Quick answer
Evaluate SNF EHR access by action, facility and time period. Test both intended work and prohibited paths using ordinary accounts, including reports and exports. Reconcile temporary assignments with actual application access and reconstruct privileged activity from logs. A role label, disabled login or completed access ticket does not by itself establish the resulting permissions.
Design permissions around the work
Ask who needs which action at which location for which period. A regional analyst may need aggregated reports without editing records. A local administrator may need account maintenance without population export. A temporary replacement may need one facility for one overnight shift.
For regulated entities and ePHI, the HHS Summary of the HIPAA Security Rule describes access and audit controls. This procurement worksheet is a limited operating test, not a complete assessment of HIPAA compliance. The NIST SP 1305 supplier risk quick-start guide supports communicating supplier requirements; use it to make support access and responsibilities explicit.
Fill a role-site-action matrix
The values below are hypothetical policy choices, not universal permission rules. Replace them with the organization's approved design.
| Test role | Allowed scope | Allowed action | Action that should fail |
|---|---|---|---|
| Coordinator A | Facility A | Manage assigned referral tasks | Open B records through search or export |
| Regional analyst | A and B | Read approved reporting population | Edit local record or shared template |
| Temporary B coverage | B, 19:00–07:00 | Assigned operational tasks | Access A or retain B access after approved end |
| Local access administrator | A | Apply approved role assignments | Initiate unrestricted resident export |
| Supplier support account | Defined approved purpose/time | Agreed troubleshooting task | Reuse access for an unrelated task or after closure |
Test record screens, search, reports, downloaded files, background jobs and configuration routes. A chart screen that blocks Facility B while an export includes B has not met the intended boundary.
Use a temporary assignment to test the whole lifecycle
Create a synthetic assignment starting at 19:00 and ending at 07:00 the following day. Confirm named-account readiness before the shift, correct facility scope during it, and the approved end-of-access behavior afterward. Include an extension and a cancellation before start.
A date-only expiration can end the account at midnight, interrupting intended coverage. An indefinite account avoids that interruption but creates a different unresolved condition. The design needs an unambiguous end time, the relevant time basis and a route for authorized extensions.
For a person with approved assignments at two sites, ending Facility A must not automatically erase valid B coverage or preserve A merely because B continues. This is a relationship test between person, assignment and scope, not just a check of one active-account flag.
Reconcile departures across access layers
Make a small offboarding specimen: identity-provider group, EHR role, supplier portal role and any connected service in scope. Record the approved removal method and observed outcome for each. Have technical specialists determine how active sessions and background credentials are handled in the actual arrangement.
Do not infer full removal from a closed request ticket or one failed login. Conversely, do not conduct unauthorized access attempts against production. Use the approved test environment and accounts to establish what the process changes and what remains dependent on another team.
An independent facility may have one person administering several layers; a documented backup needs the same visibility. An enterprise may have different teams for each layer, so the completion record must join their outcomes. Splitting responsibility without a reconciled result can leave an account between teams.
Reconstruct one privileged export
Use ten synthetic residents. Person P requests an authorized export, service S creates it and person Q downloads it. Ask the approved reviewer to reconstruct the sequence from normal evidence access.
| Question | Useful evidence | Gap revealed |
|---|---|---|
| Who initiated the request? | P and request reference | Only service S appears |
| What population was requested? | Scope/filter and object reference | “Export” with no population context |
| Was a file produced? | Job result correlated to request | Request exists but result missing |
| Who retrieved it? | Q and retrieval event | Creation mistaken for download |
| When did each step occur? | Defined time basis and precision | Incompatible timestamps obscure order |
The review does not establish intent or legal permissibility by itself. It establishes what the evidence can explain. If supplier help is required to retrieve detail, record the assistance path and expected response rather than implying local staff can investigate independently.
Decide whether remaining limitations fit the operating model
An independent facility may accept additional manual review for an infrequent privileged action if a qualified backup and workable process exist. A group handling frequent regional exports may find the same manual arrangement impractical. Estimate the actual volume and review burden before treating both as equivalent choices.
Retain unresolved bundled permissions, missing log correlations and scope boundaries in the procurement record. Acceptance should describe the tested role model and its limits, not label the product universally secure or audit-proof.
Questions & answers
Should a regional reporting role also edit every facility record?
Define those permissions independently according to approved duties. Cross-site visibility, record editing, bulk export and configuration changes are different actions and should not be inferred from one another.
What if the product bundles privileges more broadly than we need?
Record the demonstrated limitation and its consequences. Have the responsible security and operations leaders compare configuration alternatives, additional review controls or a narrower deployment. Renaming the role does not change its actual permissions.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.