Under the Technical Safeguards of the Security Rule there is a section relating to access controls (§164.312). Within this section Covered Entities must implement procedures “to verify that a person or entity seeking access to electronic protected health information is the one claimed” and “assign a unique name and/or number for identifying and tracking user identity”. If employees are sharing passwords with interns, medical students, and nurses, Covered Entities are not complying with the verification requirement and cannot track user identity.