Evolution of healthcare systems and the constantly changing regulatory landscape continuously alter all facets of health information technology including access. Access to information systems must be controlled in order to protect privacy and confidentiality. Access systems must be flexible enough to be applicable regardless of device and location. While access must be secure, it cannot obstruct the efficient care of patients. Access controls depend on position because privileges and permissions depend on position. These controls are the method of enforcing authorization through mechanisms and policies. This chapter discusses some of the mechanisms of controlling access. Also discussed are some practical considerations for client and device strategy.