What is a baseline security control for protecting EHR access?

• A. Role-based access control (RBAC) and unique user credentials
• B. Multi-factor authentication
• C. Password policy enforcement
• D. Regular access logging

Answer: (A)

Controlling who can reach EHR data starts with giving each user a unique identity and then restricting what they can access based on their role. Unique user credentials ensure every action can be tied to a specific person, which supports accountability. Role-based access control assigns permissions by job function, so individuals only have the minimum access necessary to perform their duties. Together, these elements establish a solid, foundational way to protect EHR access and align with accountability and regulatory requirements.

While features like multi-factor authentication add extra protection, and password policy enforcement strengthens credential security, they don’t by themselves define who can access what. Regular access logging is vital for detecting and investigating issues but doesn’t prevent unauthorized access at the outset. The combination of unique identities with role-based permissions is the essential setup for secure, accountable EHR access.