Security Safeguards
Role-Based Access Control (RBAC)
Also known as: RBAC
Granting access to ePHI based on a user's job role rather than individually.
Role-Based Access Control (RBAC) is a model that grants permissions to ePHI according to a user's job role rather than assigning them individually.
RBAC is a practical way to implement HIPAA's minimum necessary standard and least privilege: defining roles such as "clinician," "billing," or "read-only support" keeps access aligned with what each job actually requires and makes access control easier to audit. Some web frameworks include RBAC out of the box. Yii 2's DbManager, for example, keeps roles, permissions, and rules in database tables, a setup our Yii HIPAA compliant guide recommends.