Part 2 substance-use chart
A care coordinator outside the Part 2 program cannot open the encounter even if a colleague tries to share a link — label policy denies unless consent/authorization attributes are present.
AC-3(3) Mandatory Access Control
High Risk
Very Complex
High Cost
AC-3(3) requires enforcing mandatory access control (MAC) over organization-defined subjects and objects, using organization-defined attributes (e.g., labels, classifications) that users cannot unilaterally change. In healthcare, MAC-style patterns appear when VIP/psych/substance-use records carry sensitivity labels that block casual sharing, when research datasets are compartmented, or when OS SELinux/AppArmor policies stop EHR service accounts from reading arbitrary host files — regardless of what a local admin wants to share.
Control Objective
Enforce non-discretionary access rules based on sensitivity labels or equivalent attributes so ePHI protections cannot be weakened by ad-hoc user sharing decisions.
Implementation Guidance
- Identify data classes needing MAC-like rules: behavioral health, substance use (42 CFR Part 2), HIV, VIP, research identifiable files.
- Assign labels or compartments in EHR, DLP, and file platforms; map user clearances/roles to those labels.
- Prevent end users from freely reclassifying labeled objects downward without an authorized process.
- On hosts running ePHI workloads, enable OS mandatory policies (SELinux/AppArmor) for service accounts.
- Document label inheritance for copies, exports, and prints.
- Train workforce that 'I can see it, so I can email it' fails under MAC rules.
- Monitor attempts to access cross-compartment charts or files.
- Integrate MAC decisions with AC-3(4) DAC for day-to-day sharing within allowed bounds.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Research identifiable extract
Dataset labeled 'Identifiable Research — Protocol 22' is readable only by cleared analysts; copying to a general SharePoint library is blocked by DLP/MAC rules.
EHR app service confined on Linux
SELinux confines the interface engine so a compromised process cannot read /etc/shadow or unrelated PHI directories on the host.
Best Practices
- Start MAC with a few high-sensitivity classes, not every field.
- Keep label taxonomy simple enough clinicians understand.
- Block uncontrolled downgrades of sensitivity.
- Apply host MAC to servers holding ePHI.
- Log cross-label access denials.
- Align labels with HIPAA minimum necessary and special privacy laws.
Common Gaps & Violations
- Sensitivity flags exist in EHR but are advisory only.
- Users can remove 'confidential' labels freely.
- VIP charts protected only by policy memo, not technical labels.
- File shares ignore classification when users drag-and-drop.
- Hosts run ePHI apps with MAC disabled 'for troubleshooting' permanently.
Required Documentation
- MAC / labeling policy and attribute definitions
- Subject-object clearance mapping
- Configuration of EHR/DLP/OS MAC controls
- Exception and relabeling procedure
- Sample denial logs for cross-label access
How to Test & Validate
- Attempt access to a labeled sensitive chart with an uncleared role; confirm deny.
- Attempt to downgrade or remove a sensitivity label as a standard user; confirm block.
- Verify export/copy retains or enforces label restrictions.
- On a hardened host, confirm confined service cannot read out-of-policy paths.
- Review exceptions for time limits and approvals.
Audit Considerations
Assessors examine whether special-category ePHI has technical non-discretionary enforcement. Policy-only VIP protection without labels/enforcement is a frequent gap.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.514 Minimum Necessary — limit uses/disclosures; MAC attributes help enforce necessity by class.
- 164.312(a)(1) Access Control — technical enforcement of authorized access.
- 164.308(a)(4) Information Access Management — policies for access to ePHI including sensitive subsets.
- 164.530 Privacy Rule administrative requirements — special handling expectations for certain disclosures align with labeled controls.
Compliance Tips
- Map state/federal special-category laws into your label set before buying tools.
- Pair AC-3(3) with workforce training so clinicians understand why a share fails.
- Do not claim MAC if users can freely reclassify everything.
Frequently Asked Questions
Is RBAC the same as MAC?
No. RBAC (AC-3(7)) assigns permissions by role; MAC enforces label/clearance rules users cannot override at will.
Must every hospital run SELinux?
Host MAC is one implementation path. Application/data labeling that users cannot unilaterally weaken can also meet the enhancement intent for ePHI objects.
How does this relate to Part 2?
Part 2-style restrictions are a strong healthcare example of non-discretionary rules over substance-use information.
References & Resources
- NIST SP 800-53 Rev. 5 — AC-3(3)
- 42 CFR Part 2 (where applicable)
- Related: AC-3, AC-3(4), AC-3(7), AC-6, MP-2
Related Guidelines
Related controls that commonly accompany AC-3(3).
Need Help Implementing AC-3(3)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.