New ambulatory EHR go-live
AC-1 policy update clarifies clinic manager approval for ambulatory templates and forbids shared nursing logins before go-live training completes.
Access Control Policy and Procedures
High Risk
Moderate
Low Cost
AC-1 requires developing, documenting, disseminating, reviewing, and updating an access control policy and procedures that address purpose, scope, roles, management commitment, coordination, and compliance — plus procedures to implement the Access Control family. In covered entities and BAs, AC-1 is the parent policy that binds EHR roles, break-glass, remote access, and vendor accounts to HIPAA minimum necessary and workforce clearance expectations.
Control Objective
Establish and maintain a living access control policy and supporting procedures that define how access to systems creating, receiving, maintaining, or transmitting ePHI is authorized, provisioned, reviewed, and revoked.
Implementation Guidance
- Publish an access control policy covering workforce, contractors, students, and system accounts that can reach ePHI.
- Define roles: authorizing officials, system owners, IAM admins, and privacy/security reviewers.
- Map procedures for joiner/mover/leaver, privileged access, break-glass, and BA/vendor access.
- Align policy language to HIPAA workforce security and information access management standards.
- Disseminate via policy portal; require acknowledgment for managers who approve EHR access.
- Review at least annually and after major EHR, IdP, or telehealth access model changes.
- Coordinate AC-1 with PS, IA, and PE policies so physical and logical access tell one story.
- Version-control policy and keep prior versions for audit reconstruction.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
BA analytics team needs extracts
Procedure under AC-1 requires BAA confirmation, data-use approval, and time-boxed service accounts — not ad-hoc VPN plus a shared SQL login.
Merger of two hospital IdPs
Policy review resets who may authorize elevated EHR roles across the new enterprise directory before accounts are merged.
Best Practices
- One enterprise AC policy with system-specific procedures annexed.
- Explicit break-glass and emergency access rules.
- Annual review with change-triggered updates.
- Manager acknowledgment for access approvers.
- Link policy to role catalogs and HR events.
- Cover non-human and vendor accounts.
Common Gaps & Violations
- Generic IT access policy with no ePHI or EHR specifics.
- Procedures never updated after cloud EHR migration.
- Shared clinical logins tolerated contrary to written policy.
- No defined review cadence.
- Policy exists but staff cannot locate the current version.
Required Documentation
- Access control policy (AC-1)
- Supporting procedures (provisioning, review, revocation)
- Roles and responsibilities matrix
- Review/approval history
- Dissemination / acknowledgment evidence
How to Test & Validate
- Obtain current AC-1 policy; confirm owner and last review date.
- Trace a new hire from request to EHR role against stated procedures.
- Verify privileged and break-glass rules are documented.
- Interview an access approver for awareness of policy duties.
- Confirm prior versions are retained for auditors.
Audit Considerations
Assessors start family reviews at AC-1. A stale or generic policy while EHR privilege models are complex is a common finding that undermines downstream AC evidence.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(3) Workforce Security — authorize, supervise, and clear workforce access consistent with policy.
- 164.308(a)(4) Information Access Management — isolate clearinghouse functions and authorize/establish access.
- 164.312(a) Access Control — unique user ID, emergency access, automatic logoff, encryption/decryption as addressed in procedures.
- 164.316 Policies and procedures — implement, document, and review reasonable and appropriate policies.
Compliance Tips
- Put the AC-1 review on the same calendar as the HIPAA security evaluation.
- Reference minimum necessary explicitly in access approval procedures.
- Keep a one-page EHR access addendum auditors can read quickly.
Frequently Asked Questions
Is an Acceptable Use Policy enough for AC-1?
No. AC-1 must address the Access Control family — authorization, account management, least privilege, and related procedures for ePHI systems.
How often must AC-1 be reviewed?
At least annually and whenever access models, EHR platforms, or organizational structure materially change.
Do BAs need their own AC-1?
Yes if they operate systems with ePHI; covered entities should also flow access expectations through BAAs and oversight.
References & Resources
- NIST SP 800-53 Rev. 5 — AC-1
- HIPAA §§ 164.308(a)(3)–(4), 164.312(a), 164.316
- Related controls: AC-2, AC-3, AC-6, PS-2, IA-2
Related Guidelines
Related controls that commonly accompany AC-1.
Need Help Implementing AC-1?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.