What security model does Epic implement to grant users minimum access based on role?

• A. No Access Policy
• B. Attribute-Based Access Control
• C. Role-Based Access Control
• D. Mandatory Access Control

Answer: (C)

Access is granted based on a user’s role, with permissions attached to that role rather than to the individual. In Epic systems, people are assigned roles that define what data they can see and what actions they can perform, so each user gets only what their job requires. This approach supports least privilege and makes it easy to manage access—change a user’s responsibilities by adjusting their role, and their permissions update accordingly. Centralized role management also makes auditing straightforward because you can map exactly which privileges belong to which roles and who holds them. Other models would rely on different criteria (like specific attributes or strict clearance levels) or would be too restrictive for everyday workflows, whereas role-based access control cleanly aligns with typical job functions.