HIPAA Compliance with Epic EHR: Configuration Guide

Epic Systems is one of the largest EHR platforms in healthcare, used by hospitals and large practices. Epic includes built-in HIPAA compliance tools including role-based access control, detailed audit logging, encryption options, Break-the-Glass emergency access, and secure patient portals through MyChart. Organizations must configure these features correctly to ensure compliance.

1. Configure Role-Based Access Control (RBAC)

• Access Security Console → System Setup → User Role Setup
• Create specific roles with minimal necessary privileges (principle of least privilege)
• Assign permissions by job function (clinicians, billing, IT staff)
• Review and update roles quarterly to remove unnecessary access
• Document role definitions and approval chains

2. Implement Strong Authentication Policies

• Enforce minimum 12-character passwords with complexity requirements
• Enable single sign-on (SSO) with Multi-Factor Authentication (MFA)
• Configure automatic session timeout after 15 minutes of inactivity
• Disable password sharing and enforce unique user logins
• Set password expiration every 90 days

3. Enable Comprehensive Audit Logging

• Activate Application Audit Logs in the Audit Trail module
• Enable tracking of all PHI access and modifications
• Configure alerts for unusual access patterns or bulk downloads
• Set audit log retention to minimum 6 years per HIPAA requirements
• Schedule monthly reviews of audit reports for suspicious activity

4. Configure Break-the-Glass Emergency Access

• Enable Break-the-Glass in System Security → Access Control settings
• Set clear criteria for emergency patient access without standard authorization
• Require justification documentation at the time of access
• Configure automatic alerts to security team on Break-the-Glass activation
• Review all Break-the-Glass logs quarterly and investigate appropriateness

5. Secure MyChart Patient Portal Settings

• Enable patient account lockout after 5 failed login attempts
• Require strong password policies for all patient accounts
• Configure appropriate access restrictions (e.g., hide sensitive diagnoses if needed)
• Enable message encryption for all patient-provider communications
• Implement proxy access controls for authorized representatives only

6. Establish Data Encryption Standards

• Enable encryption for data at rest using FIPS 140-2 approved algorithms
• Enforce TLS 1.2+ for all data in transit
• Configure encryption for all external interfaces and API connections
• Maintain encryption key management procedures and backups
• Document all encryption configurations in your security documentation

7. Implement Access Review Procedures

• Schedule quarterly user access reviews by department managers
• Deactivate terminated employee accounts within 24 hours
• Run monthly reports comparing active users against HR roster
• Document all access changes and retain evidence of approvals
• Require re-certification of access policies annually

8. Configure Backup and Disaster Recovery

• Enable Epic backup functionality with encryption enabled
• Test disaster recovery procedures quarterly with full Epic restoration
• Maintain secure offsite backup storage with access controls
• Document RTO (Recovery Time Objective) and RPO (Recovery Point Objective)
• Ensure backup integrity monitoring and automated alerting

• Overly Broad Default Roles: Many organizations keep default Epic roles too permissive instead of customizing them. Regularly audit and restrict access to actual job requirements.
• Neglected Audit Log Review: Failing to regularly review audit logs means violations go undetected. Assign responsibility and schedule monthly reviews.
• Break-the-Glass Overuse: Emergency access should be rare. Frequent Break-the-Glass access indicates workflow problems that need addressing.
• Poor Termination Procedures: Not disabling accounts promptly after employee termination. Implement automated workflows through HR integration.
• Inadequate MyChart Controls: Patient portal account sharing and weak password policies create unauthorized access risks.
• Missing Encryption Validation: Assuming Epic encryption is enabled without verification. Confirm all encryption settings in system configuration.