Battery fire in UPS room
Facilities uses protected EPO to cut power to a smoking row. PE-10 placement allows quick action; CCTV and cover deter prank activation.
Emergency Shutoff
Medium Risk
Moderate
Medium Cost
PE-10 requires providing the capability of shutting off power to systems or individual system components in emergency situations, placing shutoff switches or devices in accessible locations to allow personnel to act quickly, and protecting shutoff capability from unauthorized activation. Misplaced or unprotected EPO switches can halt EHR environments — or fail when fire/flood demands a safe kill.
Control Objective
Provide protected, usable emergency power shutoff for facilities or components supporting ePHI so responders can cut power safely in emergencies without enabling casual sabotage.
Implementation Guidance
- Determine where emergency shutoff is required (data halls, certain labs) per safety and security design.
- Locate switches for rapid authorized access during emergencies yet controlled against casual activation.
- Protect switches (covers, monitoring, cameras, PE-3 access) from unauthorized use.
- Document what loads are killed and impact on clinical systems; coordinate with clinical leadership.
- Train facilities, security, and data center staff on when and how to use shutoff.
- Test procedures in drills without unexpected clinical harm — use tabletop where live test is unsafe.
- Post clear labeling and emergency contacts.
- After activation, follow recovery steps with CP and PE-9 power restoration procedures.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Unauthorized shutoff attempt
Visitor lifts an unlocked cover in a tour route. PE-10 protection (alarmed cover, escort routes) prevents outage to EHR compute.
Drill clarifies clinical impact
Tabletop shows shutoff would take down pharmacy verification. Procedure updates sequencing and notification under PE-10.
Best Practices
- Accessible yet protected shutoff devices.
- Clear labeling and trained operators.
- Documented clinical impact of activation.
- Monitoring/alarms on EPO where feasible.
- Coordination with fire/life-safety plans.
- Recovery steps tied to CP.
Common Gaps & Violations
- EPO in public hallway with no cover.
- Staff unaware shutoff exists.
- No understanding of clinical blast radius.
- Shutoff wired incorrectly and untested.
- Activation leaves no audit/notification trail.
Required Documentation
- Emergency shutoff procedure (PE-10)
- Shutoff location map and protection method
- Training/drill records
- Clinical impact analysis for activation
- Post-activation recovery checklist
How to Test & Validate
- Locate shutoff devices; verify protection against casual use.
- Interview staff on activation authority.
- Review last drill or tabletop covering PE-10.
- Confirm labeling and contact postings.
- Trace monitoring/alarm if configured.
Audit Considerations
Assessors and fire marshals both care about emergency power control. Healthcare must balance life safety, ePHI availability, and sabotage resistance.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.310(a) Facility Access Controls — physical safeguards include emergency procedures affecting equipment.
- 164.308(a)(7) Contingency Plan — emergency shutoff is an emergency operation with recovery implications for ePHI.
- 164.310(a)(2)(i) Contingency Operations — facility access for facility restoration and data recovery.
- 164.306 Availability — controlled shutoff and recovery protect orderly availability management.
Compliance Tips
- Put PE-10 on data center emergency runbooks next to fire procedures.
- Alarm EPO covers into the SOC where practical.
- Never place unprotected shutoff on public tours.
Frequently Asked Questions
Must every IDF have an EPO?
Apply based on facility design and risk; PE-10 requires capability where the organization defines emergency shutoff needs for the system.
Can shutoff be purely breakers in a locked room?
If responders can access quickly under emergency procedures and unauthorized activation is controlled, document that design.
What if shutoff risks patient care devices?
Scope carefully — clinical biomedical power may follow different life-safety designs; coordinate with clinical engineering and codes.
References & Resources
- NIST SP 800-53 Rev. 5 — PE-10
- Related controls: PE-9, PE-11, CP-2, PE-13
Related Guidelines
Related controls that commonly accompany PE-10.
Need Help Implementing PE-10?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.