Impossible-travel VPN
A coder’s VPN appears from two states an hour apart. AC-17(1) alerting lets SOC disable the tunnel before bulk claim exports complete.
Monitoring and Control
High Risk
Moderate
Medium Cost
AC-17(1) enhances base AC-17 by employing automated mechanisms to monitor and control remote access methods. Authorizing VPN or vendor tools is not enough — healthcare organizations must see who is connected, from where, to which ePHI systems, and be able to disconnect or block abusive sessions in near real time during incidents or anomalous telehealth/VPN activity.
Control Objective
Continuously monitor remote connections that can reach ePHI and retain the ability to control (allow, limit, or terminate) those sessions when risk warrants.
Implementation Guidance
- Centralize VPN, VDI, ZTNA, and vendor remote-support logs into SIEM with user, source, device, and destination fields.
- Alert on impossible travel, new countries, mass file transfer, and after-hours privileged remote use.
- Enable live session kill from SOC/IAM for VPN and PAM vendor tools.
- Dashboard concurrent remote sessions into EHR and clinical networks.
- Record or closely monitor high-risk vendor remote support into production ePHI hosts.
- Review remote-access metrics weekly; investigate spikes after phishing campaigns.
- Integrate UEBA where available for remote clinician and coding workforce.
- Document who can authorize emergency disconnect during ransomware or insider events.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Vendor support overrun
EHR hoster remote session exceeds the approved window. Monitoring flags the still-open channel; ops terminate and require a new ticket.
Telehealth portal abuse
Sudden surge of failed remote SSO into the telehealth EHR triggers control rules that step-up MFA and temporary geo-blocks.
Best Practices
- Automate monitoring; do not rely on monthly log pulls alone.
- Practice session kill in IR tabletops.
- Prioritize privileged and vendor remote paths.
- Correlate remote access with DLP/exfil signals.
- Keep a 24×7 escalation path for disconnect.
- Measure mean time to terminate abusive remote sessions.
Common Gaps & Violations
- VPN logs retained but never reviewed or alerted.
- No way to kill a live vendor session quickly.
- Remote access inventory incomplete (SaaS EHR ignored).
- Alerts tuned so noisy they are ignored.
- Monitoring only corporate VPN while ignoring always-on vendor tunnels.
Required Documentation
- Remote access monitoring standard (AC-17(1))
- SIEM use cases and alert runbooks
- Session termination authority matrix
- Vendor remote monitoring/recording procedure
- Sample alerts and response tickets
How to Test & Validate
- Generate a test anomalous remote logon; confirm alert and response.
- Kill a test VPN/VDI session from the admin console.
- Verify vendor remote tools produce monitorable events.
- Review 30 days of remote alerts for disposition quality.
- Confirm SaaS EHR remote admin actions are in scope.
Audit Considerations
Assessors ask how you detect unauthorized remote use. Show live dashboards, alert examples, and evidence you can disconnect — policy text alone fails AC-17(1).
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(b) Audit Controls — mechanisms to record and examine activity in systems with ePHI, including remote paths.
- 164.308(a)(1)(ii)(D) Information System Activity Review — regular review of remote access activity.
- 164.312(a)(1) Access Control — ability to control remote access supports authorization enforcement.
- 164.308(a)(6) Security Incident Procedures — monitoring feeds incident detection for remote abuse.
Compliance Tips
- Put ‘remote session terminate’ on the IR quick-card.
- Include telehealth and cloud EHR in the monitoring diagram.
- Report remote-access anomalies in the monthly security metrics pack.
Frequently Asked Questions
Does logging without alerting satisfy AC-17(1)?
Weakly at best. The enhancement expects automated monitoring and control — detection plus ability to act.
Must every telehealth visit be watched live?
No. Focus on anomalous patterns, privileged remote admin, and vendor paths; retain logs for routine clinical access.
How does this relate to SI-4?
SI-4 is broader system monitoring; AC-17(1) specifically targets remote access methods.
References & Resources
- NIST SP 800-53 Rev. 5 — AC-17(1)
- Related controls: AC-17, SI-4, AU-6, IR-4, AC-12
Related Guidelines
Related controls that commonly accompany AC-17(1).
Need Help Implementing AC-17(1)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.