Hotfix on the claims interface
A developer edits a production mapping file to unblock billing. SA-10 forbids silent prod edits — fix goes through branch, review, and promoted artifact with integrity hash.
Developer Configuration Management
High Risk
Complex
Medium Cost
SA-10 requires requiring developers to perform configuration management during design, development, implementation, and operation; managing integrity of changes; documenting authenticity/integrity of changes; and controlling libraries and tools. Custom HL7/FHIR adapters, RPA bots, and EHR scripts without CM become silent pathways to alter or exfiltrate ePHI.
Control Objective
Ensure developer changes to ePHI-related software and configuration are versioned, reviewed, integrity-protected, and promoted through controlled pipelines — not ad-hoc edits on production.
Implementation Guidance
- Mandate version control (e.g., Git) for all custom code and infrastructure-as-code touching ePHI paths.
- Prohibit direct production edits; require pull requests with peer review for clinical interfaces.
- Protect CI/CD secrets; use separate prod credentials and signed or hashed build artifacts where feasible.
- Maintain inventories of code libraries, shared packages, and approved toolchains.
- Log who changed what and when; retain for audit correlation with AU controls.
- Extend expectations to citizen-developer/low-code platforms used for patient workflows.
- Vendor-developed customizations: require change manifests and integrity evidence in contracts.
- Align SA-10 with CM-3 organizational change control and SA-11 testing before release.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Shared utility library for FHIR apps
Multiple portals import a common PHI redaction library. SA-10 tracks library versions and owners so a vulnerable release can be found quickly.
Contractor leaves USB builds
Offshore BA drops unsigned binaries for a bedside app. SA-10 requires authenticated source, build provenance, and rejection of unmarked media.
Best Practices
- No prod write access for routine developers.
- Mandatory code review for ePHI-impacting changes.
- Protected main branches and signed builds where practical.
- Inventory of libraries and pipelines.
- Cover scripts, stored procedures, and RPA.
- Contractual CM duties for custom BA development.
Common Gaps & Violations
- Production database triggers edited live.
- Untracked scripts on interface engines.
- Shared generic CI credentials.
- Low-code apps with no version history.
- Vendor drops with no checksum or source control link.
Required Documentation
- Developer CM procedure (SA-10)
- Repository and pipeline standards
- Branch protection / review requirements
- Library and toolchain inventory
- Sample change integrity evidence (commits, hashes)
How to Test & Validate
- Sample a production interface change; verify repo history and review.
- Confirm developers lack standing prod edit rights.
- Inspect CI secrets handling for ePHI-related pipelines.
- Review library inventory currency.
- Check a vendor customization for change documentation.
Audit Considerations
Integrity of developer changes is a common root cause in breach investigations. Assessors want proof that ePHI-impacting code cannot be altered without traceable CM.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(c) Integrity — protect ePHI from improper alteration or destruction; developer CM supports integrity of systems that process ePHI.
- 164.308(a)(1) Risk Management — manage risks from unauthorized software change.
- 164.312(b) Audit Controls — CM records support reconstruction of who changed clinical integrations.
- 164.308(a)(5) Workforce Security awareness — developers need procedures, not only tools.
Compliance Tips
- Treat interface engine maps as code under SA-10.
- Alert on direct prod config changes outside the pipeline.
- Pair SA-10 evidence with SA-11 test reports for releases.
Frequently Asked Questions
Does SA-10 apply if we only configure a cloud EHR?
Yes for any organization-controlled customizations, scripts, integrations, and configuration-as-code you maintain — scale formality to risk.
How is SA-10 different from CM-3?
CM-3 is organizational configuration change control; SA-10 focuses on developer CM practices and integrity of software changes during the life cycle.
Are database stored procedures in scope?
Yes when they process or govern ePHI workflows — manage them under version control like application code.
References & Resources
- NIST SP 800-53 Rev. 5 — SA-10
- Related controls: CM-3, SA-11, SI-7, AU-2, SR-3
Related Guidelines
Related controls that commonly accompany SA-10.
Need Help Implementing SA-10?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.