164.308(a)(3)(ii)(B) Workforce clearance procedure

What the workforce clearance procedure requires before access is granted

The workforce clearance procedure asks a covered entity or business associate to have a documented method for deciding that a workforce member's access to electronic protected health information is appropriate before that access is granted. In practice, the question an assessor will ask is simple: for this person, in this role, what did you check, who decided, and where is the record? The standard does not prescribe a background check, a reference call or a particular approval chain. It requires that the organization pick a procedure, apply it consistently and be able to show that it was applied. The clearance decision is the gate, and the evidence is the approval record for each person who can reach ePHI.

Screening depth is a risk-analysis decision, not a fixed rule. A clinician with broad chart access, a billing analyst with payment data, and a contractor who only touches a backup console carry different levels of risk, so the risk analysis should set how deep screening goes for each role and whether reference checks, identity verification, licensure checks or criminal history checks are proportionate. The addressable label does not let an organization skip the procedure. Under the general rules in 45 CFR 164.306(d), the entity must first decide whether the procedure is reasonable and appropriate. If it is not, it must document why and adopt an equivalent alternative measure that is reasonable and appropriate. Leaving the question unanswered is the weakest position to defend. Confirm with counsel and your own risk analysis before you conclude that any screening step can be dropped.

The procedure is hard to evidence because clearance rarely happens in one place. Human resources runs hiring, department managers request role changes, and procurement or a contract owner onboards contractors who may never appear in the HR system at all. Each team may hold part of the record, and none may hold the decision. Before an assessment, check whether every route that grants ePHI access, including temporary and vendor accounts, passes through a documented clearance step with a named approver and a retained date. Termination procedures depend on the same records, since ending access is the consequence of a clearance determination that access should stop.

Which workforce members, systems and access paths the clearance procedure covers

The clearance procedure under 164.308(a)(3)(ii)(B) has to reach everyone who can touch ePHI, not only employees on payroll. The cards below set out the scoping decisions that determine who goes through clearance, how deeply each person is screened, and how each clearance outcome feeds the termination procedure.

Employees in clinical and administrative roles

Role sensitivity is the first variable. A billing specialist, a registration clerk and a clinician may each reach different ePHI, so clearance should follow the job's actual data access rather than the job title alone. Check which roles open patient records, claims, scheduling data or exported reports, and record the clearance outcome for each role. Map every role to the ePHI it can reach before setting the screening depth.

Privileged IT and database staff

System administrators, database owners and backup operators can often read ePHI without any application-level permission. Their clearance should be deeper than a standard user's because a single privileged account can reach many records at once. Confirm which administrative accounts exist, who approves them, and whether the risk analysis treats them as higher-risk access paths.

Contractors and trainees

Contractors, temporary staff, students and trainees are workforce members under the rule when they work in ePHI systems or locations, even if they are not employees. Clearance should cover the same checks as the role they fill, and the agreement under which they work should name the clearance decision. Confirm who sponsors each non-employee and who records the determination.

Third-party personnel with remote access

Vendor engineers, managed service staff and support technicians may reach ePHI systems over remote sessions without ever being on site. Clearance for these people is often handled by the vendor, so the covered entity or business associate needs to confirm what the vendor screens, how remote accounts are issued and when they expire. Confirm this against the business associate contract and the risk analysis for each remote path.

Systems and applications holding ePHI

Clearance decides who may enter a system, so the list of systems that hold ePHI sets the scope of the procedure. Electronic health records, billing platforms, file shares, reporting databases and backup repositories each present a different access path. Build an inventory of these systems from the risk analysis, and check that each one has a named owner who can approve access.

Clearance feeds termination procedures

A clearance determination that limits or denies access has to be carried into the termination procedure in 164.308(a)(3)(ii)(C), which covers ending access when a clearance determination says access should stop. Record each determination in a form that the access team can act on, and confirm that changes flow to every system in the inventory. Ask how the process tracks a role change that narrows access as well as a full departure.

How an assessor tests workforce clearance decisions

This table sets out what an assessor tests for 164.308(a)(3)(ii)(B), the evidence they request for each test, and the findings that most often appear. Read each row as a test the organization should run on itself before an assessment, because the gaps usually show up in the paperwork trail rather than in the screening itself.

Test area	Evidence requested	Common findings
Written clearance procedure	Current clearance policy and procedure, approval dates, owner, and the roles it covers	Procedure exists but names no owner, predates a reorganization, or does not cover contractors and trainees
Sample of recent hires and role changes	Personnel files or ticket records for a sample of new hires and transfers, showing the clearance step and its sign-off	Clearance step skipped for transfers, or completed after access was already granted
Screening matched to the risk analysis	Risk analysis entries that drive screening depth for each role, plus the screening performed for those roles	Screening identical for every role, or the risk analysis never mentions personnel screening
Documented addressable decisions	Written assessment of whether screening is reasonable and appropriate for each role, with reasons for any decision not to screen	No record of the assessment, or a decision not to screen with no equivalent alternative measure described
Equivalent alternative measures	Description of the alternative (for example, supervised access or added monitoring) and evidence it operates	Alternative measure named in policy but never implemented or tested
Link to access provisioning	Access request tickets showing clearance approval before role-based access was provisioned	Access granted by a business owner without a clearance decision on file
Exceptions and overrides	Exception register with approver, rationale, expiry and follow-up	Undocumented exceptions, or exceptions that never expire
Link to termination and changes	Records showing that a negative clearance decision led to removal or limitation of access	Clearance outcomes recorded but access not changed, or no review after a role change

How to build a workforce clearance procedure from the risk analysis

This sequence turns the risk analysis into a clearance procedure that decides who gets access to ePHI, how deep screening goes for each role, and how that decision reaches provisioning, termination and periodic review. Each step produces a record an assessor can trace back to a documented finding.

Confirm risk analysis findings for ePHI access
Start from the current risk analysis and pull out every finding that touches who can reach ePHI, including workforce members, contractors, trainees and vendor staff with system access. The security official or designated risk owner does this, and the output is a short extract listing each access-related threat, its likelihood and impact, and the systems involved. Confirm the extract matches the most recent risk analysis version so the clearance decisions trace to a dated document.
Define role sensitivity tiers
Group roles by how much harm misuse of their access could cause to ePHI, based on the findings from the first step. Typical tiers separate roles with broad read access to clinical records, roles with administrative or privileged access to systems holding ePHI, and roles with little or no ePHI exposure. The output is a role tier matrix that lists each job role, its tier, the systems it can reach and the reason for the assignment. HR and system owners should review the matrix before it is approved.
Choose screening and approval steps for each tier
For each tier, decide what the clearance check involves, such as reference checks, identity verification, background screening where lawful, confirmation of licensure, or a supervisor sign-off. Record who approves access at each tier and what they must see before approving. Confirm local employment law and union or contract terms before fixing the screening depth, since the rule does not prescribe specific checks. The output is a screening standard per tier, signed by the security official and HR.
Document the addressable decision and any alternative
The clearance procedure is addressable, so assess whether it is reasonable and appropriate for each tier. Where you adopt it, record the decision and the screening it requires. Where a specific check is not reasonable or appropriate for a role, document why and record the equivalent alternative measure, such as tighter supervision or narrower access, and the reason it is reasonable. The output is a signed decision record per tier that an assessor can read without interviewing the author.
Connect clearance to access provisioning
Build the link between a clearance decision and the access request so no account is provisioned before the required checks are complete. Use a provisioning ticket template that names the role tier, the approvals obtained, the clearance date and the access granted. System owners grant access only against an approved ticket. The output is a sample of completed tickets showing the clearance record attached to each grant. Confirm which steps your identity system can enforce automatically and which depend on manual checks.
Link clearance outcomes to termination and changes
A clearance determination that denies or limits access must flow into access removal, and a change in role may require a new clearance check. Map each trigger, such as a failed check, a role change or an end of engagement, to the termination or modification steps that follow. The output is a short trigger table cross-referenced to the termination procedure so that offboarding evidence and clearance records tell one consistent story.
Set review triggers and schedule reviews
Define the events that reopen the clearance decision, including material changes in the risk analysis, new systems that hold ePHI, incidents involving workforce access, and changes to role tiers. Schedule periodic reviews of the tier matrix and sampled access grants, and assign an owner for each review. Confirm review intervals with your own risk management plan, since the rule does not set one. The output is a dated review log and an updated decision record each time the procedure changes.

Evidence that shows workforce clearance is working

Clearance is a decision that has to be visible on paper and in system records. The cards below cover the documents that set the rules, the decisions made under them, and the access changes that show those decisions were carried out. Each one needs an owner and a refresh routine so the evidence still matches reality on the day an assessor asks.

Written clearance procedure with version history

The procedure states who decides clearance, what checks apply by role, when clearance must be complete before access starts, and how exceptions are escalated. Keep every revision with its date, approver and the reason for the change, so an assessor can see the procedure in force at any past point. Review it after each risk analysis update and after any change to how screening is performed. Confirm with your own counsel and HR how long prior versions must be kept under your retention rules.

Role sensitivity tiers tied to the risk analysis

Tiers group roles by the ePHI they can reach and the harm misuse could cause, such as clinical records, billing data or backup administration. The tier assignments should cite the risk analysis entries that justify them, so a reader can trace why a role needs deeper screening. Recheck tiers when systems are added, when a role's data access expands, or when the risk analysis is refreshed. Ask whether each tier decision has a named owner and a date of last review.

Signed clearance decisions per person or role

Each clearance decision records the individual or role, the tier, the checks completed, the decision (granted, limited or denied), and the signature of the authorizing manager. Decisions for roles should cover every person who holds that role, with individual records for exceptions. Reconcile signed decisions against the current staff roster at least on a set schedule, because a decision for someone who has since changed roles no longer supports their access. Confirm that the signer has the authority described in your procedure.

Screening results kept under retention rules

Background check results, reference confirmations and license verifications are the proof behind a clearance decision. Store them in a restricted location, limit who can view them, and apply the retention period your employment and privacy obligations set, which may differ by jurisdiction. Record when each check was completed so an assessor can match it to the decision it supported. Confirm with your legal team which fields may be stored and which should be kept only as a pass or fail result.

Documented addressable decisions and alternatives

Because clearance is addressable, the file should show the assessment of whether a given screening step is reasonable and appropriate for each role. Where a step is not implemented, the record must explain why and name the equivalent measure, such as supervised first-week access or restricted read-only roles. Revisit these decisions when the risk analysis changes, since a measure that was adequate for one tier may not be for another. Ask your compliance lead to confirm that each alternative is still in use.

Access provisioning records showing clearance applied

Provisioning tickets, identity directory changes and role assignments should cite the clearance decision that allowed each grant. A useful test is whether an assessor can pick one clearance decision and follow it to the account that was created, with timestamps on both. Access certification campaigns can help here: designated reviewers decide within a set timeframe whether to keep, change or revoke role assignments, which counters access accumulation over time. Confirm which identity platform you use can record the decision reference on each grant, and what the reviewers' decisions look like in its reports.

Documenting the addressable decision and an equivalent alternative

Clearance is an addressable specification, so the rule does not let an entity skip it simply because screening is expensive or inconvenient. Under 45 CFR 164.306(d)(3), the entity must first assess whether the procedure is reasonable and appropriate. If it is, the entity implements it. If it is not, the entity must document why it is not reasonable and appropriate and then implement an equivalent alternative measure, provided that alternative is itself reasonable and appropriate. The decision and its reasoning are the deliverable an assessor will ask to see, not just the outcome.

*Illustrative example:* a three-clinician practice cannot justify full criminal background checks for a front-desk hire, but it still has to decide who gets access to its scheduling and EHR systems. The decision record might state the threat being addressed (a workforce member with a history of fraud reaching billing data), why full screening is not reasonable at this size and budget, and the compensating measures: reference checks and identity verification before the first login, role-based access limited to scheduling, a named owner who approves each access request in writing, and a quarterly review of who holds which role. The record should also say when the decision will be revisited, such as when headcount changes or a new system holds more ePHI.

The risk analysis is the document that makes this decision defensible. OCR's risk analysis guidance names personnel screening under 164.308(a)(3)(ii)(B) as a decision the analysis should inform, so the screening depth and the compensating measures should trace back to identified threats and vulnerabilities for the systems involved. Confirm with your own counsel and security official how your state law treats background checks before you rely on a screening limit, since state requirements can narrow the options. Termination procedures under 164.308(a)(3)(ii)(C) also depend on these decisions, so the clearance record should name the access that must be removed if a determination changes.

What meeting the workforce clearance procedure costs

This table breaks the clearance procedure into its cost components and shows who pays for each, whether it is one-time or recurring, and what pushes it up or down. No dollar figures are supplied for this section, so each row names what to ask a screening provider or quote to show. Self-hosted tooling mainly changes the cost of the access review, not the screening fee itself.

Cost component	One-time or recurring	What drives it	How to keep it down
Internal policy and risk analysis time	One-time, then recurring at each review	Number of roles that touch ePHI and how many screening tiers the risk analysis sets	Group roles into a short list of access tiers so the policy covers them without case-by-case rules
Screening vendor fees per check	Recurring per hire, rehire or role change	Check types (identity, licensure, sanctions, criminal record), jurisdictions and volume of new hires	Ask for per-check pricing by check type, and screen only the checks the risk analysis justifies
HR and legal review of screening scope	One-time, with periodic review	Local employment and data protection rules, union terms and how much adverse-action handling is needed	Have counsel approve a standard scope template once, then reuse it for each role tier
Access provisioning changes	One-time build, then recurring maintenance	Number of systems where access is granted and whether approval is manual or workflow-driven	Tie provisioning to the clearance decision in a single workflow instead of separate tickets
Evidence upkeep	Recurring	How many clearance decisions must be recorded, retained and retrievable for the documentation standard	Store decisions in the system of record that already holds access data so evidence is produced as a by-product
Access review cost (self-hosted tooling)	Recurring	Frequency of reviews, number of access items and reviewer time per item	Use an access certification campaign with named reviewers and set deadlines, which shifts effort from manual exports to reviewer decisions
Auditor sampling time	Recurring per assessment cycle	Number of workforce samples the auditor selects and how easily each file shows the clearance decision	Keep one complete clearance file per sampled person so the auditor does not need follow-up requests

Who owns the clearance decision, who can help and where the auditor stops

Your organization owns the clearance decision. Under 164.308(a)(3)(ii)(B) the procedure must determine whether a workforce member's access to ePHI is appropriate, and that determination belongs to people accountable for the risk, normally the security official working with HR, the data owner and the manager of the role. Your risk analysis sets how deep screening should go, so the team that owns that analysis also sets the screening scope and approves it in writing.

Screening scope: Decide which roles need background checks, reference checks, licence verification or sanctions list checks, and record the reason for each tier.
Sign-off: Name who approves clearance for each role, and what they must see before approving.
Exceptions: Document who may grant temporary access before screening completes, and the compensating controls that apply.
Re-clearance triggers: Define events such as a role change or a new privileged entitlement that reopen a clearance decision.
Records: Keep dated approvals linked to the role and the individual so an assessor can trace each decision.

Before relying on any outside party, confirm that your named approvers can show their reasoning from the risk analysis.

Why workforce clearance procedures fail assessments

Clearance decisions under 164.308(a)(3)(ii)(B) are easy to write down and hard to make work in practice. The gaps below share one root cause: the screening decision is not connected to the risk analysis, the access record, or the lifecycle of the person it applies to.

Screening that never reached the risk analysis

Many organizations run background checks because they always have, not because the risk analysis asked for them. The rule is addressable, so the depth of screening for each role should trace back to the risk analysis finding that justifies it. Check whether your risk analysis names personnel screening as a decision, and whether screening depth differs for staff with access to high-impact ePHI systems versus those with limited access.

No written record for addressable decisions

Under 45 CFR 164.306(d)(3), an addressable specification requires a documented assessment. If you decided screening was not reasonable for a role, or chose an equivalent alternative measure, the reasoning must be written down. Assessors commonly ask for the decision record itself, not just a policy that says screening happens. Confirm that each clearance decision has a date, an owner, the role it covers, and the rationale.

Clearance skipped for contractors and temporary staff

Contractors, locum providers, agency staff and interns often receive system access through a different path than employees, and the clearance step is the first thing lost. Yet the Security Rule's workforce definition reaches anyone whose conduct is under your direct control, so their access needs the same decision. Confirm that your onboarding workflow for non-employees includes a clearance check before any account is created, and that the sponsoring manager cannot bypass it.

Decisions not linked to access provisioning

A clearance decision that lives in an HR file has no effect unless the identity system enforces it. Ask whether an approved clearance is a precondition for creating accounts, assigning roles, and issuing physical or remote credentials. Where provisioning and clearance are separate tickets, a gap between them will eventually produce access that no one cleared. Map each role to its clearance level so the link can be tested.

Procedures not reviewed after role changes

A clearance decision made when someone was hired can stop fitting once they move into a role with broader ePHI access, a new system, or a new reporting line. The clearance procedure should be revisited when roles or systems change, not only at hire. Check whether role changes trigger a clearance review, and whether the review is recorded. Access certification campaigns, where designated reviewers decide within a set timeframe whether to keep, change or revoke role assignments, can provide this check in midPoint, though you should confirm the fit with your own environment.

Access granted before the clearance record existed

Accounts are often created on day one while screening results arrive days later, and the gap is rarely tracked. The clearance procedure should define what access, if any, is allowed while a check is pending, such as no ePHI access until clearance completes. Confirm that your identity system can show the clearance status and creation date for every account, so an assessor can see that no access preceded the decision.

Questions buyers ask about workforce clearance

How much effort does a workforce clearance procedure take?

The effort depends on how many roles touch ePHI, how sensitive those roles are, and how deep the screening needs to go. The clearance procedure itself is a documented decision process, so most of the work is mapping roles to access levels, agreeing who approves each level, and defining what checks happen before access is granted. The risk analysis drives the depth: a role with broad access to a patient record system will usually justify more scrutiny than a role with narrow, read-only access. Ask any provider to estimate effort by role category and to show how that estimate follows from your own risk analysis.

Can an internal team write a workforce clearance procedure without outside help?

Yes, a covered entity or business associate can write this procedure in-house, and the rule does not require an outside firm. The work needs someone who understands where ePHI lives, how access is granted in your systems, and how HR onboarding works. Teams often struggle with the link to the risk analysis and with keeping the procedure aligned with actual access reviews. An implementation partner can help prepare the procedure, the role-to-access mapping and the evidence, but the organization owns the decision and the policy. Only an independent auditor can test it and issue a report.

How long does it take to put a clearance procedure in place?

No fixed timeline applies to this specification, so the duration depends on your starting point. An organization with a current risk analysis, a role catalog and documented onboarding will move faster than one that must first inventory who has access to what. The main sources of delay are agreeing approvers across HR, IT and business owners, and getting the procedure into onboarding workflows. Ask any provider to break the timeline into discovery, drafting, approval and rollout, and to tie each phase to deliverables you can review.

What does the clearance procedure need from HR and managers?

HR and managers supply the facts that clearance depends on: the job role, the access that role needs, the date the person starts, and any approval step the policy requires. HR typically owns the screening steps and the records of what was checked, while managers confirm that the requested access matches the job. Both groups need a short, written process they can follow without security expertise. Plan for periodic refreshers so that role changes trigger a new clearance decision rather than leaving old access in place.

Does HIPAA require background screening for every workforce member?

The rule does not name a specific background check for every workforce member. Under 45 CFR 164.308(a)(3)(ii)(B), the specification is addressable, so you must assess whether a clearance procedure is reasonable and appropriate for your environment. If you decide a particular check is not reasonable, you must document why and implement an equivalent alternative measure if one is reasonable. Screening depth is therefore a documented decision informed by your risk analysis, and it should reflect the access each role holds. Confirm any state or employment law limits on screening with counsel before you set the scope.

What will an auditor ask to see for workforce clearance?

An auditor will typically ask for the written clearance procedure, the documented decision for how it is applied, and evidence that it was followed for real hires and role changes. Expect to show the role-to-access mapping, records of approvals, and the link back to the risk analysis that set the screening depth. If you chose an alternative measure instead of a specific check, the documented reasoning will be examined. Only an independent assessor can test these records and report on them, so prepare the evidence ahead of time and keep it current.

How does workforce clearance connect to termination and access reviews?

Clearance decides who gets access, and termination procedures under 164.308(a)(3)(ii)(C) remove it when that decision changes or someone leaves. The same records should support both, so a clearance decision that is later revoked can be traced to an offboarding step. Periodic access reviews, which relate to the access establishment and modification specification, check that granted access still matches the clearance decision. Some organizations run formal certification campaigns, where designated reviewers decide within a set timeframe whether to keep, change or revoke access. Confirm the review cadence with your risk analysis and document it.

What should an engineer check when wiring clearance into identity systems?

Check that every account that can reach ePHI maps to a role with an approved clearance decision, and that no account exists without one. Confirm that new access requests route through the approval step and that the approval is recorded with a timestamp and approver identity. Look for shared accounts, standing privileges granted outside the process, and access that survives a role change. Open-source identity and access management tools can produce these records, but confirm each capability against your own environment and the tool's current documentation before relying on it.

How DeployOpen prepares clearance procedures and evidence

DeployOpen helps covered entities and business associates build the systems, records and evidence behind their workforce clearance procedure, while the organization keeps ownership of the decisions. We work inside your own infrastructure, so access workflows, approval records and screening outputs stay under your control.

How we scope

Engagements are fixed-scope, with the systems, workforce groups and access types covered agreed in writing before work starts.
We take the risk analysis as the input for how deep clearance screening and approval should go for each role.
The written scope names who approves clearance, who the reviewers are, and which evidence the organization expects to hold.

How we build

We configure access request and approval workflows so each grant of ePHI access records the approver, the basis and the date.
We set up periodic review of role assignments, with designated reviewers who decide within a defined timeframe whether to keep, change or revoke access.
We connect clearance decisions to termination and access modification steps so a denied or withdrawn clearance removes access in the systems.

How we hand over

Deliverables include written clearance procedure documentation, workflow configuration records and the review and approval logs your team will keep.
We document how each addressable decision was assessed, and where screening is not used, the reasoning and any equivalent alternative measure.
Handover covers operating the workflows, running review campaigns and showing an assessor how the evidence was produced.

How we support

Ongoing support, upgrades and testing of the clearance workflows are available as a retainer after handover.
We revisit the clearance procedure when the risk analysis changes, staff roles change or the pending Security Rule revision is finalized.
Confirm with us during scoping which evidence an independent assessor will request, since DeployOpen prepares evidence but does not issue audit reports or attestations.