HIPAA Security Rule access control requirements
HIPAA's Security Rule requires a unique login for each user and an emergency access procedure. Automatic logoff and encryption are addressable, not optional.
HIPAA’s Security Rule sets its access control standard in 45 CFR 164.312(a)(1): your systems must let in only the people and software programs you have granted access. Four implementation specifications sit under it. Two are required and two are addressable. Around them are the rules on who gets access (164.308(a)(3) and (a)(4)), on verifying each person (164.312(d)), and on recording activity (164.312(b)). What “required” and “addressable” mean is in What is the HIPAA Security Rule?
How the access rules fit together
The rules split into a decision and its enforcement. The administrative side, in 164.308, decides who should have access. Workforce security in 164.308(a)(3) asks you to give workforce members appropriate access and keep out those who shouldn’t have it. Information access management in 164.308(a)(4) asks for policies on authorizing access, and on setting up, documenting, reviewing and changing each user’s access.
The technical side, in 164.312, makes the systems follow that decision. Access control allows in only those granted rights under 164.308(a)(4). Person or entity authentication checks that someone signing in “is the one claimed”. Audit controls record and examine what happens in systems that hold electronic protected health information (ePHI).
The two sides depend on each other. If nobody decides when a per-diem clinician’s access ends, the EHR has nothing to enforce.
The requirements and what to check
The table covers the specifications that touch logins. A required item has no exception; an addressable one needs a documented decision.
| Requirement | Status | What it asks | What to check in each system |
|---|---|---|---|
| Unique user identification, 164.312(a)(2)(i) | Required | A unique name or number for identifying and tracking each user | Every person, including per-diem and billing company staff, has their own login |
| Emergency access procedure, 164.312(a)(2)(ii) | Required | Procedures for getting necessary ePHI during an emergency | A written way in when the usual admin or sign-in method isn’t available |
| Automatic logoff, 164.312(a)(2)(iii) | Addressable | End a user’s sign-in after a set time of inactivity | Shared workstations sign out on their own, or you have documented why not |
| Encryption and decryption, 164.312(a)(2)(iv) | Addressable | A way to encrypt and decrypt ePHI | Laptops and phones that store ePHI are encrypted, or you have documented why not |
| Person or entity authentication, 164.312(d) | Standard | Verify that the person signing in is who they claim to be | You know how each system checks identity, and whether that is a password alone |
| Access authorization, establishment and modification, 164.308(a)(4)(ii)(B)–(C) | Addressable | Policies for granting access, and for setting up, reviewing and changing it | Each grant has a request and an approval, and role changes update access |
| Termination procedures, 164.308(a)(3)(ii)(C) | Addressable | End access when employment or another arrangement ends | A departure triggers removal in every system the person used |
| Information system activity review, 164.308(a)(1)(ii)(D) | Required | Regularly review records such as audit logs and access reports | Someone reviews the logs on a set schedule and keeps evidence |
| Log-in monitoring and password management, 164.308(a)(5)(ii)(C)–(D) | Addressable | Monitor sign-in attempts; create, change and protect passwords | Failed sign-ins are watched, and passwords aren’t sent by text or chat |
“Standard” means the rule sets the standard with no implementation specifications under it. You meet it directly, as 164.306(c) requires.
Working through the addressable items
For each addressable item, 164.306(d)(3) sets a short process. Assess whether it is reasonable and appropriate in your setting, given what it would add to protecting ePHI. If it is, implement it. If it isn’t, write down why and use an equivalent measure where that is reasonable and appropriate.
Your size counts in that assessment. Under 164.306(b), you weigh your size and capabilities, your systems, the cost and the risk when you choose measures. A two-doctor practice and a health system can reach different answers for automatic logoff. Each has to record how it decided. Section 164.316 requires you to keep that record for six years from creation or from the date it was last in effect, whichever is later.
The process doesn’t apply to required items. A practice can’t decide that unique logins are unreasonable for its front desk.
What about multi-factor authentication?
Multi-factor authentication means a second check after the password, such as a code on your phone. The current 164.312(d) asks you to verify identity and names no method. HHS proposed a multi-factor requirement in January 2025 (90 FR 898), at a proposed 164.312(f)(2)(ii), but that rule is still a proposal.
HHS’s Healthcare and Public Health Cybersecurity Performance Goals are voluntary. They list multi-factor authentication as an essential goal for accounts reachable from the internet, where it is safe and technically possible. The same list includes prompt removal of access for departing staff, contractors and volunteers, and separate accounts for admin work. It also lists unique credentials, which HHS ties to spotting unusual activity and stopping an attacker from moving across your network. For how a shared login interacts with a code on one phone, see Sharing two-step verification across a team.
Where to start
Start with a list. Write down every system that holds or shows ePHI: the EHR, practice management, telehealth, e-prescribing, imaging, and payer and lab portals. For each one, note its logins, who uses each, whether it signs users out on its own, and whether it keeps an activity log.
Fix unique user identification next, because it is required and allows no alternative. A login that several people use fails that row. Can staff share an EHR login? covers where those logins come from and how to split them. Move to the addressable rows after that, and record each decision as you make it.
Frequently asked questions
Is automatic logoff mandatory under HIPAA?
It is addressable. You assess whether it is reasonable and appropriate for each system. If you decide not to use it, you document why and put an equivalent measure in place where that is reasonable and appropriate.
Do billing company staff need their own logins in our systems?
Yes. The rule requires a unique name or number for each user, and a user is any person with authorized access. Staff from a billing company who sign in to your systems are users.
How often do we have to review access logs?
The rule says to review records of system activity regularly and sets no interval. Choose one, write it in your policy and keep evidence of each review.
How fast must we remove a departing employee's access?
The current rule asks for procedures to end access when employment or another arrangement ends, as an addressable specification, with no deadline. HHS's voluntary performance goals list prompt removal as an essential goal.
How Junify handles this
- Doing this by hand
- You give every clinician and staff member their own login, open and close access for each per-diem shift and vendor staff change, and keep a record of who used which system and when for someone to review.
- With Junify
- For logins you can't split per person yet, Junify shows who used them. Your admin adds the login to Junify and assigns it to the people who may use it. They verify on their own phone and click to sign in without seeing the password, and each use is recorded under their name. When a shift, job or vendor contract ends, the admin removes the assignment. You can export the record of who signed in, and when, as a CSV.
Sources
- eCFR: 45 CFR 164.304, Definitions
- eCFR: 45 CFR 164.306, Security standards: General rules
- eCFR: 45 CFR 164.308, Administrative safeguards
- eCFR: 45 CFR 164.312, Technical safeguards
- eCFR: 45 CFR 164.316, Policies and procedures and documentation requirements
- HHS Cyber Gateway: Healthcare and Public Health Cybersecurity Performance Goals
- Federal Register, 90 FR 898 (January 6, 2025): HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule
-
Can staff use personal devices to access clinical systems?
HIPAA allows it with safeguards. Treat each personal laptop or phone as a workstation, write a device policy, and protect both the device and the login.
-
Who is responsible for user accounts in your practice's cloud software?
The vendor secures its service. Your practice decides who gets a login and removes it when they leave. HHS says to sign a BAA and put the split in writing.
-
The HHS cybersecurity performance goals for accounts and logins
Four of HHS's 10 essential goals cover logins: MFA, revoking departing staff's access, unique credentials and separate admin accounts. HHS calls them voluntary.