Night outage in the data hall
Power fails; emergency lights guide operators to safe exit and to PE-10 shutoff if required — not flashlight tribal knowledge.
Emergency Lighting
Medium Risk
Easy
Low Cost
PE-12 requires employing and maintaining automatic emergency lighting that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility. Dark data centers and HIM vaults during outages delay secure shutdown and safe egress around ePHI environments.
Control Objective
Provide maintained automatic emergency lighting for exits and evacuation routes in facilities that house ePHI systems and sensitive records so personnel can respond safely during power loss.
Implementation Guidance
- Confirm emergency lighting covers exits and egress paths for data centers, IDFs with staff access, HIM, and related spaces.
- Prefer automatic activation on power loss with battery packs tested per schedule.
- Include stairwells and routes staff use to reach emergency shutoff or staging areas.
- Inspect/test units on a defined cadence; replace failed batteries promptly.
- Coordinate with PE-11 emergency power for longer outages where needed.
- Document landlord vs organization responsibility in leased clinics.
- After renovations, re-validate coverage — construction often leaves dark zones.
- Train staff that emergency lighting supports both life safety and orderly equipment response.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
HIM basement vault
Records area lighting fails test. PE-12 maintenance replaces packs before an auditor night walk finds a dark vault.
Clinic lease gap
Ambulatory suite relies on building emergency lights. Attestation and annual check confirm coverage for spaces with ePHI workstations.
Best Practices
- Automatic activation on outage.
- Regular battery/functional tests.
- Coverage of exits and critical routes.
- Post-renovation revalidation.
- Lease clarity for non-owned sites.
- Pair with evacuation drills.
Common Gaps & Violations
- Dead emergency light batteries.
- Coverage gaps after remodel.
- Assuming landlord coverage without checks.
- No lighting on path to EPO.
- Test logs missing for IT spaces.
Required Documentation
- Emergency lighting standard (PE-12)
- Coverage map for ePHI-relevant facilities
- Inspection/test logs
- Lease/attestation evidence
- Work orders for failed units
How to Test & Validate
- Inspect sample emergency lights and test logs.
- Walk egress routes in dark-simulation or review design.
- Verify automatic activation method.
- Check clinic attestations.
- Confirm post-renovation inspection occurred.
Audit Considerations
Life-safety inspectors and HIPAA physical safeguard reviews both notice dark exits. PE-12 is straightforward evidence when maintenance logs exist.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.310(a) Facility Access Controls — facility security and emergency operations need safe access/egress.
- 164.308(a)(7) Contingency Plan — power disruption procedures include safe staff response in facilities.
- 164.310(a)(2)(ii) Facility Security Plan — physical safeguards during emergencies.
- 164.306 Availability and integrity — orderly emergency response protects systems and people.
Compliance Tips
- Put emergency light tests on the same facilities calendar as fire extinguisher checks.
- Include IT spaces explicitly in coverage inventories.
- Fix failed units within defined SLAs.
Frequently Asked Questions
Is PE-12 only about exit signs?
It covers automatic emergency lighting for exits and evacuation routes — broader than decorative exit signage alone.
Do cloud data centers satisfy our PE-12?
Provider facilities are assured via vendor controls; you still implement PE-12 in your own facilities.
How long must batteries last?
Follow applicable building/fire codes and your facility standard; document the requirement.
References & Resources
- NIST SP 800-53 Rev. 5 — PE-12
- Related controls: PE-11, PE-13, CP-2, PE-3
Related Guidelines
Related controls that commonly accompany PE-12.
Need Help Implementing PE-12?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.