Access Control Policy

1. Purpose and Scope

Northwind Health (sample) establishes this Access Control Policy to define the technical safeguards required to ensure that only authorized workforce members can access electronic Protected Health Information (ePHI) hosted in our AWS environments, GitHub repositories, Google Workspace, and related systems. This policy implements the specifications required by the HIPAA Security Rule at 45 CFR §164.312(a)(1) (Access Control) and supports the workforce security requirements of 45 CFR §164.308(a)(3) and minimum necessary requirements of 45 CFR §164.502(b) and §164.514(d).

The scope of this policy covers all systems, applications, cloud infrastructure, databases, and devices owned or operated by Northwind Health (sample) that store, process, or transmit ePHI or customer PII. This includes, but is not limited to: Google Workspace services (Gmail, Google Drive, Google Docs, Google Sheets), AWS production and development environments, GitHub source code repositories, GitHub Actions CI/CD pipelines, Slack communication channels, Datadog monitoring dashboards, Kandji-managed endpoints, and the Gusto HR platform, to the extent such platforms contain or can access ePHI.

This policy applies to all workforce members, including the 24 full-time and contract personnel of Northwind Health (sample), regardless of whether they operate from the Austin, TX office or work remotely. Failure to comply with this policy may result in disciplinary action up to and including termination of employment or engagement, and may constitute a violation of law subject to penalties under 45 CFR §160.404 (civil money penalties) and the Breach Notification Rule at 45 CFR §164.400 et seq.

2. Unique User Identification

In compliance with 45 CFR §164.312(a)(2)(i) (Unique User Identification) and §164.308(a)(5)(ii)(D) (Password Management), Northwind Health (sample) requires that every individual who accesses systems containing ePHI be assigned a unique user identifier that is individually traceable to that person. Shared accounts, group logins, and generic credentials are strictly prohibited for access to any system containing ePHI.

The Security Officer shall maintain an identity inventory within Google Workspace, which serves as the authoritative Identity Provider (IdP) for Northwind Health (sample). Each workforce member receives a unique Google Workspace account upon HR onboarding through Gusto. Unique identifiers follow the format firstname.lastname@northwindhealth-sample.com. All downstream system access, including AWS IAM roles, GitHub organization membership, Datadog access, and Slack workspace membership, must be provably linked to this unique Google Workspace identity through single sign-on (SSO) or documented IAM federation. Any exception must be approved by the Security Officer in writing and logged.

The Security Officer, in coordination with the Engineering Manager and People Operations, shall conduct a quarterly reconciliation of active user accounts against current employment records in Gusto. For the 12-month period ending October 15, 2026, Northwind Health (sample) shall complete and retain records of four such reconciliations. Access revocation upon termination or role change must follow the procedures described in §164.308(a)(3)(ii)(C) (Termination Procedures) and shall be executed within 24 hours of termination notification.