HI150 Unit 9 User Access Review Example

Course	HI150 Automation of Health Information 1
Unit	Unit 9
Paper type	User access review
Length	About 580 words, 5 pages double-spaced
Format	APA 7 student paper
School	Purdue University Global
Program	BS in Health Information Management
Updated	October 2026

Free sample paper for HI150 Unit 9

Coders Who Could Edit Notes, a Transfer Who Kept Her Old Rights and a Temp Still Logged In: A Unit 9 User Access Review Setting Each Role in a Composite Health Information Department Against What Its Work Requires

[Student Name]

Purdue University Global

HI150: Automation of Health Information 1

Unit 9 User Access Review

[Instructor Name]

[Date]

The department, its staff and its system are composite; the access control requirements and the sources cited are real.

What this part is doingThe review compares need with grant for every role and function, so excess access shows up even where nobody has misused it.

Scope

System: the hospital's electronic health record, health information management module. Department: health information management, 31 active accounts. Date: September 30. Source: the system's account and role report, compared with the human resources roster.

The Matrix

Functions: view, create, edit, sign, merge, print, release and administer. Each line lists what the role needs and any mismatch found.

1. Release clerk: needs view, print, release. Granted as needed. No mismatch.

2. Coder: needs view and create queries. Granted view, create and edit on clinical notes. Mismatch: edit.

3. Scanning technician: needs view, create document images and index. Granted as needed.

4. Deficiency analyst: needs view and assign deficiencies. Granted as needed.

5. Index coordinator: needs view and merge. Granted as needed.

6. Supervisor: needs view, print, release and limited administer for password resets. Granted full administer. Mismatch: broader than needed.

Findings

1. All nine coders hold edit rights on clinical notes, inherited from a template copied from the clinical documentation specialist role. No edits by coders were found in the audit log for the past year, but the right exists.

2. One employee who moved from release of information to scanning in June still holds release rights.

3. A temporary scanning worker whose assignment ended August 16 has an active account, last used August 15.

4. The front desk uses one shared login, "HIMDESK," for the department's public workstation, so actions from that terminal cannot be traced to a person.

5. The supervisor role carries full administrative rights, including role editing, which no one in the department needs.

Nothing in this list has caused harm yet. Each is a door left open, and the review's job is to find doors, not intruders.

Causes, by Process

Role design: findings 1 and 5 come from roles built by copying broader templates. Role change: finding 2 comes from a transfer process that adds new rights without removing old ones. Offboarding: finding 3 comes from temporary staff ending through the agency without a notice to the system administrator. Convenience: finding 4 comes from a workstation set up to avoid frequent logins. Fixing the accounts without fixing these processes would leave the next review with the same findings. The privacy rule requires covered entities to limit workforce access to the minimum necessary for each role (45 C.F.R. § 164.514, 2024), and the security rule requires unique user identification and procedures for granting, changing and ending access (45 C.F.R. § 164.312, 2024; 45 C.F.R. § 164.308, 2024).

What this part is doingFindings are grouped by the process that failed, since each process change prevents a whole class of future findings.

Emergency Access

The review confirms that a break-the-glass function exists for clinical staff and is logged. No health information role needs it, and none holds it.

Corrections

1. Remove edit rights from the coder role today.

2. Remove release rights from the transferred employee today.

3. Disable the temporary worker's account today, and require the agency to notify the department on each assignment's last day.

4. Replace the shared login with individual logins and a short automatic lock.

5. Reduce the supervisor role to password reset only.

6. Repeat the review quarterly.

What this part is doingEvery correction has a time frame of today except the shared login and the review cycle, which need workstation changes and a calendar.

References

45 C.F.R. § 164.308 (2024). https://www.ecfr.gov/current/title-45/section-164.308

45 C.F.R. § 164.312 (2024). https://www.ecfr.gov/current/title-45/section-164.312

45 C.F.R. § 164.514 (2024). https://www.ecfr.gov/current/title-45/section-164.514

The Purdue Global HI150 Unit 9 instructions

Unit 9 typically asks you to review user access for a department's roles. Define the scope, including the system, department, date and source of the account list. Build a matrix of roles against functions, showing what each role needs and what it holds. List each mismatch as a finding. Group findings by the process that produced them, such as role design, transfers or departures, since fixing accounts alone leaves the process unchanged. Address emergency access and shared logins. Propose corrections with timelines and a review cycle. Ground your recommendations in access control requirements, at least briefly. Use composite data. A matrix followed by numbered findings and short sections on causes and corrections is the usual format.

How the HI 150 Unit 9 example is put together

The worksheet states its scope and source, then lists six roles with needed functions and mismatches. Five numbered findings describe excess rights, a transfer, a live account, a shared login and an oversized supervisor role. A highlighted line frames the findings as open doors rather than incidents. A causes section groups them by process and cites federal minimum necessary and access control rules, with a margin note on grouping. A short emergency access section follows, then six corrections with a margin note on timing. The matrix makes the excess rights visible at a glance, before any account is examined in detail. Each finding names the account type, not the person, so the review can be shared with the department.

Reading the HI150 Unit 9 grading rubric

Access reviews are generally graded on completeness and reasoning. Points go to a matrix that compares need with grant for every role and to findings that state each mismatch precisely. Credit rises for tracing findings to the processes that produced them and for corrections aimed at those processes. Instructors value attention to shared logins, departed accounts and emergency access. Brief, accurate grounding in access requirements adds marks. Clear presentation and a review cycle complete the rubric. Reviews that list accounts without explaining causes, or that treat unused rights as harmless, generally lose points. Instructors also check that each correction has a date, especially for departed accounts.

HI150 Unit 9 help from the desk

Students often check only whether access was misused, missing excess rights nobody has used yet. Compare need with grant. Another common gap is fixing accounts without fixing the transfer or departure process. Do not overlook shared logins, which make every action untraceable. Avoid recommending a review without saying how often and who owns it. Keep names composite. If your section provides an account list and roles, send them and we can build the matrix, findings and corrections. Compare the account list with the human resources roster every time. Finally, ask what the transfer and departure processes are, since they produce most findings.

Get an HI150 Unit 9 example written to your instructions

A role list or permission table makes the strongest starting point for Unit 9; a plain scenario is fine too. Attach whichever you have, the instructions and the rubric. The matrix and action plan follow that material and the system your section names, delivered in 24-48h, and your first sample is free. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.

More HI150 papers and BS in Health Information Management samples

HI150 Unit 9 questions, answered

What should happen with a shared login?

The example recommends replacing it with individual accounts and explains why in workflow terms: every entry made under a shared name belongs to no one, so deficiency routing, audit review and error tracing all fail at that desk. Where a shared device is genuinely needed, the fix is quick individual sign-in on that device rather than a common password.

How often should access be reviewed?

Facility policy sets the interval, and the example leaves the number to it while insisting that the review repeat and that someone own it. Role changes and departures between reviews are handled by the processes the findings name, so the periodic review catches what those processes miss rather than doing their work for them.

Where can I find a free HI150 Unit 9 sample paper?

The complete Unit 9 access review, with the role matrix, findings and corrections, can be read here.

What should happen with a shared login?

Replace it with individual accounts, since actions under a shared name cannot be traced to a person, which defeats auditing and deficiency routing.

How often should user access be reviewed?

Facility policy sets the interval, often quarterly, but every review needs an owner, and role changes and departures should trigger changes between reviews.