164.312(a)(1) Access Control (Standard)
Technical safeguard · Standard
The requirement as we hold it
Access Control (Standard). Implement technical policies and procedures to allow only authorized persons or software programs access to ePHI. NIST recommends identity, authentication, authorization, and session management aligned to SP 800-53 AC family.
The examiner asks
- Show me the technical policy that lets only authorised persons or software reach ePHI.
- Where are identity, authentication, authorisation and session rules set?
Evidence to bring
- the access control policy
- the system configuration
Source: 164.312(a)(1) at eCFR. Our statement of the clause, not the instrument verbatim.