Patient portal feature launch
CA-1 procedures block production DNS cutover until assessment findings on MFA and session timeout are closed or accepted by the authorizing official.
Security Assessment Policy and Procedures
High Risk
Moderate
Medium Cost
CA-1 requires policy and procedures for assessment, authorization, and monitoring — purpose, scope, roles, management commitment, coordination, and compliance — plus procedures to implement the CA family. Healthcare organizations use CA-1 to ensure EHR modules, patient portals, HIEs, and clinical apps are assessed and authorized before connecting to ePHI, with ongoing monitoring rather than one-time go-live checklists.
Control Objective
Govern how systems and services that affect ePHI are security/privacy assessed, authorized to operate, and continuously monitored throughout their lifecycle.
Implementation Guidance
- Publish CA-1 policy defining authorization boundaries for enterprise ePHI systems and major interfaces.
- Name authorizing officials and assessment roles (security, privacy, clinical informatics).
- Require pre-production assessments for new systems, major upgrades, and high-risk BA services.
- Define authorization packages: risk findings, control inheritance, BAAs, and residual risk acceptance.
- Establish continuous monitoring expectations (scans, control testing, metrics).
- Disseminate procedures to project managers so “security at the end” is not the default.
- Review CA-1 annually and after significant cloud or M&A changes.
- Align with RA-3 risk assessment and PL-2 system plans.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Lab interface via new clearinghouse
Authorization review under CA-1 confirms encryption, auditability, and BA status before HL7 feeds carry ePHI.
Annual EHR reauthorization
Continuous monitoring metrics and penetration test results feed a yearly authorization decision for the EHR boundary.
Best Practices
- Written authorizing official designations.
- Risk-based assessment depth by system criticality.
- No production ePHI until authorization (or documented interim).
- Continuous monitoring plan per major system.
- Track POA&Ms to closure.
- Include privacy assessment for new data uses.
Common Gaps & Violations
- Shadow IT clinical apps with ePHI never assessed.
- Go-lives approved by operations only.
- Assessments filed and never re-checked.
- Cloud SaaS assumed “authorized” because vendor has SOC 2 alone.
- No named official who accepts residual risk.
Required Documentation
- CA-1 assessment/authorization/monitoring policy
- Authorization procedure and templates
- Authorizing official designations
- Sample authorization packages
- Continuous monitoring procedures
How to Test & Validate
- Review CA-1 policy for scope covering ePHI systems.
- Sample a recent go-live for assessment/authorization evidence.
- Confirm continuous monitoring activities exist for a major system.
- Verify POA&M tracking for open findings.
- Interview project lead on when security is engaged.
Audit Considerations
Assessors look for governance over system approval. HIPAA evaluation and risk management expectations align with CA-1 discipline even when formal FedRAMP-style ATOs are not used.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(8) Evaluation — periodic technical and nontechnical evaluation of security safeguards.
- 164.308(a)(1) Risk Analysis / Risk Management — authorize based on understood risks.
- 164.306 Security standards general rules — ensure safeguards remain reasonable and appropriate.
- 164.316 Policies and procedures — document assessment and authorization governance.
Compliance Tips
- Add a CA checkpoint to the enterprise change/release calendar for ePHI systems.
- Maintain a simple authorized-systems register linked to BAAs.
- Use interim authorization sparingly with expiry dates.
Frequently Asked Questions
Do we need federal-style ATOs for HIPAA?
Not by name — but you do need documented assessment, risk acceptance, and ongoing evaluation commensurate with ePHI risk.
Does vendor SOC 2 replace CA-1?
No. SOC 2 informs assessment; your organization still authorizes use in your environment and monitors continuously.
How often reauthorize?
Define in policy — commonly annually for critical ePHI systems and at major changes.
References & Resources
- NIST SP 800-53 Rev. 5 — CA-1
- NIST SP 800-37 Risk Management Framework
- Related controls: CA-2, CA-6, CA-7, RA-3, PL-2
Related Guidelines
Related controls that commonly accompany CA-1.
Need Help Implementing CA-1?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.