AC-10 limits the number of concurrent sessions for each system account. By capping how many simultaneous logons a user (or role) may hold, organizations reduce the window in which stolen credentials, shared passwords, or abandoned remote sessions can be abused in parallel — a practical control for EHR, VPN, cloud apps, and privileged access paths that touch ePHI.
Prevent a single account from maintaining an unlimited number of simultaneous sessions, lowering the impact of credential theft, session hijacking, and informal password sharing in clinical environments.
How this control shows up in healthcare and HIPAA-covered environments.
A practice manager's VPN account allows unlimited concurrent sessions. An attacker logs in from abroad while she works from home — both sessions stay active. With AC-10 set to one VPN session, the second logon is blocked or drops the first, producing an immediate help-desk call and investigation.
A floating nurse works Monday at Clinic A and Tuesday at Clinic B. Without session controls, yesterday's session may remain open on a shared PC. A concurrent limit of one interactive EHR session, combined with AC-11/AC-12 lock and terminate policies, closes abandoned sessions when she signs on elsewhere.
The EMR configuration admin role is limited to a single concurrent console session. That stops a phished admin password from being used in parallel with the legitimate change window, and forces clearer operational discipline around who is 'on console.'
Auditors will ask for the defined numeric limits, where they are enforced, and proof from configuration — not screenshots of a policy PDF alone. Be prepared to explain clinical workflow exceptions and how accountability is preserved.
How this NIST control supports HIPAA Security Rule expectations.
Start with one remote/VPN session and one privileged session. For clinicians moving between workstations, allow the minimum that matches real workflow (often 1–2) and fix shared-password habits instead of raising the cap.
No. Concurrent limits restrict how many sessions exist at once; AC-11/AC-12 and HIPAA automatic logoff address idle and finished sessions.
Publish a self-service 'sign out other sessions' option or a help-desk kill-session procedure with identity verification.
Related controls that commonly accompany AC-10.
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.
