- Citation
45 CFR 164.308(a)(3)- Standard
- Workforce security, 164.308(a)(3)(i)
- Safeguard
- Administrative safeguards
- Type
- Standard, with three addressable specifications
What the rule says
Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.45 CFR 164.308(a)(3), as currently in force
In plain English: Make sure the right people have access to patient information, the wrong people don't, and when someone leaves, their access leaves with them, the same day.
What it means in practice
- Authorization and/or supervision (A): decide who may access ePHI and who supervises those who work near it.
- Workforce clearance procedure (A): check people before granting access, scaled to the role: background checks, references, license verification.
- Termination procedures (A): a checklist that removes every account, badge, key and remote access path when someone leaves or changes role, with a record.
- All three are addressable, which means implement them or document why not and do the equivalent. For almost every entity, implement them.
Who's allowed in the water, and when they have to get out. That's the short version of this requirement.Your engineer
What OCR looks for
If an investigation touches this requirement, the data request will ask for some or all of the following.
- The onboarding and offboarding checklists, completed, for the period.
- Access authorization records by role.
- Background check or clearance records where your policy requires them.
- A sample leaver traced through every system.
Where entities get caught
Gulf Coast Pain Consultants, $1.19 million penalty, 2024: a former contractor's access was never terminated and was used to create thousands of fraudulent claims.
Ambry Genetics, $700,000, 2026: among the findings, no procedures for terminating access.
How to meet it at a small organization
Write a one-page leaver checklist naming every system: EHR, Windows, email, practice portal, imaging, remote access, building keys and alarm codes, the texting app, the shared drive. Run it the day someone leaves and keep the signed copy. For joiners, decide what each role sees and grant only that.
Under the proposed Security Rule update
The proposal would require termination of access no later than one hour after a workforce member's employment ends, and notice to other regulated entities within 24 hours when a workforce member's access to their systems changes or ends. The update was proposed in January 2025 and remains a proposal as of October 2026; see what's changing.
This page explains a federal regulation in plain language. It isn't legal advice, and AccuSights doesn't certify compliance; no one can. For every standard and specification, see the Security Rule, clause by clause.
With AccuSights: Joiner and leaver workflows live in the platform with every system listed, the identity connector confirms accounts are actually disabled, and a leaver whose account is still active the next day is a flagged drift.