Section § 164.312(a)(1)Access control

What it says

(a)(1) Standard: Access control. Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4).

(2) Implementation specifications:

(i) Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity.

(ii) Emergency access procedure (Required). Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.

(iii) Automatic logoff (Addressable). Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.

(iv) Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information.

HIPAA, the United States rules protecting health information, § 164.312(a)(1)

What is in the packs for this

Each one helps with this requirement.

• XLSExcel

  Security Rule Safeguard Register

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Lists the 22 Security Rule standards and their 41 implementation specifications in plain words, required or addressable, with an owner and the evidence to keep.
• DOCWord

  Site & Business Unit Continuity Plan Template

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this standard's emergency access procedure. One site's or business unit's plan for losing its building, a large part of its people, a supplier or its systems, with the first steps, the minimum resources and the vital records.