164.308(a)(4)(i) Information Access Management (Standard)
Administrative safeguard · Standard
The requirement as we hold it
Information Access Management (Standard). Implement policies authorizing access to ePHI consistent with applicable HIPAA Privacy Rule requirements. NIST recommends minimum necessary, role-based, and least-privilege access.
The examiner asks
- Show me the policy that authorises access to ePHI consistently with the Privacy Rule.
- Where is the minimum-necessary and role-based rule written down?
Evidence to bring
- the information access management policy
- the role-to-access mapping
Source: 164.308(a)(4)(i) at eCFR. Our statement of the clause, not the instrument verbatim.