AC-17 requires establishing and documenting usage restrictions, configuration requirements, connection requirements, and implementation guidance for each type of remote access allowed, authorizing remote access before connections are established, and monitoring remote access for unauthorized use. For clinics and hospitals this covers VPN, secure virtual desktops, EHR vendor remote tools, and telehealth clinician access to ePHI from off-site locations.
Allow remote work and telehealth without opening unmanaged pathways into systems that store or process ePHI — every remote method is authorized, configured, monitored, and revokeable.
How this control shows up in healthcare and HIPAA-covered environments.
A coder needs EHR access from home. Instead of exposing RDP to the internet, AC-17 drives a VPN + MFA + company laptop (or VDI) policy so charts never land on an unmanaged PC, and sessions are logged for audit.
The EHR hoster requests remote admin access after hours. AC-17 requires a ticket, named engineer account, time-boxed approval, and monitoring — not a standing shared support login permanently allowed through the firewall.
A physician sees patients via telehealth while traveling. Remote access is limited to the telehealth + EHR web apps through SSO with MFA; split-tunnel VPN to the whole clinical VLAN is denied by policy.
Auditors map remote access to HIPAA transmission and access controls. Expect demos of MFA, device requirements, and evidence that vendor remote tools are controlled — not just a VPN screenshot.
How this NIST control supports HIPAA Security Rule expectations.
No. AC-17 requires authorized, controlled remote methods. VDI or SSO to a hardened cloud EHR can qualify if risks are managed — but unmanaged home PCs with direct EHR logins usually do not.
AC-17 covers the remote connection method and usage rules. AC-19 focuses on the mobile device itself (phone/tablet/laptop controls).
If they access ePHI remotely through your systems or theirs, remote access risks still apply — cover expectations in the BAA and their security program.
Related controls that commonly accompany AC-17.
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.
