AC-11 requires initiating a session lock after an organization-defined period of inactivity, or on user demand, and retaining the lock until the user re-authenticates. Session lock conceals on-screen information and blocks further activity — essential on nursing stations, registration desks, and admin laptops where ePHI can otherwise remain visible to passersby.
Ensure unattended authenticated sessions cannot be used or viewed by others without re-authentication, protecting on-screen ePHI and system integrity.
How this control shows up in healthcare and HIPAA-covered environments.
A front-desk clerk steps away to help a patient with paperwork. Without session lock, the next visitor can read demographics and insurance details on screen. A 3-minute idle lock plus staff habit of manual lock prevents exposure.
Emergency department PCs need fast access. The organization uses short locks with badge tap-in rather than long passwords typed each time — meeting AC-11 intent without slowing care.
A care manager's laptop auto-locks after 5 idle minutes during a meeting break, blocking access to care-plan documents if another attendee tries the keyboard.
HIPAA assessors frequently sample workstations on the floor. They look for effective lock behavior in real workflows, not only a GPO screenshot. Be ready to explain clinical timeout exceptions.
How this NIST control supports HIPAA Security Rule expectations.
No. Lock keeps the session intact but blocked; logoff/termination (AC-12) ends the session. Busy clinics often lock for short absences and fully log off at end of shift.
There is no single federal number. Choose risk-based values, document them, enforce them, and be able to justify clinical area settings.
Yes if the solution still re-authenticates the correct user at a strength your risk analysis accepts.
Related controls that commonly accompany AC-11.
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.
