AC-9 notifies the user, upon successful logon, of the date and time of the last successful logon and, where implemented, information about unsuccessful logon attempts since the last successful access. This simple feedback loop helps workforce members notice account misuse that automated tools may miss — especially shared workstations and remote access to ePHI systems.
Give authenticated users enough last-logon context to recognize possible unauthorized use of their credentials and report it quickly.
How this control shows up in healthcare and HIPAA-covered environments.
A nurse logs into the EHR at 07:00 and sees last successful logon at 02:14. She was asleep. She reports it; investigation finds credential reuse from a personal email breach. Password reset and session termination (AC-12) stop further ePHI access.
A remote coder's IdP shows last logon from an unfamiliar city. Combined with AC-7 lockout history, security confirms a stolen password attempt and enforces MFA enrollment the same day.
Domain admins see previous privileged logon details on the bastion host, making it harder for a silent hijack to go unnoticed between change windows.
AC-9 is often marked 'not selected' in some baselines, but when you claim it, show system evidence and user awareness. For HIPAA programs it is a low-cost detection control that supports login monitoring expectations.
How this NIST control supports HIPAA Security Rule expectations.
Selection depends on your baseline/overlay. Even when optional, healthcare organizations often implement it because it is inexpensive and supports HIPAA login monitoring.
Document the limitation and use IdP/SSO login notifications, email alerts, or SIEM user behavior alerts as compensating controls.
No. It is a human-facing signal that complements centralized audit logging (AU family).
Related controls that commonly accompany AC-9.
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.
