EHR security workbook export
Only security admins can export the full role-permission matrix. A curious analyst's attempt is denied — preventing a roadmap for privilege abuse.
AC-3(5) Security-Relevant Information
Critical Risk
Moderate
Medium Cost
AC-3(5) requires preventing access to security-relevant information except during secure, authorized sessions. Security-relevant information includes audit configurations, authentication policy settings, cryptographic keys/material, access-control rule sets, and vulnerability scan credentials. If a standard EHR user can read or alter these, they can blind monitoring or widen ePHI access undetected.
Control Objective
Ensure security-relevant configuration and secrets that protect ePHI systems are readable or changeable only by authorized administrators in controlled sessions.
Implementation Guidance
- Inventory security-relevant artifacts: IdP policies, EHR security workbench, SIEM rules, HSM/key vault access, firewall policies, break-glass lists.
- Restrict read and write separately — many staff need no read of key material or full ACL exports.
- Store secrets in a vault; ban plaintext passwords in tickets and shared drives.
- Require privileged session (PAM/JIT) to view or edit security configs.
- Encrypt backups of security config and limit restore rights.
- Monitor access to security-relevant objects and alert on anomalous reads.
- Sanitize error pages and support dumps so they do not leak security config (pairs with SI-11).
- Review who can export role-permission matrices — those exports are security-relevant.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Cloud key vault
Database TDE keys live in Key Vault; application developers get wrap/unwrap via managed identity but cannot list key values or change access policies.
SIEM rule tampering blocked
SOC analysts can create detections; only a smaller detection-engineering role can disable critical ePHI audit rules — protecting security-relevant monitoring config.
Best Practices
- Treat ACL/role exports as sensitive assets.
- Vault all credentials and API keys.
- JIT access to security consoles.
- Separate read vs modify on security config.
- Alert on changes to audit and auth policies.
- Include security-relevant files in DLP policies.
Common Gaps & Violations
- Role matrices on open SharePoint.
- Firewall configs emailed in cleartext.
- Break-glass password list in a shared inbox folder.
- Developers with Owner rights on key vaults.
- Helpdesk wiki posts MFA bypass procedures publicly.
Required Documentation
- Definition of security-relevant information for the org
- Access rules for security consoles and vaults
- Secret management standard
- Sample alerts for security-config changes
- Inventory of security-relevant data stores
How to Test & Validate
- Attempt to open security workbench / key vault / audit config as a non-admin; confirm deny.
- Verify secrets are not in code repos or shared drives (sample scan).
- Confirm audit-policy changes require privileged role and are logged.
- Review membership of roles that can read security-relevant exports.
- Inspect support procedures for leakage of security config.
Audit Considerations
Assessors ask how audit and access-control settings are protected from tampering. World-readable security documentation and shared break-glass lists are immediate red flags.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(b) Audit Controls — audit mechanisms themselves must be protected from unauthorized alteration.
- 164.312(a)(2)(iv) Encryption and Decryption — cryptographic key access is security-relevant.
- 164.308(a)(1) Risk Management — protect controls that manage ePHI risk.
- 164.312(a)(1) Access Control — limit who can change the rules of access.
Compliance Tips
- Add 'security-relevant' classification to document libraries holding architecture and ACL exports.
- Rotate any secret found in tickets during cleanup sprints.
- Pair with AU-9 protection of audit information.
Frequently Asked Questions
Are clinical protocols security-relevant?
Usually not. Focus on information that controls authentication, authorization, auditing, and cryptography.
Can auditors view security configs?
Yes under controlled sessions and need-to-know — grant temporary read, do not leave standing open access.
Are vulnerability scan results in scope?
Yes — they reveal weaknesses in ePHI systems and should be access-restricted.
References & Resources
- NIST SP 800-53 Rev. 5 — AC-3(5)
- Related: AC-3(1), AC-6, AU-9, IA-5, SC-12
Related Guidelines
Related controls that commonly accompany AC-3(5).
Need Help Implementing AC-3(5)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.