Healthcare account access

Running logins at a medical practice comes down to how you verify each person, how you grant and end access, and how you record who did what. HIPAA’s Security Rule sets requirements for each. Logins that several people still share are where those requirements are hardest to meet.

Where the requirements come from

The Security Rule is Subpart C of 45 CFR Part 164. Section 164.302 applies it to covered entities, which include health care providers that send health information electronically for transactions such as claims. It applies equally to business associates, the vendors that handle patient information on a provider’s behalf. What is the HIPAA Security Rule? explains how it is organized, and What is a HIPAA business associate? explains where the vendor line falls.

The rule doesn’t scale down by size, but it lets you choose how you meet it. Under 164.306(b), you weigh your size, your systems, the cost and the risk when you pick your measures. Some specifications are required and some are addressable. Addressable means you assess each one and either implement it or document why not and use an equivalent measure where that is reasonable and appropriate.

HHS has also published two documents that bear on this. HHS’s Healthcare and Public Health Cybersecurity Performance Goals are a voluntary list of priorities, divided into essential and enhanced goals. And HHS proposed changes to the Security Rule in January 2025 (90 FR 898). Those changes are not law unless HHS finalizes them.

Where shared logins persist

The rule assumes one login per person. Section 164.304 defines a user as “a person or entity with authorized access”, and 164.312(a)(2)(i) requires a unique name or number for each user. Shared logins persist where people or systems don’t fit that assumption easily.

Per-diem and locum clinicians are the first case. HIPAA counts people whose work is under your direct control as workforce, whether or not you pay them (45 CFR 160.103). When their account isn’t ready for the first shift, someone may lend them a login.

Billing company staff are users of your systems when they sign in, yet the company’s staffing changes happen outside your practice. If the practice gives the company one login, nobody at the practice knows who used it on a given day.

Telehealth, scheduling, payer and lab portals each have their own sign-in, separate from the EHR. Each is one more place where a login can end up shared, and each needs the same decisions about who may use it.

Interface and device accounts are the last case. They connect lab equipment or other software to your systems, and no person uses them. The access control standard in 164.312(a)(1) covers “persons or software programs”, so they need rules too. Can staff share an EHR login? goes through each case and how to split it.

A related gap is personal devices. Under 164.304, a workstation is a computing device such as a laptop or desktop. A staff member’s own laptop that opens the EHR fits that wording, so workstation use and workstation security in 164.310(b) and (c) reach it.

What the rules ask for

These are the parts of the Security Rule that touch logins. “Standard” means the rule sets a standard with no implementation specifications under it; you meet it directly.

The voluntary performance goals point the same way. Their essential goals include prompt removal of access for departing staff and contractors, separate user and admin accounts, and multi-factor authentication for accounts reachable from the internet. They also list unique credentials, which HHS ties to spotting unusual activity and stopping an attacker from moving between systems. The requirement-by-requirement checks are in HIPAA Security Rule access control requirements.

How to handle logins that stay shared

For shared logins, that leaves two jobs. Split every login that can be split. For the rest, decide how you’ll know who used it. There are three ways to approach it.

You can mix these system by system. Comparing ways for several people to use one shared account compares the tools in more depth. Admin logins have their own concerns, covered in Managing privileged accounts.

Where to start

Start from your risk analysis, which 164.308(a)(1)(ii)(A) makes required, and list every system and login that touches patient information. HIPAA Security Rule access control requirements says what to note for each one.

Next, split what can be split. Give per-diem clinicians their own login before their first shift, and close it when the engagement ends. Ask each vendor whose staff sign in to your systems for a list of those people, and give each of them access you can remove on its own.

Then decide the record for each login that stays shared, and set a schedule for reviewing activity logs. Check that each business associate contract is in writing and says what the rule requires. For the general shared-account picture outside healthcare, see Managing shared accounts.