Patient portal directory listing fixed
Legacy /assets folder listed backup SQL files. AC-3(6) remediation disables indexing and moves backups off the web root — preventing bulk ePHI theft via 'system information' exposure.
AC-3(6) Protection of User and System Information
High Risk
Moderate
Low Cost
AC-3(6) requires protecting organization-defined user and system information while being processed, stored, or transmitted within the system — beyond the primary ePHI objects themselves. Examples include usernames in logs, process listings that reveal clinical app architecture, directory indexes on web servers, diagnostic dumps, and system documentation. Attackers and curious insiders use this metadata to find ePHI paths or impersonate users.
Control Objective
Prevent unauthorized access to user and system metadata that could expose ePHI, weaken privacy, or enable further compromise of healthcare systems.
Implementation Guidance
- Disable directory browsing on portals that front clinical apps.
- Restrict who can query IdP/EHR user directories and export user lists.
- Harden error messages so stack traces never include patient identifiers or SQL.
- Limit OS-level process/file enumeration on multi-user clinical workstations and Citrix farms.
- Protect CMDB and architecture diagrams with need-to-know access (also AC-3(5)).
- Redact or tokenize user identifiers in lower environments when full prod clones are unavoidable.
- Control transmission of system inventories off-network (vendor support shares).
- Review printer banners, lock screens, and screen-share defaults for inadvertent system/user info exposure.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Helpdesk tool user enumeration
Only Tier-2 identity staff can search the full enterprise directory for VIP accounts; front-line scripts return minimal attributes.
Vendor screen-share during EHR ticket
Support session policy blocks unattended control and forbids exporting system configuration files without ticketed approval and redaction review.
Best Practices
- No directory listing on internet-facing clinical sites.
- Minimize attributes returned by user-lookup APIs.
- Sanitize errors and crash dumps.
- Protect architecture and inventory docs.
- Govern vendor access to system information.
- Treat user lists as sensitive when they map to care roles or VIP patients.
Common Gaps & Violations
- Open directory indexes on forgotten IIS/Apache sites.
- Verbose EHR errors showing patient MRNs.
- Full AD exports on analysts' laptops.
- Unrestricted CMDB for all IT contractors.
- Debug mode left on in production portals.
Required Documentation
- Hardening standard for system/user information protection
- Web server and portal configuration baselines
- Error-handling / debug-mode policy
- Directory and user-export access rules
- Vendor support information-handling procedure
How to Test & Validate
- Crawl clinical web roots for directory listing and backup file exposure.
- Trigger application errors as a low-priv user; inspect for ePHI or stack secrets.
- Attempt full user-directory export with a standard account; confirm deny.
- Review Citrix/VDI permissions for process/file enumeration abuse cases.
- Sample vendor tickets for over-shared system exports.
Audit Considerations
Technical tests often find forgotten directory listings or verbose errors. These are treated as access-control failures even when the 'main' EHR login works correctly.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(a)(1) Access Control — protect information systems that maintain ePHI, including supporting system information.
- 164.312(c) Integrity — unauthorized alteration of system info can undermine ePHI integrity protections.
- 164.530(c) Safeguards — protect PHI from intentional/unintentional disclosure, including via metadata leaks.
- 164.308(a)(1) Risk Analysis — information disclosure via system metadata is a credible threat vector.
Compliance Tips
- Add a quarterly 'exposed files' scan to vulnerability management for patient portals.
- Turn off detailed errors in all production clinical apps as a go-live gate.
- Classify enterprise user rosters as confidential.
Frequently Asked Questions
Is this only about protecting ePHI fields?
No — it covers user and system information that can enable ePHI compromise or privacy harm.
Are usernames alone PHI?
Not always, but user directories tied to care relationships or VIP status can be sensitive; restrict broadly.
How does this differ from AC-3(5)?
AC-3(5) focuses on security-control data; AC-3(6) covers broader user/system information protection during processing, storage, and transmission.
References & Resources
- NIST SP 800-53 Rev. 5 — AC-3(6)
- Related: AC-3, AC-3(5), SI-11, SC-4, AU-9
Related Guidelines
Related controls that commonly accompany AC-3(6).
Need Help Implementing AC-3(6)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.