ED tracking board visible to waiting room
Board shows patient names/status. PE-19 review relocates or applies privacy filtering for public sight lines.
Information Leakage
Medium Risk
Moderate
Low Cost
PE-19 requires protecting the system from information leakage due to electromagnetic signals and other emanations, or limiting leakage to organization-defined levels. In practical healthcare programs this includes shoulder-surfing of EHR screens, printer output in public areas, and — where risk warrants — technical emanation controls for high-sensitivity environments.
Control Objective
Reduce unauthorized observation and emanation of ePHI from system components through physical placement, privacy aids, and, where justified, technical leakage limits.
Implementation Guidance
- Assess leakage risks: public-facing screens, registration desks, shared printers, glass conference rooms overlooking EHR ops.
- Deploy privacy screens, session lock (AC-11), and display positioning for clinical workstations.
- Route ePHI print jobs to secured printers; avoid lobby multi-functions for clinical output.
- Use clean desk and remove printed ePHI promptly (MP controls).
- For high-risk programs (e.g., certain research/government care), evaluate electromagnetic emanation requirements explicitly.
- Train workforce on shoulder-surfing awareness in open bays.
- Review telehealth and remote work camera angles that capture ePHI screens.
- Document risk-based scope so PE-19 is not ignored as only TEMPEST.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Registration desk shoulder surf
Visitor photographs an insurance card screen. Privacy screen plus recessed monitor positioning reduce leakage.
Shared floor printer
After-visit summaries sit in an open bin. Secured release printing under PE-19/MP handling stops casual pickup of ePHI.
Best Practices
- Privacy screens in public clinical areas.
- Secure print release for ePHI.
- Position monitors away from public view.
- Session lock and screen timeout.
- Risk-based emanation analysis for high sensitivity.
- Telehealth screen hygiene.
Common Gaps & Violations
- Waiting-room visibility into EHR screens.
- Unattended clinical printouts.
- Glass war rooms with live ePHI dashboards.
- Ignoring PE-19 as irrelevant outside defense.
- Remote workers on planes with open charts.
Required Documentation
- Information leakage / visual privacy standard (PE-19)
- Workstation placement and privacy-screen requirements
- Secure printing procedures
- Risk assessment for emanation controls if applicable
- Training materials on visual privacy
How to Test & Validate
- Observe registration/nursing stations for visual exposure.
- Check printer locations and release controls.
- Verify privacy screens where required.
- Sample telehealth workspace guidance.
- Review any high-sensitivity emanation requirements and evidence.
Audit Considerations
Visual leakage is one of the most common physical privacy failures in clinics. Assessors and mystery-walkers notice it immediately.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.530(c) Safeguards — reasonable and appropriate safeguards to protect PHI from intentional or unintentional disclosure.
- 164.312(a) Access Control — automatic logoff and access controls reduce on-screen exposure time.
- 164.310(b) Workstation Use — policies for physical attributes of surroundings of workstations that access ePHI.
- 164.310(c) Workstation Security — physical safeguards for workstations that access ePHI.
Compliance Tips
- Add visual privacy to clinic security walkthrough checklists.
- Prefer pull-print everywhere clinical documents print.
- Include PE-19 in telehealth onboarding.
Frequently Asked Questions
Is PE-19 only TEMPEST?
The control addresses emanations broadly; healthcare programs should treat visual/printer leakage as in-scope even when full TEMPEST is not required.
Do privacy screens alone satisfy PE-19?
They help for visual risks; combine with placement, lock, and print controls — and technical emanation limits only where risk analysis demands.
Are speakerphones disclosing PHI a PE-19 issue?
Acoustic leakage is a privacy safeguard concern; address under workstation use/privacy policies alongside PE-19 visual controls.
References & Resources
- NIST SP 800-53 Rev. 5 — PE-19
- Related controls: AC-11, AC-4, PE-5, MP-2, SC-4
Related Guidelines
Related controls that commonly accompany PE-19.
Need Help Implementing PE-19?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.