HIPAA requires an emergency access procedure: a way to get necessary ePHI during an emergency. A good break-glass design lets a clinician override normal restrictions fast, forces a short reason, logs everything, and triggers a review afterward. The aim is safe speed, not a permanent back door.
What the rule requires
The emergency access procedure is a required specification under the access control standard in 164.312(a). The regulation says to establish and, when needed, implement procedures for obtaining necessary ePHI during an emergency. It does not describe the mechanism, so you design it.
Note the word emergency. It can mean a patient emergency where a clinician needs records they do not normally see, or a system emergency such as an outage where normal login paths fail. Plan for both.
Design principles
- Make it fast. If break-glass takes two minutes, clinicians will share passwords instead.
- Make it narrow. Grant read access to the needed records for a limited time, not blanket admin rights.
- Make it visible. Log the user, patient record, time, reason and what was viewed.
- Make it reviewed. A privacy or security officer should see every break-glass event within a short, fixed period.
- Make it testable. Run it in drills so staff know it exists.
Patient emergency pattern
The user clicks an override, picks a reason from a short list, and gets time limited access. The system alerts a reviewer. Next day the reviewer confirms the use was appropriate or opens a follow up. FHIR security guidance names break-glass as one of the access paths that implementers need to cover, along with search chaining and batch operations, so the pattern applies to APIs as well as screens.
System emergency pattern
When identity systems are down, clinicians still need to see allergy lists and medications. Options include a read only downtime copy of key data, printed summaries refreshed on a schedule, and a sealed emergency credential held by a named custodian. Whichever you pick, test whether it works with the network down, and log its use by hand if the system cannot.
Mistakes to avoid
- Emergency accounts with permanent passwords shared in a binder.
- No review step, so misuse goes unseen.
- Override that opens everything instead of what is needed.
- Never drilling, so the first real use is during a real crisis.
Related: unique user identification.
Quick check
Is the emergency access procedure required?
Yes, it is a required specification under the access control standard.
Should break-glass use be logged?
Yes. Logging and review are what keep an override from becoming a gap in your audit trail.
Sources
Last reviewed: 19 October 2026.
