Non-bypassable SSN rule
Admin cannot configure a filter profile that allows raw SSN + full chart to public cloud — constraint blocks the save.
Security or Privacy Policy Filter Constraints
High Risk
Complex
Medium Cost
AC-4(14) requires security or privacy policy filter constraints as an enhancement to base AC-4 information flow enforcement. Base AC-4 establishes that flows must be authorized; this enhancement adds: Constrain filters so they cannot be configured to violate non-bypassable rules (e.g., never allow raw SSN+full chart to public cloud). Healthcare delivery organizations rely on this to keep ePHI within approved clinical, billing, and research pathways.
Control Objective
Place constraints on policy filters so administrators cannot weaken mandatory ePHI flow protections.
Implementation Guidance
- Define non-bypassable constraints (e.g., no raw SSN+full chart to public cloud).
- Enforce constraints in filter admin UI/API.
- Separate who can propose vs approve constraint changes.
- Preserve audit logging in all emergency profiles.
- Test attempted misconfiguration and confirm reject.
- Document constraint rationale for assessors.
- Review constraints annually with privacy.
- Monitor for constraint override attempts.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Break-glass filter floor
Even emergency profiles must keep audit logging and VIP tag enforcement — cannot configure silent full open.
Prod vs test constraint
Test filter configs cannot be promoted if they disable mandatory ePHI destination checks.
Best Practices
- Tie AC-4(14) to named owners in IAM/privacy/security.
- Prefer system enforcement over informal email approval.
- Measure coverage on systems that store or transmit ePHI.
- Review exceptions at least quarterly.
- Correlate events into SIEM use cases.
- Document mapping to HIPAA safeguards in the SSP.
Common Gaps & Violations
- Policy claims security or privacy policy filter constraints but no technical enforcement on EHR paths.
- Exceptions granted permanently without review.
- Vendors and research feeds left out of scope.
- Logs not retained or not reviewed.
- Upgrades silently disable the control.
Required Documentation
- Policy/procedure for Security or Privacy Policy Filter Constraints (AC-4(14))
- Configuration baselines and diagrams
- Exception register
- Sample logs/alerts
- Training or runbook evidence
How to Test & Validate
- Attempt a prohibited action related to security or privacy policy filter constraints; confirm block or required workflow.
- Complete an authorized path; confirm success and logging.
- Sample exceptions for expiry and approval.
- Verify ePHI systems in scope are covered (not only corporate IT).
- Confirm SIEM/alert or retention evidence for the last 90 days.
Audit Considerations
Assessors look for operating evidence of Security or Privacy Policy Filter Constraints on systems touching ePHI — screenshots, logs, and failed-test results — not only a policy paragraph referencing AC-4(14).
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(a)(1) Access Control — limit system access and, by extension, unauthorized information movement.
- 164.312(e)(1) Transmission Security — guard ePHI transmitted over networks and interconnections.
- 164.308(a)(4) Information Access Management — policies for access and disclosure pathways.
- 164.530(c) Safeguards / 164.514 Minimum Necessary — reduce unnecessary data in flows.
Compliance Tips
- List AC-4(14) explicitly in the system security plan control matrix.
- Prioritize EHR, VPN, HIE, and BA file-transfer paths.
- Keep a one-page evidence pack (config + sample log + exception list) ready for assessors.
Frequently Asked Questions
Can admins still emergency-open?
Only within constrained emergency profiles that preserve mandatory protections.
Who sets constraints?
Security architecture with privacy — not local filter admins alone.
How tested?
Attempt to save a noncompliant filter config and confirm reject.
References & Resources
- NIST SP 800-53 Rev. 5 — AC-4(14)
- Related controls: AC-4, AC-4(8), AC-4(11)
Related Guidelines
Related controls that commonly accompany AC-4(14).
Need Help Implementing AC-4(14)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.