Ask a facility administrator who can see resident records and the answer is usually "the people who need to." Ask IT to prove it and the conversation gets more complicated. Permissions pile up over time as people change roles, cover for coworkers or receive temporary access that is never removed. After a few years, a long-time employee may hold access to systems they have not used in a decade.
Two HIPAA concepts address this: the minimum necessary standard and the Security Rule's access control requirements. A regular access review ties them together.
The Privacy Rule's minimum necessary standard generally requires covered entities to make reasonable efforts to limit the use, disclosure and request of protected health information to the minimum needed to accomplish the purpose. It does not apply to disclosures for treatment.
The Security Rule asks for technical and administrative safeguards, including:
Unique user identification for each person
Access authorization and establishment policies that define how access is granted
Workforce clearance and termination procedures so access is appropriate and removed when employment ends
Information system activity review of audit logs and access reports
An access review demonstrates these in practice.
Create a list of job roles and the systems and data each role should reach. Keep it simple and practical:
Which EHR modules does each role need?
Who needs financial or billing data?
Who may view or export reports?
Who needs administrator access?
Roles make future requests easier, because new staff are assigned a template rather than a custom list.
Export user lists from your EHR, email system, file shares, phone system, billing platform and any other application with PHI. Include:
User name and role
Permissions or groups
Last sign-in date
Account status
Include vendor and shared accounts, which are often overlooked.
Send each department head the list for their team and ask them to confirm or correct it. Questions to answer:
Does everyone on this list still work here, in this role?
Does each person need all the access they have?
Are there accounts for people who have not signed in recently?
Are there generic or shared accounts, and why?
Who has administrator privileges, and is that still needed?
IT can flag accounts with no recent activity, but the business owner decides whether access is appropriate.
Remove or reduce access as needed, and record changes made, who approved them and when. Keep the signed or emailed confirmations. This record becomes evidence of an active compliance program.
Access review is more than lists. Also sample the logs for unusual activity:
Staff viewing records of residents not on their unit
Access to the records of coworkers, family or public figures
Large exports or repeated searches
Logins at unusual hours or from unusual places
Most EHRs offer audit reports. Check what yours provides and schedule someone to look at them.
The rule does not state a frequency, but quarterly reviews of privileged and clinical access and an annual review of everything else is a common, defensible practice. Also review whenever someone changes roles, and immediately when someone leaves.
Most access problems occur at job transitions. Make sure HR notifies IT on the day someone resigns or is terminated, and that managers request changes when employees transfer. The old access should end when the new access begins.
Granting broad access to avoid repeated requests
Keeping accounts for former agency staff
Letting contractors keep accounts after projects end
Reviewing permissions without checking whether they match job duties
Assuming the EHR vendor handles it for you
Pick your EHR and email systems first and complete one review cycle. UnityCare IT can help pull access reports, flag inactive and over-privileged accounts and create a repeatable review process that satisfies auditors and keeps resident information appropriately restricted.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172