AC-2 requires the organization to manage information system accounts across their full lifecycle — defining account types, assigning account managers, establishing conditions for group and role membership, creating, enabling, modifying, disabling, and removing accounts, and monitoring account use. For covered entities and business associates, this is the operational backbone of unique user identification and workforce access to ePHI.
Ensure every account that can reach ePHI has a known owner, a documented business need, timely provisioning and deprovisioning, and periodic review so access does not outlive the job role.
How this control shows up in healthcare and HIPAA-covered environments.
A revenue-cycle clerk is terminated at 10:00. Without AC-2 discipline, EHR and clearinghouse logins stay active for days. A documented leaver checklist disables IdP, EHR, VPN, and email within hours, and an access review later confirms no residual roles remained.
A nurse moves to quality improvement and no longer needs broad charting write access across all clinics. AC-2 mover workflow removes floor EHR roles and grants read-focused analytics access with manager approval — preventing privilege accumulation.
A PACS vendor was given a temporary admin account for a go-live weekend. Six months later it still works. AC-2 temporary-account rules with expiry dates and monthly privileged review catch and remove it before an audit finding — or a breach.
Auditors compare HR termination lists to active-directory/EHR user lists, sample access tickets, and ask how movers are handled. Gaps between HR and IT are the most common AC-2 finding in healthcare assessments.
How this NIST control supports HIPAA Security Rule expectations.
Review privileged accounts at least monthly and standard ePHI users at least quarterly, plus event-driven reviews after major org changes.
Yes. They need an owner, purpose, minimal privileges, and a review cycle — often stricter than human accounts.
No. AC-2 decides who should have an account and which roles; AC-3 enforces those decisions technically at runtime.
Related controls that commonly accompany AC-2.
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.
