EHR security config change
Analyst needs User Security for a role fix. AC-2(6) JIT elevates for 2 hours after approval; standing 'EHR Security Admin' is no longer permanent on their account.
Dynamic Privilege Management
High Risk
Complex
High Cost
AC-2(6) enhances base AC-2 by requiring the organization to implement dynamic privilege management capabilities. Where base AC-2 and AC-6 assign relatively static roles, this enhancement adds the ability to grant, adjust, or revoke privileges dynamically based on context (time, task, approval, risk signal) — reducing standing power over ePHI systems.
Control Objective
Grant elevated privileges to ePHI and supporting systems dynamically for a task window, then remove them automatically — minimizing standing privileged access.
Implementation Guidance
- Deploy PAM / JIT elevation for domain, EHR security, database, and cloud admin roles.
- Require ticket or MFA step-up before privilege activation.
- Scope elevation to the minimum resource set (one OU, one EHR environment, one subscription).
- Auto-expire elevations; alert if extended repeatedly.
- Use risk signals (impossible travel, malware alert) to revoke dynamic privileges mid-session where tooling allows.
- Keep standard clinical roles relatively static; focus dynamic management on privileged and break-glass paths first.
- Log privilege on/off events into SIEM (pairs with AC-2(4)).
- Pilot with IT admins before expanding to revenue-cycle super users.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Nightly interface restart
Engineer checks out temporary rights to the interface engine host, restarts the HL7 process, and privileges drop — no 24/7 local admin on the ePHI broker.
Suspected account compromise
UEBA flags anomalous behavior; dynamic privilege engine revokes elevated tokens while investigation proceeds, beyond simply disabling the whole account later.
Best Practices
- Default standing privilege to none for admins.
- Short TTLs; justify extensions.
- Pair with MFA and session recording.
- Prefer resource-scoped elevation.
- Review chronic elevators monthly.
- Document dynamic rules in the access standard.
Common Gaps & Violations
- PAM purchased but admins still have standing Domain Admins.
- Elevations last days by default.
- No approval on JIT for production ePHI.
- Dynamic rules undocumented and known only to one engineer.
- Clinical 'superuser' rights still permanent and broad.
Required Documentation
- Dynamic privilege management standard (AC-2(6))
- PAM/JIT architecture and scope
- Elevation approval rules and TTLs
- Sample elevation logs
- Standing vs dynamic privilege inventory
How to Test & Validate
- Request elevation; confirm time-boxed grant and auto-remove.
- Verify actions outside elevated scope fail.
- Review users with standing privileged groups — justify each.
- Confirm SIEM receives elevation events.
- Test revoke-on-risk if implemented.
Audit Considerations
Assessors look for standing admin populations. Showing JIT check-out metrics demonstrates AC-2(6) maturity beyond static RBAC spreadsheets.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(a)(1) Access Control — minimum necessary technical access; dynamic privilege supports least privilege over time.
- 164.308(a)(4) Information Access Management — access modified as needed for the task.
- 164.308(a)(3)(ii)(A) Authorization and/or Supervision — elevations can require supervised/approved activation.
- 164.312(b) Audit Controls — privilege changes and use must be examinable.
Compliance Tips
- Start AC-2(6) with infrastructure admins touching ePHI hosts.
- Publish a 'no standing Domain Admin' goal with exceptions board.
- Tie elevations to change tickets for production.
Frequently Asked Questions
How does AC-2(6) differ from AC-6?
AC-6 is the least-privilege principle for assigned rights; AC-2(6) adds dynamic grant/adjust/revoke capabilities so privileges are not always standing.
Is RBAC enough?
RBAC is necessary but often static. Dynamic privilege management layers JIT/time-bound elevation on top.
Must clinicians use JIT for charting?
Usually no — focus on privileged/admin functions. Clinical access stays role-based with reviews.
References & Resources
- NIST SP 800-53 Rev. 5 — AC-2(6)
- Related controls: AC-2, AC-6, AC-2(7), IA-2, AU-6
Related Guidelines
Related controls that commonly accompany AC-2(6).
Need Help Implementing AC-2(6)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.