HIPAA Security Access Control (45 CFR 164.312(a))
Technical policies and procedures for systems containing ePHI to allow access only to those granted access rights, with required specifications for unique user identification and emergency access.
Primary source
45 CFR 164.312(a) — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312#p-164.312(a)
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.312(a)) requires technical access controls on systems containing ePHI.
Unique user identification (R): assign a unique name or number for identifying and tracking user identity. Shared accounts disqualify audit logs from establishing accountability and are a recurring OCR finding.
Emergency access procedure (R): procedures for obtaining necessary ePHI during an emergency. The control must contemplate scenarios where normal access mechanisms fail (system outage, key personnel unavailable).
Automatic logoff (A): electronic procedures that terminate sessions after a predetermined time of inactivity. Workstation-level idle timeouts plus application-level session timeouts are the typical implementation.
Encryption and decryption (A): mechanism to encrypt and decrypt ePHI. Addressable does not mean optional — a risk analysis that concludes encryption at rest is unreasonable for systems holding ePHI rarely survives an audit. AES-256 is the de facto standard.
The access control standard is paired with the information access management standard at 164.308(a)(4)(4)) which sets the administrative basis for who is granted access in the first place.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Audit Controls Standard (45 CFR 164.312(b))Required technical safeguard: implement hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI.
- RegulationHIPAA Person or Entity Authentication (45 CFR 164.312(d))Required standard to verify that a person or entity seeking access to ePHI is the one claimed. The Security Rule is technology-neutral on the mechanism; risk analysis drives whether MFA is reasonable.
- RegulationHIPAA Technical Safeguards (45 CFR 164.312)Five standards covering access control, audit controls, integrity, person or entity authentication, and transmission security for ePHI.
- RegulationHIPAA Administrative Safeguards (45 CFR 164.308)Nine standards covering security management, workforce security, training, contingency planning, incident procedures, evaluation, and business associate contracts.
- ComplianceHIPAA Contingency Plan Template — 45 CFR § 164.308(a)(7)2026 HIPAA contingency plan template — 45 CFR § 164.308(a)(7) data backup, DRP, emergency mode, testing, and applications/data criticality analysis.
- SRAChange Healthcare Ransomware: What Small Practices Took AwayThe February 2024 Change Healthcare cyberattack, what HHS and UnitedHealth Group disclosed, and the small-practice lessons about clearinghouse concentration risk, contingency planning, and the Security Rule's information system activity review.
- GlossaryAccess ControlsTechnical policies and procedures that allow only authorized persons or software programs to access ePHI.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.