least-privilege Controls

Privileged accounts are separated and access is minimized

Limit system access to authorized users, processes, and devices

Limit system access to permitted transactions and functions

Implement policies and procedures for authorizing access to ePHI

Access permissions are defined in policy, enforced, and reviewed using least privilege and separation of duties

Logical access security measures restrict access to assets

Role-based access is used and reviewed periodically