Access Control
This standard requires the CE to implement technical policies and procedures for electronic information systems that maintain ePHI in order to allow access only to those persons or software programs that have been granted access rights as specified in the administrative safeguards. There are four implementation specifications within this standard: Unique user identification (required). The CE must assign a unique name or number for identifying and tracking each user’s identity. Emergency access procedure (required). The CE must establish procedures for obtaining necessary ePHI in an emergency. Automatic log-off (addressable). The CE must implement electronic processes that terminate an electronic session after a predetermined time of inactivity. Encryption and decryption (addressable). The CE should implement a mechanism to encrypt and decrypt ePHI as needed. Audit controls. This standard requires the CE to implement hardware, software, and procedures that record and examine activity in the information systems that contain ePHI. Integrity. This standard requires the CE to implement policies and procedures to protect ePHI from improper alteration or destruction. Person or entity authentication. This standard requires the CE to implement procedures to verify that a person or entity seeking access to ePHI is in fact the person or entity claimed. Transmission security. This standard requires the CE to implement technical measures to guard against unauthorized access to ePHIbeing transmitted across a network. There are two implementation specifications with this standard: Integrity controls (addressable). The CE must implement security measures to ensure that electronically transmitted ePHI is not improperly modified without detection.
