The principle of least privilege — giving each user access only to the systems and data their role requires — is stated in virtually every HIPAA Security Rule guidance document and violated in virtually every home health agency I assess. The violations are not deliberate. They are the accumulated result of practical decisions made under operational pressure: a new supervisor who was given her predecessor's full access profile because it was faster than building a new one; a billing coordinator who was given EHR clinical access to help cover during a staffing shortage two years ago and whose access was never reduced; a former clinical director whose Microsoft 365 account was deactivated but whose EHR access persisted because the two systems have different deactivation processes.
The HIPAA Security Rule requirement for access control reviews is clear: covered entities must implement policies and procedures for authorising access to ePHI based on the workforce member's role, and must review those access rights periodically to ensure they remain appropriate. "Periodically" in HIPAA terminology means often enough to catch the violations that accumulate through staff transitions, role changes, and operational exceptions — which at a home health agency means at minimum quarterly.
What a Formal Access Review Examines
A formal access control review does not ask whether users can log in — it asks whether what users can access after logging in is appropriate for their current role. The review examines:
- Active accounts vs. current workforce: every active account in the EHR, Microsoft 365 or Google Workspace, scheduling system, and billing platform should correspond to a currently employed or contracted workforce member with a legitimate need for access. Accounts belonging to former employees, former contractors, or former volunteers that remain active are an immediate remediation priority.
- Access level vs. current role: a nurse aide who was promoted to clinical supervisor 18 months ago may still have an aide-level EHR access profile that does not reflect her current responsibilities, or — more commonly — may have been given supervisor-level access to a broad set of patient records that exceeds what her specific caseload requires.
- Cross-functional access anomalies: billing staff who have clinical record access beyond what billing functions require; clinical staff who have billing system access; administrative staff who have scheduling access to patient populations outside their assigned branch or region.
- Dormant accounts: accounts belonging to active employees who have not logged in for 30 or more days — which may indicate the account is no longer needed, the employee has changed roles, or the account represents a system the employee does not actually use.