HI575 Unit 5 Access Control Policy Example

Reviewed by Chester Goodwin, MBA Protection of Health Information Purdue University Global Free custom sample in 24 to 48h

This HI575 Unit 5 access control policy commits a composite orthopedic practice to grant access by role, remove it within four business hours of a departure and recertify it every quarter through the manager who owns each role. Purdue Global HI 575, offered in the MS in Health Informatics, asks students in the fifth unit to write a security policy that answers a specific risk. The sample's purpose ties it to a departed therapist's account found active five months later. Numbered statements cover unique accounts, role-based grants, removal, recertification, vendor sessions and break-glass access, and each procedure names who acts, from which report and what record it leaves.

CourseHI575 Protection of Health Information
UnitUnit 5
Paper typeAccess control policy
LengthAbout 860 words, 6 pages double-spaced
FormatAPA 7 student paper
SchoolPurdue University Global
ProgramMS in Health Informatics
UpdatedOctober 2026

Free sample paper for HI575 Unit 5

1

Four Hours, Every Quarter, by Name: A Unit 5 Access Control Policy Written to Close a Departed Therapist's Open Account

[Student Name]

Purdue University Global

HI575: Protection of Health Information

Unit 5 Access Control Policy

[Instructor Name]

[Date]

Tollbridge Orthopedic Group, its roles, systems and every time limit are composite; the rule and sources cited are real.

What this part is doingTying the policy's purpose to one specific finding tells the reader which exposure every later statement must close.
2

1. Purpose

This policy sets how Tollbridge Orthopedic Group grants, changes, reviews and removes access to systems holding patient information. It responds to the risk analysis finding that a physical therapist's account remained active for five months after her departure, because the termination checklist omitted two systems.

2. Scope

The policy applies to every system in the practice's data inventory: the hosted health record, the patient portal administration console, the imaging archive, the billing platform, the fax server, email, the shared drive and the therapy app. It also applies to the three vendors with remote access: the imaging equipment vendor, the IT contractor and the billing clearinghouse. Vendor accounts are included because the inventory showed they are the easiest to forget.

3. Definitions

1. Role: a set of job duties, such as front desk, billing or surgeon.

2. Account: a unique sign-in assigned to one person.

3. Privilege: a specific permission attached to an account through its role, such as exporting claims.

4. Role owner: the manager accountable for who holds a role and what it permits.

4. Policy Statements

4.1 Every person has a unique account. Shared accounts are prohibited, including at front desk workstations.

4.2 Access is granted by role, using the role catalog in Appendix A. Privileges beyond the role require written approval from the role owner and the privacy officer, with an end date.

4.3 Access is removed from all systems within four business hours of notice from human resources, and the removal is logged with a timestamp.

4.4 Every role owner recertifies the accounts in the role each quarter, confirming each person still needs the access.

4.5 Vendor remote access is off by default and enabled only for a scheduled session, logged, and disabled when the session ends.

4.6 Emergency access to records outside a person's role is available through a break-glass function that requires a stated reason and is reviewed within one business day.

A promise to remove access means nothing unless someone named does it, from a named report, and leaves a record that it was done.

What this part is doingWriting statements short and putting the who, when and evidence in the procedures keeps the policy readable while making each promise checkable.
3

5. Procedures

5.1 Granting. The role owner submits a request naming the role. The IT contractor creates the account within one business day and records the request number in the account notes. Record left: the approved request.

5.2 Removing. Human resources enters the departure in the HR system, which sends an automatic notice to the IT contractor and the privacy officer. The contractor disables the person's accounts in every system on the removal checklist within four business hours and returns the completed checklist with timestamps. The checklist is generated from the data inventory, so a new system is added to the checklist when it is added to the inventory. Record left: the timestamped checklist.

5.3 Recertifying. In the first week of each quarter, the privacy officer sends each role owner a report of accounts in their role. The owner confirms or removes each one within ten business days. Unanswered reports are escalated to the practice administrator. Record left: the signed report.

5.4 Vendor sessions. The vendor requests a session by ticket. The IT contractor enables access for the scheduled window and disables it after. Record left: the ticket and the session log.

5.5 Break-glass review. The privacy officer reviews every break-glass use the next business day against the stated reason. Record left: the review note.

6. Responsibilities

1. Practice administrator: approves this policy and resolves escalations.

2. Privacy officer: runs recertification, reviews break-glass use and audits removal checklists monthly.

3. Role owners: approve role assignments and recertify quarterly.

4. Human resources: enters departures on the day notice is given.

5. IT contractor: creates, changes and removes accounts and keeps the records.

7. Exceptions

Exceptions require written approval from the privacy officer and the practice administrator, an end date and a compensating control. The front desk shared account is not eligible for an exception; it will be replaced by individual badge sign-in.

8. Enforcement

Violations are handled under the practice's sanctions policy, which the Security Rule requires for workforce members who fail to comply with security procedures (45 C.F.R. § 164.308, 2024).

9. Basis

The Security Rule requires access controls that allow only authorized persons access, unique user identification and procedures for emergency access (45 C.F.R. § 164.312, 2024), and the government's resource guide recommends periodic review of access rights as part of workforce security (Marron, 2024).

Appendix A: Role Catalog

Fourteen roles are defined, among them front desk, scheduling, medical assistant, physical therapist, imaging technologist, surgeon, physician assistant, billing specialist, billing manager, privacy officer, practice administrator, surgery center nurse, IT contractor and imaging vendor. Each lists the systems it reaches and its privileges. Claims export, for example, is limited to the billing manager and one named specialist.

Revision History

Version 1.0, adopted this quarter, replaces the 2021 user access procedure.

What this part is doingIncluding a role catalog, even in summary, shows how the policy becomes daily practice rather than a statement of intent.
4

References

45 C.F.R. § 164.308 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308

45 C.F.R. § 164.312 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312

Marron, J. A. (2024). Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A cybersecurity resource guide (NIST Special Publication 800-66r2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-66r2

Reading the HI 575 Unit 5 instructions

The fifth unit usually asks you to write a policy for one area of health information security, often access control, in a standard format. Expect purpose, scope, definitions, policy statements, procedures, responsibilities, exceptions, enforcement and revision history. Six pages is typical. Tie the purpose to the risk finding the policy answers. Make the scope explicit, including vendor accounts. Keep statements short and testable, and put the who, when and evidence in the procedures. End every procedure with the record it produces, because an auditor will ask for it. Include a role catalog or matrix if the course expects one, and address emergency access. A short revision history at the end shows the policy will be kept current.

Inside the HI575 Unit 5 example

The purpose names the active account of a departed therapist and the checklist gap behind it. Scope lists every inventory system and three vendors with remote access. Four definitions separate role, account, privilege and role owner. Six numbered statements follow, and the highlighted sentence explains why each promise needs a name, a report and a record. Five procedures describe granting, removal from an inventory-based checklist within four hours, quarterly recertification, vendor sessions and break-glass review, each ending with its record. Responsibilities, exceptions that exclude the shared front desk account, enforcement under the sanctions policy, the regulatory basis, a fourteen-role catalog and a revision history complete the policy.

Where the points sit in the HI575 Unit 5 rubric

Security policies are generally graded on alignment with the identified risk, clarity and testability of statements, completeness of procedures, assignment of responsibility and format. Procedures and responsibilities often carry the most points, because a policy that does not say who acts and what record results cannot be audited. Alignment earns credit when the purpose connects to a specific finding. Statements are judged on whether each could be verified. Coverage of vendors and emergency access is commonly rewarded. A complete standard format and correct citations finish the rubric. Policies that restate regulatory language without saying how the practice will meet it tend to lose points. Exceptions with end dates and compensating controls, and a role catalog that limits sensitive privileges, are frequent sources of extra credit.

HI575 Unit 5 help from the desk

A common reason policies are returned is that statements describe goals, such as access will be appropriate, rather than testable requirements. Another is procedures with no owner or timeline. Some students forget vendor accounts, which the earlier inventory usually shows are easy to miss. Exceptions are often left open-ended. Emergency access is frequently omitted. A policy that cites the Security Rule without operational detail reads as boilerplate. For a different policy area, say device disposal or remote work, describe the finding it must close, and we will write the statements and procedures to that finding. Another quiet weakness is a removal procedure that relies on someone remembering every system instead of a checklist generated from the inventory.

Get an HI575 Unit 5 example written to your instructions

A custom Unit 5 policy can be built for whatever organization your prompt names, including its own roles and vendors. Send the instructions and rubric with any role list or earlier analysis you have. Expect it within 24-48h, and the first one is on us, drafted to the headings your section requires. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.

Request this unit free All HI575 units Finished samples

More HI575 papers and MS in Health Informatics samples

HI575 Unit 5 questions, answered

Should an access control policy include a role matrix?

Some prompts ask for one and many accept it as an appendix. The example places a role catalog at the end, fourteen roles with purpose and owner, and keeps detailed permissions out of the policy body so the document does not need revision every time a screen changes. If your section wants the full grid, attach it and reference it from the statements.

How fast must access be removed after someone leaves?

The rule does not set a number, so the policy has to choose one and defend it. The example uses four business hours from notice because the analysis found a stale account and the practice can meet that target with its current staff. Whatever figure your paper chooses, pair it with the record that proves removal happened and a reconciliation that catches misses.

What is break-glass access, and does the policy need it?

It is a controlled way for a clinician to reach records outside normal permissions during an emergency, with the reason recorded and the use reviewed afterward. Many graders expect it wherever care is delivered. The example limits it to the surgery center, requires a reason at the moment of access and has the privacy officer read every use the next business day.

Where can I find a free HI575 Unit 5 sample paper?

The whole Unit 5 policy appears here, from its purpose and six statements to procedures that each leave a record.

Why include vendor accounts in an access control policy?

Vendors often hold standing remote access that nobody reviews, so naming them in scope and limiting them to scheduled sessions closes a common gap.