# HIPAA 164.312(a)(1)

URL: /systems/trust-and-governance/criteria/hipaa/164-312-a-1 · Id: `criterion:hipaa:164.312(a)(1)`

> Systems that hold electronic protected health information allow access only to authorized persons or software.

[Systems](/business/nouns/system) that hold electronic protected health information allow access only to authorized persons or software.

| Property | Value |
| --- | --- |
| Framework | HIPAA |
| Reference | `164.312(a)(1)` |
| Satisfied by | [Task-bound access](/systems/trust-and-governance/controls/task-bound-access) |