§164.312(a)(1): Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4). Audit Inquiry Has the entity implemented technical policies and procedure for the electronic information systems that maintain ePHI to allow access only to authorized users? Does the entity only allow access to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4) to electronic information systems that maintain electronic protected health information? Obtain and review policies and procedures related to access control. Evaluate the content relative to the specified performance criteria to determine if ePHI is only accessible to authorized persons or software programs. Elements to review may include but are not limited to: • Identification of the capabilities of electronic information system access controls (i.e., read-only, modify, full access) • Identification of the type of access controls implemented for the electronic information systems • Identification of how system and generic IDs/accounts are implemented, managed and controlled by technical access controls • Workforce members’ roles and responsibilities regarding the capabilities to add, modify, or delete user access • The frequency of review and verification of user access to electronic information systems that maintain ePHI • The frequency of review and verification of software program access to electronic information systems that maintain ePHI • How is removed upon termination or modified upon change of position Obtain and review documentation demonstrating the implementation of access controls for electronic information systems that maintain ePHI. Evaluate and determine if the electronic information systems have the capacity to enable access controls; if access controls can be enabled, are the enabled access controls configured in accordance with the access control policies and procedures; and how are the electronic information systems' technical access capabilities defined (i.e., read-only, modify, full-access). Obtain and review documentation demonstrating a list of new workforce members from the electronic information system who was granted access to ePHI. Obtain and review documentation demonstrating the access levels granted to new workforce members. Evaluate and determine whether workforce members' access was approved; review the new workforce members’ technical access granted and compare it to approved user access to determine that technical access is approved and granted in accordance with the access authorization requirements. Obtain and review documentation of a list of users with privileged access. Evaluate and determine whether the privileged access is appropriate based on the access control policies. Obtain and review a list of default, generic/shared, and service accounts from the electronic information systems with access to ePHI. Obtain and review documentation demonstrating the access levels granted to default, generic/shared, and service accounts. Evaluate and determine if the default, generic/shared, and service accounts are in use and that access has been approved and granted in accordance with the access authorization requirements. Obtain and review documentation demonstrating that periodic reviews of procedures related to access controls have been conducted. Evaluate and determine whether reviews have been performed of user access levels and evaluate the content in relation to the specified performance criteria. Obtain and review documentation demonstrating a list of terminations and job transfers. Obtain documentation demonstrating the removal or modification of user access levels. Evaluate and determine whether user access level removal or modification was approved and performed in accordance with the related policies and procedures. Required/Addressable Required

§164.310(c): Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users. Audit Inquiry Does the entity have policies and procedures that document how workstations are physically restricted to limit access to only authorized personnel? Does the entity workstations that access electronic protected health information restricted to authorized users? Obtain and review policies and procedures related to workstation security. Evaluate the content in relation to the specified criteria for security measures and guidance on how to implement and maintain physical security and how physical access to workstations that access ePHI is restricted to appropriate personnel. Obtain and review documentation demonstrating workstation security policies and procedures being implemented. Evaluate and determine if implementation is appropriate and is in accordance with related policies and procedures. Required/Addressable Required

§164.310(b): Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information. Audit Inquiry Does the entity have policies and procedures in place that specifies the proper functions to be performed and the physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI? Does the entity specify the proper functions to be performed and the physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI? Obtain and review such policies and procedures related to workstation use. Evaluate the content in relation to the specified performance criteria for the proper functions to be performed by electronic computing devices. Elements to review may include but are not limited to: • Process to identify workstations by type and location • Specify the physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI (e.g. to prevent or preclude unauthorized access to an unattended workstation, limit the ability of unauthorized persons to view sensitive information as needed) • Procedures related to the proper use and performance of workstations • Workforce members roles and responsibilities in the workstation use process Obtain and review an inventory of the locations and types of workstations. Evaluate and determine if an inventory exists of workstation; when the inventory was last updated; and whether there is a documented process for updating the inventory. If available, review the inventory to see if it includes the types of ePHI data elements contained on the systems included in the inventory. Obtain documentation demonstrating workstation classification. Evaluate and determine if each workstation is classified based on the specific workstation’s capabilities, connection, and allowable activities. Obtain and review documentation demonstrating workstation use policies and procedures implemented. Evaluate if such implementation is in accordance with related policies and procedures. Required/Addressable Required