Night outage in the server room
Automatic emergency lighting lets ops safely reach the orderly shutdown console and secure the room instead of using phone flashlights near live racks.
Emergency Power
Medium Risk
Easy
Low Cost
PE-11 requires employing and maintaining automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes. In healthcare, dark IDFs, pharmacies, and records rooms during outages create safety issues and impede controlled shutdown, guard response, and contingency actions protecting ePHI.
Control Objective
Provide reliable automatic emergency lighting for areas housing or supporting ePHI systems and for exits/evacuation routes so security and operations can continue safely during power loss.
Implementation Guidance
- Map areas: data centers, IDFs, EHR operations rooms, health information management, pharmacies with ePHI systems, and exit routes.
- Install automatic emergency lighting that activates on outage without manual switching.
- Cover evacuation routes and exits per life-safety codes and organizational standards.
- Test lighting on a defined schedule; replace batteries/units that fail.
- Coordinate with PE-12 emergency power for continuity of critical spaces.
- Ensure contractors and night staff know lighting is automatic — procedures for if it fails.
- Include ambulatory buildings under organizational control, not only hospitals.
- Document maintenance in facilities systems for audit evidence.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Clinic evacuation after storm power loss
Exit-route lighting supports safe egress while security ensures workstations with ePHI are locked/logged off per contingency steps.
Failed battery pack found on test
Monthly PE-11 test flags a dark corridor to the HIM vault; facilities replaces the unit before the next outage.
Best Practices
- Automatic activation required.
- Cover exits and critical ePHI support areas.
- Scheduled testing and battery replacement.
- Tie to facilities CMMS work orders.
- Coordinate with emergency power plans.
- Include off-campus owned/leased clinics.
Common Gaps & Violations
- Emergency lights present but never tested.
- IDF closets left dark during outages.
- Only exits covered — not system areas needed for secure shutdown.
- Battery failures known and deferred indefinitely.
- New wing opened without PE-11 commissioning.
Required Documentation
- Emergency lighting standard (PE-11)
- Coverage map for ePHI-relevant areas and exits
- Testing and maintenance schedule/results
- Work orders for failed units
- Coordination notes with emergency power (PE-12)
How to Test & Validate
- Review recent emergency lighting test logs.
- Spot-check critical rooms for functional units.
- Confirm automatic activation design (no manual-only).
- Verify exit routes in a clinic sample are covered.
- Trace a failed test to remediation evidence.
Audit Considerations
Life-safety and security tours often include lighting. Dark critical spaces during simulated outages undermine contingency and facility access control narratives.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.310(a) Facility Access Controls — facility security plan and contingency operations benefit from safe access during emergencies.
- 164.308(a)(7) Contingency Plan — emergency mode operation assumes staff can navigate and secure facilities.
- 164.310(a)(2)(i) Contingency Operations — procedures for facility access support to restore lost data in emergencies.
- 164.306 Ensure availability — physical environmental controls support system availability and safe response.
Compliance Tips
- Put PE-11 tests on the same calendar as generator tests where practical.
- Include IDF/MDF rooms in coverage maps, not only corridors.
- Store test evidence where security and facilities assessors can both retrieve it.
Frequently Asked Questions
Is exit lighting alone enough for PE-11?
Exits and evacuation routes are required coverage; also employ lighting that supports system/facility needs defined by your risk posture for ePHI areas.
How often should lights be tested?
Follow manufacturer and life-safety code requirements; document organization-defined frequencies and keep results.
Does PE-11 apply to cloud-only providers?
For your facilities that house endpoints, network rooms, and records — yes. Provider data centers are assessed via BA/vendor controls.
References & Resources
- NIST SP 800-53 Rev. 5 — PE-11
- Related controls: PE-12, PE-13, CP-2, PE-3
Related Guidelines
Related controls that commonly accompany PE-11.
Need Help Implementing PE-11?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.