- Shipped
- August 26, 2026 at 6:53 AM UTC
- Author
- Kamo
- Commit
- 9a5f0ff
The §164.524 right of access, made real: a patient signs in and reads their own problems, medications, allergies, immunisations and appointments, and can download the whole record as a C-CDA. A THIRD PRINCIPAL, and the guards now know all three. EhrEndpointGuardTest grew PORTAL_AUTHENTICATED for the handlers that resolve a patient session and PORTAL_DOORS for the two that cannot — activating an invitation and signing in, because obtaining a session is what they are for. Both lists are policed rather than merely excused: the first checks each handler really resolves a portal session, the second that sign-in verifies a password and that activation looks the invitation up by the hash of the presented token. EVERY SIGN-IN FAILURE ANSWERS THE SAME SENTENCE, and an unknown address still costs the time of a hash. Distinguishing "no such account" from "wrong password" confirms which addresses are patients of this practice — and being a patient of an oncology clinic is a diagnosis. A 404 rather than a 403 on somebody else's record is the same reasoning. FAILURES LOCK THE ACCOUNT, not an IP. A portal login is the one credential a covered entity publishes the address of, and the realistic attack is a slow spray across many accounts rather than a burst against one, which a per-IP rate limit does not see. Withdrawing access revokes every live session, not just the account. Disabling alone leaves whoever is signed in reading the record until their session happens to expire, which is not what anybody means by withdrawing access. The password rule is LENGTH ONLY. Composition rules — a digit, a symbol, a capital — push people towards Password1! and away from the long passphrases that are actually strong. Portal reads are audited as PATIENT_REQUEST with a PATIENT_AUTHORIZED basis, and the record download is also written to the disclosure ledger. §164.528 does not require a patient's own access in their accounting, but 42 CFR §2.25 has no such exclusion and "who opened my record" deserves a complete answer.