Pull your electronic health record's active user list right now. Count the accounts. Then count the people who badge into your building on a given week. If the first number is meaningfully larger than the second, you have an access control problem — and it is the single most common finding in Office for Civil Rights investigations of small and mid-sized practices.

This article is for the person who owns that list: the practice administrator, privacy officer, or compliance lead. It covers what HIPAA access controls actually require under the Security Rule, who in your organization performs each task, how fast it has to happen, and what the documented evidence looks like when a regulator or a cyber insurance underwriter asks. No clinical advice, no theory — workflows and paper.

What Are HIPAA Access Controls? The Short Answer

HIPAA access controls are the technical and administrative measures required under 45 CFR §164.312(a)(1) that limit electronic protected health information to the people and software programs authorized to see it. The standard has four implementation specifications:

  • Unique user identification (Required) — every workforce member gets their own named account. No shared "frontdesk" login.
  • Emergency access procedure (Required) — a documented way to reach ePHI during an outage or crisis.
  • Automatic logoff (Addressable) — sessions terminate after a defined period of inactivity.
  • Encryption and decryption (Addressable) — a mechanism to encrypt and decrypt ePHI at rest.

"Addressable" does not mean optional. It means you implement it, or you document why it is not reasonable and appropriate for your environment and what you did instead. That written analysis is the evidence. If it does not exist, the specification is simply unmet.

The Provisions Investigators Read Alongside §164.312(a)(1)

Access control never gets evaluated alone. When OCR or a forensic examiner reviews an incident, they pull a cluster of related requirements. Know all of them:

§164.308(a)(3) — Workforce Security

Authorization and supervision, workforce clearance, and termination procedures. This is where the departed-employee account lives. Your obligation is to have a procedure for ending access when employment ends or a role changes.

§164.308(a)(4) — Information Access Management

Access authorization (who approves a grant), and access establishment and modification (how you document, review, and change it). This is the policy layer that sits above the EHR's permission screens.

§164.312(b) and §164.312(d) — Audit Controls and Authentication

Both are Required, no addressable escape hatch. You must record and examine activity in systems containing ePHI, and you must verify that a person seeking access is who they claim to be. Text of the rule and HHS's implementation guidance are on the HHS Security Rule page.

§164.502(b) and §164.514(d) — Minimum Necessary

The Privacy Rule requires you to identify the classes of persons who need access, the categories of ePHI they need, and conditions appropriate to that access. In practice, this is the written justification for your role matrix. HHS's minimum necessary guidance is worth handing to any manager who argues that everyone needs full chart access.

One more thing to watch: HHS published a proposed rule in January 2025 that would substantially modernize the Security Rule, including tightening access management, removing the required/addressable distinction, and mandating multi-factor authentication with narrow exceptions. As of this writing it remains a proposal, not law. But the direction of travel is unmistakable, and practices that build MFA and formal access reviews now will not be scrambling later.

Build the Role Matrix Before You Touch a Permission Screen

Most practices configure access backward: someone gets hired, IT copies the permissions of whoever sits nearby, and nobody documents why. Three years later the billing coordinator can order labs and the scheduler can view behavioral health notes.

Start with a one-page matrix. Rows are job roles — not names. Columns are systems and data categories. Cells contain the permission level and a short justification tied to job function.

  • Front desk / scheduler: demographics, appointment, insurance eligibility. No clinical notes. No billing adjustments.
  • Medical assistant: chart view and vitals entry for patients on today's schedule and assigned panel. No financial records.
  • Billing specialist: claims, remittance, diagnosis and procedure codes. Read-only clinical access limited to documentation needed for coding.
  • Provider: full clinical access to assigned and covering patients. Break-the-glass logging for others.
  • Practice administrator: user administration and reports. Not routine clinical chart access.
  • Third-party billing vendor: scoped, named accounts — never a shared credential, never a generic "vendor" login.

Sensitive categories deserve their own row: behavioral health, substance use treatment records subject to 42 CFR Part 2, HIV and reproductive health data, and employee-patient charts. Restrict those by default and grant them explicitly.

Have each department manager sign the matrix. That signature is your access authorization evidence under §164.308(a)(4)(ii)(B). Re-approve annually.

The 24-Hour Termination Workflow

Here is the sequence that survives scrutiny. Assign a named owner to each step, with a backup.

  1. Hour 0 — HR or the practice manager notifies the access owner by a defined channel (a ticket, not a hallway conversation). The notice includes last day worked and whether the departure is voluntary.
  2. Same business day for involuntary departures, within 24 hours otherwise — disable, don't delete. Disabling preserves the audit trail. Deletion destroys evidence you may need.
  3. Cover every system, not just the EHR. Clearinghouse portal, payer portals, e-prescribing, imaging, lab result portals, patient communication platform, VPN, email, cloud storage, phone system, badge reader, and any password manager vault.
  4. Collect physical assets. Laptop, phone, badge, keys, and any paper containing PHI taken home.
  5. Rotate shared secrets the person knew — the alarm code, the Wi-Fi passphrase for the clinical network, any service account credentials.
  6. Run a final access review on that user's last 90 days of activity if the departure was contentious or the role had broad access.
  7. Record the completion with date, time, systems touched, and the initials of who did it. File it with the termination packet.

That last step is the one practices skip, and it is the one that matters. An investigator will not accept "we always do that." They will ask for the record for three specific former employees.

Quarterly Access Reviews: What the Evidence Actually Looks Like

Once a quarter, export the full active user list from every system that touches ePHI. Sit down with each department manager and walk the list line by line. The output is a signed, dated document that shows four things for every account:

  • The account holder's current role and employment status
  • The permission level assigned
  • Whether that level still matches the role matrix
  • The action taken — confirmed, reduced, or disabled — and the date

Flag anything that looks like accumulation. A nurse who covered the front desk during a staffing gap in March should not still hold scheduling-admin rights in December. Privilege creep is the quiet failure mode: nobody granted anyone too much at once, it just piled up.

Also review the accounts nobody owns — service accounts, test logins, the account your prior IT contractor created in 2021. If you cannot name a person responsible for it, either assign one or kill it.

Retain each review for six years from creation or last effective date, per §164.316(b)(2)(i). If assembling that evidence set by hand is what keeps getting bumped down your list, a platform that generates your risk analysis, access control policies, and the supporting document set gives you a defensible baseline in an afternoon rather than a quarter.

Audit Controls: Who Watches the People With Access

Granting the right permissions is half the job. Detecting misuse of correctly granted permissions is the other half, and it is where practices are weakest.

The classic scenarios: a staff member looks up a coworker's chart, a relative's chart, their own chart, or a local celebrity's chart. None of those require a hacked password. They require curiosity and an unmonitored log.

Set a monthly cadence for reviewing at minimum:

  • Same-surname access — user last name matches patient last name
  • Self-access — user viewing their own record outside the patient portal
  • Break-the-glass events — every override, with a written justification from the user
  • After-hours activity — chart access outside scheduled shifts
  • Bulk exports and report runs — anyone pulling more than a defined threshold of records
  • Failed login clusters — repeated failures against one account

Document who ran the review, what date range it covered, what was flagged, and how each flag resolved. "Reviewed, no anomalies" with a date and signature is acceptable evidence. Nothing at all is not.

Vendor and Remote Access: The Accounts You Didn't Create

Your billing company, your IT contractor, your EHR vendor's support team, and your transcription service all have paths to ePHI. Each needs named accounts, scoped permissions, session logging, and an expiration date on standing remote access.

Two rules that eliminate most of the risk: no shared vendor credentials, and no permanent always-on remote access tools. Support sessions should be initiated by your staff and terminated when the ticket closes.

Every one of those vendors is a business associate and needs a signed agreement on file before access is granted — if any relationship is running on a handshake or a contract you cannot locate, a signature-ready business associate agreement closes that gap quickly. Then add a column to your vendor list recording which named individuals at each firm hold credentials in your systems, and re-confirm it annually.

Where Practices Fail When OCR Asks

Patterns worth checking yourself against, drawn from the kinds of findings that recur across resolution agreements and the incidents visible on the OCR breach portal:

  • Shared logins at the front desk. Convenient, and a flat violation of a Required specification. Also makes every audit log useless.
  • No risk analysis linking access controls to identified risk. Your controls have to trace back to a documented, current risk analysis under §164.308(a)(1)(ii)(A).
  • Policies written once, never reviewed. A policy dated four years ago that references a system you no longer use signals that nothing is operational.
  • Addressable specifications skipped without documentation. No automatic logoff, no encryption, and no written rationale for either.
  • Audit logs enabled but never examined. Having the capability is not the requirement. Examining the activity is.

A 90-Day Plan You Can Actually Finish

Days 1–15: Export active user lists from every system holding ePHI. Reconcile against your current payroll roster. Disable anything unmatched. This alone resolves the most common finding.

Days 16–40: Draft the role matrix. Get manager signatures. Reduce any account that exceeds its role.

Days 41–60: Write or update the access control policy, the termination procedure, and the audit log review procedure. Assign named owners and backups. Confirm your risk analysis covers access control and is dated within the last twelve months.

Days 61–90: Turn on MFA everywhere it is supported, starting with remote access and administrator accounts. Run your first documented audit log review. Set calendar reminders for the quarterly access review. HHS and ONC's Security Risk Assessment Tool and NIST's SP 800-66 Revision 2 are free and map cleanly to these steps.

Strong HIPAA access controls are not a technology purchase. They are a small set of repeatable administrative habits, performed on schedule, with a signature at the end of each one.

If your policy binder is out of date, or your last risk analysis predates your current EHR, start there — build the risk analysis and policy set that your access controls have to trace back to, then run the 90-day plan against it. The user list reconciliation you do in week one will tell you more about your real exposure than any assessment you buy.