Access control: enforcing the decision you already made

Ask a clinic if they have access control, and most point to a written policy: who is allowed to see what, organized by role. That document can be genuinely well made. It can also have nothing to do with what actually happens on the floor.

What the rule actually requires

Access control is a Required standard: implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to those persons or software programs that have been granted access rights as specified under information access management (45 CFR 164.312(a)(1), cross-referencing 164.308(a)(4)).

Read that cross-reference carefully. This standard does not decide who should have access to what. That decision happens elsewhere, in the administrative safeguards, under information access management. What 164.312(a)(1) requires is that your systems actually enforce the decision you already made.

Which means a clinic can do the thinking and still fail the standard. A beautiful role matrix in a Word document, and one shared login for the whole front desk, is a failure of 164.312(a)(1). The policy exists. The enforcement does not.

The four implementation specifications

• Unique user identification (Required). Every person gets their own credential. Not a role, not a station, a person.
• Emergency access procedure (Required). A defined way to get to ePHI during an emergency, when the normal access path is unavailable.
• Automatic logoff (Addressable). Sessions end after inactivity, so a device left unlocked does not stay open indefinitely.
• Encryption and decryption (Addressable). Data is unreadable without the right key, on top of whatever access rules apply.

Addressable does not mean optional here either. It means you assess whether the measure is reasonable for your clinic, then implement it or document an equivalent alternative. For automatic logoff and encryption on systems holding a child’s clinical record, the honest assessment rarely lands on “not reasonable for us.”

“A beautiful role matrix in a Word document, and one shared login for the whole front desk, is a failure of 164.312(a)(1).”

What real access control looks like, next to what most clinics have

	What the rule requires	What most clinics actually have
Identity	Every person has their own login	A shared front-desk login, a shared EHR account for “whoever’s on shift”
Enforcement	The system technically prevents access outside the granted role	A policy document describing who should have access, unconnected to what the software actually allows
Traceability	Any access can be tied to one named person	“Someone on the front desk looked at it” is the ceiling of what can be shown
Session behavior	Devices lock after inactivity	A tablet left open on a desk all afternoon

The trap is that the left column and the right column can coexist peacefully for years. A shared login does not break anything visibly. It just means that the moment someone needs to know who actually opened a specific child’s record, the honest answer is: any of six people, we cannot say which one.

Why unique logins are the hinge

Nearly everything else in the Security Rule that depends on tracing an action back to a person depends on unique user identification working. Audit controls (164.312(b)) exist to answer who accessed what and when. That question has no answer if four people share one login. Sanctions cannot be applied to a specific person for a specific violation if the system cannot say which person acted. Termination cannot cleanly revoke one person’s access if that person’s access was never distinct from anyone else’s.

A shared account is not a smaller version of proper access control. It is the removal of the one thing that makes every other technical safeguard provable.