a. Determine which employees need access to the stored PHI. (Keep in mind the Minimum Necessary Rule.) Maintain a list of the authorized employees, and revise it as employees and employee responsibilities change.
b. Notify the storage facility promptly of changes to the list of authorized employees.
c. If keys or passwords are provided to access the stored PHI, ensure those are retrieved when the employee no longer needs access to the stored PHI.