164.308(a)(4)(ii)(B) Access Authorization (Addressable)
Administrative safeguard · Addressable
The requirement as we hold it
Access Authorization (Addressable). Implement policies for granting access to ePHI via workstation, transaction, program, or process. NIST recommends formal access request workflow with approval and provisioning records.
The examiner asks
- Show me the workflow that grants access to ePHI, from request to provisioning.
- Who approves, and where is the approval stored?
Evidence to bring
- the access request workflow
- a provisioning record
Source: 164.308(a)(4)(ii)(B) at eCFR. Our statement of the clause, not the instrument verbatim.