# Managing user accounts in pharmacy and long-term care systems Pharmacies and nursing homes that bill electronically fall under HIPAA. Give each person a login, match access to the job, end it on departure, and keep logs. Updated: October 16, 2026 Pharmacies and nursing homes fall under HIPAA's Security Rule as long as they send health information electronically for standard transactions such as claims. The account basics are the same as in a doctor's office. Give each person their own login and limit access to what their job needs. End access when they leave, and record who did what. Pharmacies that handle electronic prescriptions for controlled substances also follow DEA rules in 21 CFR Part 1311, which set their own access and audit trail requirements. ## When HIPAA applies to a pharmacy or care facility Under 45 CFR 160.103, a health care provider is a "covered entity" when it sends health information electronically for a transaction HHS has adopted a standard for. OCR's breach report gives health care claims as one example. The same section defines health care to include selling or dispensing a drug under a prescription. HHS's own summary of covered entities lists pharmacies and nursing homes by name, alongside doctors and clinics. The rules apply to more people than your employees. HIPAA's "workforce" covers employees, volunteers, trainees, and others whose work is under your direct control, whether or not you pay them. OCR's audit protocol, the checklist HHS auditors use, describes workforce members as employees, on-site contractors, students, and volunteers. Agency nurses and float pharmacists who work under your direct control need the same account controls as staff. ## One login for each person Unique user identification, in 164.312(a)(2)(i), is required. You assign a unique name or number to identify and track each user. OCR's Summer 2021 newsletter explains the problem with shared logins. They remove accountability, so if information is entered, changed, or deleted wrongly, it's hard to find the person responsible. Shared workstations at a nursing station or a pharmacy counter need one more control. Automatic logoff, in 164.312(a)(2)(iii), signs a user out after a set time with no activity. It is addressable, so you assess whether it is reasonable for you. If it isn't, you document why and use an equivalent measure if one is reasonable. The same OCR newsletter notes that without it, someone else's actions on an unattended screen look like they came from the signed-in user. ## Access that matches the job Under 164.308(a)(3) and (a)(4), you set policies so each workforce member gets appropriate access and no more. The Privacy Rule's minimum necessary standard, in 164.514(d)(2), asks you to identify the job roles that need patient data. For each role, you set the kinds of data it needs and any conditions. A pharmacy technician, a pharmacist, and a billing clerk need different access. So do a nursing assistant, a charge nurse, and the business office. How finely you can split access depends on the software. Ask the vendor which roles it supports and whether it can separate viewing from changing records. ## Controlled substance e-prescriptions in the pharmacy The DEA's rules for electronic prescriptions for controlled substances add specific duties. Under 21 CFR 1311.200(e), the pharmacy decides which employees may enter dispensing information and annotate or alter those records. It must then make sure the software's access settings let only those employees in. The software has its own requirements in 1311.205. It must be able to limit who can change prescription information and who can change the access settings themselves. Under 1311.205(b)(2), "Logical access controls must be set by individual user name or role." The software must also keep an audit trail of actions such as receiving, annotating, altering, or deleting a prescription. Each record includes the date and time, the type of event, and, where applicable, the person who acted. The software must also stop anyone from changing the audit records. That audit trail only names a person if each person signs in as themselves. If the whole counter uses one login, every entry carries the same name. ## Prescribers can't share their signing method If physicians who order for your residents sign controlled substance prescriptions electronically, 21 CFR 1311.102(a) applies to them. They must not share the password with anyone, or let anyone else use their two-factor sign-in (a second check besides the password) to sign those prescriptions. ## When staff leave or change jobs Termination procedures, in 164.308(a)(3)(ii)(C), are addressable. They cover ending access when a person's job or other arrangement with you ends. OCR's audit protocol shows what auditors look at. Their list covers turning off system access when someone leaves, whether they quit or were let go. It also covers ending access for contractors, changing access when a job changes, and how quickly access ends. A shared login makes this hard. You can't end one person's access without changing the password for everyone, and then everyone needs the new one. When a system only allows one login for your location, keep a record of who knows the password and who used it. [When shared accounts can't be split into personal ones](/guides/shared-accounts/when-accounts-cannot-be-split) covers that case. ## Frequently asked questions **Is a retail pharmacy covered by HIPAA?** HHS lists pharmacies and nursing homes among covered health care providers, as long as they send health information electronically in a transaction HHS has a standard for, such as a claim. **Do agency nurses and temps need their own logins?** HIPAA's workforce includes people whose work is under your direct control, paid or not. If agency staff work under your direct control, treat them as workforce and give each one a login. **Can pharmacy staff share one login in the dispensing software?** For controlled substance e-prescriptions, the DEA requires access to be set by user name or role, and each audit record must name the person who acted, where applicable. HIPAA separately requires a unique user ID for each user. **Can a prescriber let staff sign controlled substance prescriptions for them?** No. Under 21 CFR 1311.102(a), the prescriber must not share the password or let anyone else use their two-factor means to sign controlled substance prescriptions. ## Sources - [HHS OCR, Covered Entities and Business Associates](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html) - [45 CFR 160.103, Definitions (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103) - [45 CFR 164.308, Administrative safeguards (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308) - [45 CFR 164.312, Technical safeguards (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312) - [45 CFR 164.514, Other requirements relating to uses and disclosures of protected health information (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) - [21 CFR 1311.102, Practitioner responsibilities (eCFR)](https://www.ecfr.gov/current/title-21/chapter-II/part-1311/subpart-C/section-1311.102) - [21 CFR 1311.200, Pharmacy responsibilities (eCFR)](https://www.ecfr.gov/current/title-21/chapter-II/part-1311/subpart-C/section-1311.200) - [21 CFR 1311.205, Pharmacy application requirements (eCFR)](https://www.ecfr.gov/current/title-21/chapter-II/part-1311/subpart-C/section-1311.205) - [HHS OCR, Summer 2021 OCR Cybersecurity Newsletter: Controlling Access to ePHI](https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity-newsletter-summer-2021/index.html) - [HHS OCR, HIPAA Audit Protocol (updated July 2018)](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html) - [HHS OCR, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024](https://www.hhs.gov/sites/default/files/breach-report-to-congress-2024.pdf) ## How Junify handles this **Doing this by hand** You give every clinician and staff member their own login, open and close access for each per-diem shift and vendor staff change, and keep a record of who used which system and when for someone to review. **With Junify** When a supplier or payer portal allows your site only one login, every staff change means deciding again who knows the password and logging it. With Junify, your admin adds that login once and changes its password, so only Junify holds it. Each staff member verifies on their own phone and Junify fills in the login. Each use is recorded under the person's name. When someone leaves, the admin removes their assignment and they can no longer sign in. Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when. - [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=healthcare&from=guide&cluster=healthcare-access&slug=pharmacy-care-facility-accounts) - [Book a 30-minute demo](https://www.junify.com/bpo/demo) ## More on this topic - [Can staff use personal devices to access clinical systems?](/guides/healthcare-access/byod-for-clinical-systems): HIPAA allows it with safeguards. Treat each personal laptop or phone as a workstation, write a device policy, and protect both the device and the login. - [Who is responsible for user accounts in your practice's cloud software?](/guides/healthcare-access/clinic-saas-responsibility-split): The vendor secures its service. Your practice decides who gets a login and removes it when they leave. HHS says to sign a BAA and put the split in writing. - [The HHS cybersecurity performance goals for accounts and logins](/guides/healthcare-access/hhs-cybersecurity-performance-goals-accounts): Four of HHS's 10 essential goals cover logins: MFA, revoking departing staff's access, unique credentials and separate admin accounts. HHS calls them voluntary.