Identify the systems and workforce in scope
HHS states that a covered entity must give each workforce member using a system that maintains electronic protected health information a unique identifier. The purpose is to identify and track access and activity by user. The requirement does not disappear because an office is small. HHS guidance on unique user IDs
Can the application identify the person?
Where HIPAA applies a named device login does not resolve a shared login inside the application.
Apply the requirement to the actual workflow
Establish where users are created, how the clinical or business application recognizes them, who approves access, and which events it records. A named Windows account does not automatically establish individual identification inside an application where everyone uses one common login. A password vault does not supply missing application activity records.
Acknowledge connected responsibilities
The directory or application user store, role definitions, vendor capabilities, authentication methods, and available logs all affect implementation. Onboarding, role changes, and offboarding need to reach each relevant system. Coordinate record retention and any required business associate arrangements with the responsible privacy, security, and organizational authorities.
RDA can help map those technical and operational responsibilities. Establish applicability and the system scope before treating a particular configuration as satisfying a requirement.