User Access Policy

Electronic Visit Verification (EVV) System
Last Updated: {{Insert Date}}

1. Purpose

The purpose of this User Access Policy is to define the standards, controls, and procedures governing user authentication, authorization, and access to the EVV System ("the System").
This policy ensures compliance with:

  • HIPAA Privacy & Security Rules
  • Minnesota DHS 245D requirements
  • 21st Century Cures Act EVV mandates
  • Industry best practices for access control
  • Applicable Business Associate Agreements (BAAs)

2. Scope

This policy applies to:

  • All users of the System (administrators, agency staff, caregivers, contractors)
  • All credentials used to access the System
  • All methods of access (web app, mobile app, APIs, integrations)
  • All environments: production, support interfaces, audit logs, administrative portals

3. Definitions

3.1 User

Any individual granted access to the System.

3.2 Authentication

Verification of a user's identity (passwords, MFA, tokens).

3.3 Authorization

Permissions granted based on job role and responsibilities.

3.4 RBAC (Role-Based Access Control)

Framework for assigning permissions according to job function.

3.5 PHI Access

Ability to view, edit, export, or generate information containing Protected Health Information.

4. Access Control Principles

4.1 Least Privilege

Users receive the minimum access necessary to perform their job duties.

4.2 Separation of Duties

Critical functions are divided among multiple users to prevent unauthorized access.

4.3 Need-to-Know

Access is granted only when there is a legitimate business need.

4.4 Default Deny

All access is denied by default unless explicitly granted.

5. User Account Management

5.1 Account Creation

  • Accounts are created only after:
    • Verification of user identity
    • Completion of required training
    • Assignment of appropriate role(s)
    • Manager approval
  • Each user receives a unique account identifier
  • Accounts are created with the minimum necessary permissions

5.2 Account Modification

  • Role changes require manager approval
  • Access modifications are logged and audited
  • Users are notified of significant permission changes

5.3 Account Deactivation

Accounts are deactivated immediately upon:

  • Employee termination
  • Role change removing System access
  • Violation of access policies
  • Extended inactivity (as defined by retention policy)

5.4 Account Deletion

  • Accounts are deleted according to data retention requirements
  • All associated data is handled per Data Retention & Destruction Policy
  • Deletion is logged and audited

6. Authentication Requirements

6.1 Password Requirements

  • Minimum 12 characters
  • Combination of uppercase, lowercase, numbers, and special characters
  • Cannot be reused for last 12 passwords
  • Must be changed every 90 days
  • Cannot contain username or common dictionary words

6.2 Multi-Factor Authentication (MFA)

  • MFA is required for all users
  • MFA methods include:
    • Time-based one-time password (TOTP)
    • SMS verification
    • Email verification
    • Hardware tokens (for administrators)
  • MFA must be re-authenticated every 30 days or after suspicious activity

6.3 Session Management

  • Sessions timeout after 30 minutes of inactivity
  • Maximum session duration: 8 hours
  • Concurrent sessions are limited (typically 2-3 per user)
  • Session tokens are cryptographically secure

6.4 Failed Login Attempts

  • Account locked after 5 failed login attempts
  • Lockout duration: 30 minutes
  • After 3 lockouts, account requires administrator unlock
  • All failed attempts are logged and monitored

7. Role-Based Access Control (RBAC)

7.1 Role Definitions

Administrator

  • Full system access
  • User management
  • System configuration
  • Audit log access
  • Data export capabilities

Agency Manager

  • View all agency data
  • Manage agency users
  • Generate reports
  • Export agency data
  • Cannot modify system settings

Care Coordinator

  • View assigned clients
  • Manage visit schedules
  • View visit documentation
  • Generate client reports
  • Cannot access financial data

Caregiver

  • View assigned visits
  • Clock in/out for visits
  • Document visit activities
  • View own schedule
  • Cannot access other caregivers' data

Read-Only User

  • View-only access to assigned data
  • Cannot modify any information
  • Cannot export data
  • Typically for auditors or compliance staff

7.2 Permission Matrix

Permissions are defined by role and include:

  • View: Read access to data
  • Create: Add new records
  • Edit: Modify existing records
  • Delete: Remove records (with restrictions)
  • Export: Generate reports and data exports
  • Admin: System administration functions

7.3 Role Assignment

  • Roles are assigned based on job function
  • Users may have multiple roles if necessary
  • Role changes require approval and documentation
  • Role assignments are reviewed quarterly

8. PHI Access Controls

8.1 PHI Access Requirements

  • Access to PHI requires explicit authorization
  • Users must complete HIPAA training before PHI access
  • PHI access is logged and monitored
  • Minimum necessary principle applies to all PHI access

8.2 PHI Access Logging

  • All PHI access is logged with:
    • User identifier
    • Timestamp
    • Data accessed
    • Purpose of access
    • IP address and device information
  • Logs are reviewed monthly for unauthorized access

8.3 PHI Export Controls

  • PHI exports require additional authorization
  • Exports are logged and tracked
  • Exported data must be encrypted
  • Recipients must be authorized and documented

9. API and Integration Access

9.1 API Authentication

  • All API access requires authentication tokens
  • Tokens are issued with specific scopes/permissions
  • Tokens expire after defined period (typically 1 hour)
  • Token refresh requires re-authentication

9.2 Integration Access

  • Third-party integrations require:
    • Signed Business Associate Agreement (BAA)
    • Security assessment
    • Limited scope of access
    • Regular security reviews
  • Integration credentials are rotated regularly

9.3 Rate Limiting

  • API access is rate-limited to prevent abuse
  • Limits vary by user role and endpoint
  • Excessive requests trigger security alerts

10. Mobile App Access

10.1 Device Registration

  • Mobile devices must be registered before use
  • Device identifiers are tracked
  • Lost or stolen devices are immediately deactivated

10.2 Mobile Security

  • App requires device PIN/biometric authentication
  • Data is encrypted at rest and in transit
  • Remote wipe capability for lost devices
  • App updates are required for security patches

11. Audit and Monitoring

11.1 Access Logging

  • All access attempts are logged
  • Logs include:
    • User identifier
    • Timestamp
    • Action performed
    • Data accessed
    • IP address
    • Device information
  • Logs are retained per Data Retention Policy

11.2 Access Reviews

  • User access is reviewed quarterly
  • Reviews verify:
    • Access is still needed
    • Permissions are appropriate
    • No unauthorized access occurred
  • Reviews are documented and retained

11.3 Security Monitoring

  • Automated monitoring for suspicious activity:
    • Unusual access patterns
    • Failed login attempts
    • Access from unusual locations
    • Bulk data exports
  • Alerts are investigated immediately

12. Incident Response

12.1 Unauthorized Access

  • Suspected unauthorized access triggers immediate investigation
  • Affected accounts are suspended pending investigation
  • Incident is documented per Incident Response Policy
  • Notification provided per breach notification requirements

12.2 Account Compromise

  • Compromised accounts are immediately disabled
  • Password reset required
  • MFA re-enrollment required
  • Access logs reviewed for unauthorized activity
  • Affected users notified

13. Training and Awareness

13.1 Initial Training

  • All users must complete access control training before account activation
  • Training covers:
    • Password security
    • PHI handling
    • Access policies
    • Incident reporting
  • Training completion is documented

13.2 Ongoing Training

  • Annual refresher training required
  • Training updated when policies change
  • Users notified of significant policy updates

14. Compliance and Enforcement

14.1 Policy Compliance

  • Violations of this policy may result in:
    • Account suspension
    • Access revocation
    • Disciplinary action
    • Legal action if applicable

14.2 Policy Review

  • This policy is reviewed annually
  • Updates are approved by System Owner
  • Changes are communicated to all users

15. Contact Information

For questions about this policy or to report access issues:

16. Related Policies

  • Privacy Policy
  • PHI Handling Policy
  • Data Retention & Destruction Policy
  • Incident Response Policy
  • Password Policy