C—2413 Authorized Access, Visitor Access and Authorized Personnel Lists

Revision 24-3; Effective Sept. 1, 2024

All Programs

HHSC must maintain a visitor log and authorized access list (AAL) to record access to physical work areas containing FTI. Staff maintain Form H1866 as a record of visitor access to a restricted area. Security staff must validate a visitor’s identity by examining a government-issued identification, such as a state-issued identification, driver’s license or passport. An AAL is maintained and MPS enforced to facilitate the entry of staff who have a frequent and continuing need to enter a restricted area but who are not assigned to the area. The AAL must contain the following:

name of employee, vendor, contractor or non-agency personnel;

name of agency or department;

name and phone number of the agency point-of-contact authorizing access;

address of agency, vendor or contractor; and

purpose and level of access.

HHSC management must review the AAL monthly or upon potential indication of an event such as a security breach or personnel change. HHSC management must maintain an authorized personnel list of all staff who have access to information systems areas containing FTI.