Requirement
164.308(a)(3) - Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under [the Information Access Management standard], and to prevent those workforce members who do not have access under [the Information Access Management standard] from obtaining access to electronic protected health information.
Implementation Specifications
Authorization and/or Supervision (Addressable) - 164.308(a)(3)(ii)(A)
Requirement: Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed.
Workforce Clearance Procedure (Addressable) - 164.308(a)(3)(ii)(B)
Requirement: Implement procedures to determine that the access of a workforce member to electronic protected health information is appropriate.
Termination Procedures (Addressable) - 164.308(a)(3)(ii)(C)
Requirement: Implement procedures for terminating access to electronic protected health information when the employment of a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) [the Workforce Clearance Procedure] of this section.
Explanation
Within a covered entity’s environment, workforce members that need access to EPHI to carry out their duties must be identified. For each workforce member, or job function, the covered entity must identify the EPHI that is needed, when it is needed, and make reasonable efforts to control access to the EPHI. This will also include identification of the computer systems and applications that provide access to the EPHI. Covered entities must provide only the minimum necessary access to EPHI that is required for a workforce member to do his or her job.
