Authentic statutory obligations decomposed into atomic machine-actionable conditions, actions, and verification standards.
A covered entity must implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights. Implement hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI.
