Security

Access Controls

Technical policies and procedures that allow only authorized persons or software programs to access ePHI.

1 min read · Last reviewed May 23, 2026

At a glance

Category
Security
Primary sources
2
Workspace handoff
compliance binder

Where this comes up

This sits inside the security risk analysis under 45 CFR 164.308(a)(1)(ii)(A) — workstation controls, EHR access roles, ePHI transmission encryption, audit logging, vendor risk, and incident response. Reviewers expect dated evidence of the control, not a policy PDF that says it exists.

Full definition

What it is in practice

45 CFR 164.312(a) requires unique user identification, emergency access procedures, automatic logoff (addressable), and encryption/decryption (addressable). Role-based access control is the standard implementation pattern.

How it shows up in your practice

Avoid shared logins; assign every workforce member a unique ID. Set automatic logoff to a reasonable interval (commonly 10-15 minutes). Review access reports quarterly and revoke promptly at termination.

Sources

Take it into the workspace

Audit access controls in the Compliance Binder

Open compliance binder
Authored by D3rx

D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.

Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.

This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.