Nurse resignation
PS-1 procedures require EHR, badge, VPN, and email disable on last day with manager checklist completion.
Personnel Security Policy and Procedures
High Risk
Moderate
Low Cost
PS-1 requires personnel security policy and procedures addressing purpose, scope, roles, management commitment, coordination, and compliance, plus procedures to implement the Personnel Security family. Healthcare PS-1 connects HR, credentialing, and IAM so hiring, sanction screening, transfers, and terminations protect ePHI throughout the workforce lifecycle.
Control Objective
Establish policy and procedures that ensure personnel who can access ePHI or related facilities are appropriately screened, managed through role changes, and promptly deprovisioned upon separation.
Implementation Guidance
- Publish PS-1 policy covering employees, contractors, students, volunteers, and privileged IT staff.
- Define screening, onboarding, transfer, and termination procedures linked to PS-2/PS-3/PS-4/PS-5.
- Require same-day access removal targets for involuntary terminations affecting ePHI systems.
- Include third-party staffing agencies in policy expectations.
- Assign shared ownership across HR, security, privacy, and IAM.
- Address sanctions/exclusions monitoring for applicable roles.
- Review annually and after major HRIS/IAM changes.
- Coordinate with AT training and AC access management policies.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Traveler onboarding surge
Policy sets minimum clearance and training gates before temporary clinical access is granted.
Transfer from registration to HIM
Mover process under PS-1 triggers access review so old registration queues are removed when duties change.
Best Practices
- Unified joiner-mover-leaver runbooks.
- Same-day termination for high-risk separations.
- Contractor parity with employee controls.
- HRIS events drive IAM tickets automatically where possible.
- Sanction list monitoring cadence defined.
- Evidence retained for audits.
Common Gaps & Violations
- Terminated users with active EHR accounts.
- Contractors omitted from personnel policy.
- Transfers never trigger access reviews.
- Screening policy not enforced before access.
- No defined SLA for deprovisioning.
Required Documentation
- Personnel security policy (PS-1)
- JML procedures
- Screening and termination standards
- Roles across HR/security/IAM
- Policy review records
How to Test & Validate
- Confirm PS-1 policy is current and scoped to ePHI workforce.
- Sample terminations for timely access removal.
- Sample transfers for access adjustment.
- Verify contractors appear in procedures.
- Review sanction screening requirements vs practice.
Audit Considerations
Workforce clearance and termination hygiene are HIPAA staples. PS-1 is the policy auditors request before sampling account disable evidence.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(3) Workforce Security — authorization, supervision, clearance, and termination procedures.
- 164.308(a)(3)(ii)(C) Termination Procedures — remove access when employment ends.
- 164.308(a)(4) Information Access Management — access must remain appropriate as roles change.
- 164.316 Policies and procedures — document personnel security policy.
Compliance Tips
- Measure termination SLA weekly and report to compliance committee.
- Put PS-1 checkpoints in credentialing packets for clinicians.
- Extend leaver process to cloud apps beyond the EHR.
Frequently Asked Questions
Does PS-1 cover medical staff who are not employees?
Include credentialed practitioners and other non-employees with system access in policy scope or equivalent agreements.
How fast must access be removed?
Define in policy — best practice is immediate/same day for involuntary terminations and at end of last day for planned separations.
How does PS-1 relate to PS-4?
PS-1 is the governing policy; PS-4 is the termination control executed under that policy.
References & Resources
- NIST SP 800-53 Rev. 5 — PS-1
- HIPAA § 164.308(a)(3)
- Related controls: PS-2, PS-3, PS-4, PS-5, AC-2
Related Guidelines
Related controls that commonly accompany PS-1.
Need Help Implementing PS-1?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.