Registration desk facing the lobby
Privacy filters and monitor angles stop visitors from reading full demographics and insurance screens — PE-5 output control in a public area.
Access Control for Output Devices
Medium Risk
Easy
Low Cost
PE-5 requires controlling physical access to output from output devices to prevent unauthorized individuals from obtaining output containing sensitive information. In healthcare this means protecting workstation monitors, clinical displays, label printers, badge printers, and multi-function printers that emit ePHI — shoulder surfing, abandoned print jobs, and public waiting-room sight lines are everyday risks.
Control Objective
Prevent unauthorized viewing or retrieval of ePHI (and other sensitive output) from monitors, printers, and related output devices.
Implementation Guidance
- Position workstations and clinical displays to minimize public viewing; use privacy screens in open registration and ED triage areas.
- Enable auto screen lock (AC-11) with short timeouts on shared clinical workstations.
- Secure printer output: pull-printing / secure release, locked printer rooms, or immediate retrieval rules for PHI print jobs.
- Clear abandoned print jobs on a schedule; monitor high-risk printers near waiting areas.
- Control physical access to rooms housing high-volume PHI printers and fax/MFP devices.
- Train staff on screen positioning and 'clean desk / clean screen' expectations.
- Assess telehealth and remote work output risks (home printers, shared household viewing).
- Include specialty devices (wristband printers, Rx label printers, film printers) in walkthroughs.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Secure print for ROI packets
HIM jobs release only when staff badge at the printer, eliminating abandoned ePHI stacks on the output tray.
ED trackboard visible to hallway
Display is repositioned and unauthorized hallway viewing mitigated; visitor path no longer exposes patient names and chief complaints.
Best Practices
- Privacy screens in public-facing areas.
- Short lock timeouts on shared clinical PCs.
- Pull-print or locked printer rooms for PHI.
- Regular sweeps for abandoned output.
- Walkthroughs including specialty label printers.
- Remote-work output guidance.
Common Gaps & Violations
- Monitors readable from waiting lines.
- Stacks of patient labels left on printers.
- No screen lock on shared nursing stations.
- Fax/MFP in unlocked hallway closets.
- Home printing of ePHI without safeguards.
Required Documentation
- Output device / display protection procedure
- Secure print standards
- Workstation placement guidelines
- Walkthrough / risk assessment notes
- Training on clean screen practices
How to Test & Validate
- Conduct a public-area shoulder-surf walkthrough.
- Verify secure print or locked output controls on PHI printers.
- Check screen-lock settings on shared clinical workstations.
- Inspect for abandoned print jobs during a tour.
- Review telehealth/remote print guidance.
Audit Considerations
Physical observation often finds ePHI on screens and printers in public view. PE-5 evidence includes placement standards, secure print, and periodic walkthrough results.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.310(b) Workstation Use — policies for appropriate workstation use and surroundings to access ePHI.
- 164.310(c) Workstation Security — physical safeguards for workstations that access ePHI.
- 164.530(c) Safeguards — reasonable safeguards to limit incidental disclosures, including visual access.
- 164.310(a) Facility Access Controls — rooms with PHI printers may need restricted access.
Compliance Tips
- Add PE-5 checks to monthly clinic safety rounds.
- Prefer pull-print for any device that can print full charts or ROI packages.
- Treat trackboards and waiting-room sight lines as intentional design reviews, not afterthoughts.
Frequently Asked Questions
Is a privacy screen enough for PE-5?
It helps for displays, but PE-5 also covers printers and other output — use secure release and placement controls too.
How does PE-5 relate to AC-11?
AC-11 is session lock technically; PE-5 is physical control of what unauthorized people can see or take from output devices.
Do patient-facing status boards violate PE-5?
Minimize identifiable details visible to the public; assess incidental disclosure risk under HIPAA privacy safeguards.
References & Resources
- NIST SP 800-53 Rev. 5 — PE-5
- HIPAA §§ 164.310(b)–(c), 164.530(c)
- Related controls: AC-11, PE-3, MP-2, AC-8
Related Guidelines
Related controls that commonly accompany PE-5.
Need Help Implementing PE-5?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.