Nursing station lock still shows banner
An RN locks the EHR but the workstation keeps the patient name and MRN in the taskbar preview. AC-11(1) forces a blank lock image so visitors cannot read demographics.
Pattern-Hiding Displays
High Risk
Easy
Low Cost
AC-11(1) enhances base AC-11 session lock by requiring the system to conceal, via the device display, information previously visible on the display with a publicly viewable image. In clinics and hospitals, a locked workstation that still shows the last chart, patient banner, or medication list fails the intent — pattern-hiding (blank, logo, or approved lock image) prevents waiting-room visitors and passersby from reading ePHI while the session remains locked for re-authentication.
Control Objective
When a session locks, hide all previously displayed ePHI and clinical content behind a non-informative lock screen so locked devices do not leak protected health information.
Implementation Guidance
- Configure OS and EHR/VDI lock screens to blank or show only an approved organizational image — never a live window thumbnail of the last chart.
- Disable lock-screen notifications that surface patient names, secure-message previews, or appointment details.
- Apply pattern-hiding to nursing-station PCs, ED trackboards mirrored to secondary displays, and shared WOWs (workstations on wheels).
- Verify thin-client and Citrix/AVD lock behavior after idle lock — some brokers leave last-frame ePHI visible.
- Ban custom lock wallpapers that include screenshots of clinical apps.
- Include mobile MDM lock screens for phones with clinical apps (hide message previews).
- Test after EHR and OS upgrades — display policies often reset.
- Document exceptions only for devices in controlled areas with compensating physical barriers.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
ED hallway WOW
A locked WOW outside a trauma bay previously showed the last ECG viewer frame. Pattern-hiding replaces it with the hospital logo until badge re-auth.
Secure chat lock-screen leak
Clinical messaging pushed the last VIP patient text onto the phone lock screen. MDM suppresses previews so AC-11(1) intent holds on mobile.
Best Practices
- Prefer fully blank or static logo locks over live window previews.
- Suppress lock-screen notifications carrying PHI.
- Validate VDI and EHR clients separately.
- Include hallway and shared devices in scope.
- Retest after major OS/EHR patches.
- Pair with short idle timers (AC-11 / AC-2(5)).
Common Gaps & Violations
- Windows lock shows open EHR window thumbnails.
- Mobile lock-screen previews of clinical messages.
- Secondary trackboard displays that never blank.
- Screen savers that cycle through personal photos of whiteboards.
- VDI disconnect leaving last ePHI frame on the thin client.
Required Documentation
- Session lock and pattern-hiding standard (AC-11(1))
- OS/GPO/MDM lock-screen baselines
- EHR/VDI configuration evidence
- Exception list for controlled-area displays
- Periodic validation test records
How to Test & Validate
- Lock an EHR session mid-chart; confirm no ePHI remains visible.
- Trigger lock via idle timeout and manual lock; verify both hide content.
- Check mobile clinical apps for lock-screen notification leakage.
- Inspect thin-client/VDI last-frame behavior.
- Spot-check nursing-station devices on walkthrough.
Audit Considerations
Surveyors observe locked workstations in corridors. A locked PC that still displays a chart is an immediate AC-11(1)/privacy finding even if password is required to resume.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.310(b) Workstation Use — policies for proper use include not exposing PHI on displays.
- 164.310(c) Workstation Security — physical safeguards for workstations in public areas.
- 164.312(a)(1) Access Control — session lock with concealed display supports limited access.
- 164.530(c) Safeguards (Privacy Rule) — reasonable safeguards against incidental disclosure.
Compliance Tips
- Add pattern-hiding checks to monthly floor privacy rounds.
- Treat lock-screen PHI previews as a privacy incident category.
- Align clinical informatics and endpoint teams so EHR and OS locks both blank.
Frequently Asked Questions
Is a password-protected lock enough without hiding the screen?
No. AC-11(1) specifically requires concealing previously visible information — authentication alone does not stop shoulder surfing of a frozen chart.
Can we show the hospital logo?
Yes. A static approved image or blank screen is fine; avoid any content that reveals the prior session.
Do medication-room workstations need this?
Yes whenever the display can be viewed by unauthorized persons; controlled rooms may still need it if visitors or vendors enter.
References & Resources
- NIST SP 800-53 Rev. 5 — AC-11(1)
- Related controls: AC-11, AC-12, AC-2(5), PE-5
Related Guidelines
Related controls that commonly accompany AC-11(1).
Need Help Implementing AC-11(1)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.