Role-Based Access Control (RBAC) & MFA Implementation Guide

Minimum Necessary Access & RBAC

Under HIPAA §164.502(b), access to ePHI must be constrained to the minimum necessary level.

Express/Node.js RBAC Authorization Middleware

import { Request, Response, NextFunction } from 'express';

const PERMISSIONS: Record<string, string[]> = {
  DOCTOR: ['phi:read', 'phi:write'],
  BILLING: ['billing:read', 'billing:write'],
  ADMIN: ['audit:read'],
};

export function checkPermission(permission: string) {
  return (req: Request, res: Response, next: NextFunction) => {
    const role = req.user?.role;
    if (!role || !PERMISSIONS[role]?.includes(permission)) {
      return res.status(403).json({ error: 'Access Denied' });
    }
    next();
  };
}