SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-unique-user-ids-required

How can a system track who accessed ePHI?

Assign a unique user ID to each person or system.

Start playing free

  1. Let staff share one login
  2. Give patients user IDs
  3. Assign unique user IDs to track user identity ✔

Why: Unique user identification is required. It allows an entity to trace activity to a specific person or software program.

Huh, didn't know that: Shared logins make it impossible to tell who did what in the audit trail.

The dad joke
Why did the EHR give everyone a unique ID? So nobody could blame the ghost in the machine.
Like this card?
Play the game

References

Answer: Assign unique user IDs to track user identity. Unique user identification is required. It allows an entity to trace activity to a specific person or software program.

  1. 45 CFR 164.312(a)(2)(i) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312
    Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is electronic protected health information, or ePHI?Work SkillsWho must comply with the HIPAA Security Rule?Work SkillsWhat are administrative safeguards in the HIPAA Security Rule?

That's stuff everyone should know.