Fact · Voice privacy and security
The HIPAA Security Rule requires a unique name or number for identifying and tracking each user of an electronic system that holds electronic protected health information.
Checked against its source on October 17, 2026
In the source's own words
“Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity.”
45 CFR 164.312: Technical safeguards (HIPAA Security Rule), U.S. Department of Health and Human Services (text reproduced by Cornell Legal Information Institute), 2013, § 164.312(a)(2)(i).
Open the original- What it measures
- Access control is one of the technical safeguards. Unique user IDs are what let an audit trail show which person used a system and when.
- What it does not show
- The standard is required, but it does not say how IDs are issued or how shared logins should be handled. Those choices belong to the covered entity's risk analysis.