Generated access-review controls for the EHR need a named owner accountable for testing and remediation. Whom should the implementer assign as control owner?
Select an answer to reveal the explanation.
Short Explanation
Somebody’s name has to sit on that control—preferably the person who actually runs the app. Make the EHR application owner the control owner so tests and fixes have a clear home. Blank owners, faceless boards, and outside QSAs as instance owners leave accountability floating.
Full Explanation
Control ownership identifies who is responsible for operating and attesting to controls generated against an entity. Assigning the EHR application owner aligns accountability with operational knowledge of access reviews. Leaving ownership blank or assigning a board without a named owner reduces follow-through on tests and issues. External assessors may review evidence but are not typically configured as production control owners for internal application controls.