Requirement
164.312(a)(1) - Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4)[Information Access Management].
Implementation Specifications
Unique User Identification (Required) - 164.312(a)(2)(i)
Requirement: Assign a unique name and/or number for identifying and tracking user identity.
Emergency Access Procedure (Required) - 164.312(a)(2)(ii)
Requirement: Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.
Automatic Logoff (Addressable) - 164.312(a)(2)(iii)
Requirement: Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.
Encryption and Decryption (Addressable) - 164.312(a)(2)(iv)
Requirement: Implement a mechanism to encrypt and decrypt electronic protected health information.
Explanation
Access controls provide users with rights and/or privileges to access and perform functions using information systems, applications, programs, or files. Access controls should enable authorized users to access the minimum necessary information needed to perform job functions.
