164.308(a)(3)(ii)(C) Termination Procedures (Addressable)
Administrative safeguard · Addressable
The requirement as we hold it
Termination Procedures (Addressable). Implement procedures for terminating access to ePHI when employment ends or as required. NIST recommends time-bounded SLA, asset recovery, and HR-IT coordination.
The examiner asks
- Show me the termination procedure and the last time it ran end to end.
- What is the time limit between a leaver and their access being removed, and how is it proved?
Evidence to bring
- the termination procedure
- a leaver access-removal record
Source: 164.308(a)(3)(ii)(C) at eCFR. Our statement of the clause, not the instrument verbatim.