Housekeeper unplugs a switch
Vacuum needs an outlet; nursing VLAN switch loses power. PE-9 locking PDU covers and labeled critical circuits prevent casual unplugging.
Power Equipment and Cabling
High Risk
Moderate
Medium Cost
PE-9 requires protecting power equipment and power cabling for the system from damage and destruction. Frayed PDUs in IDFs, accessible emergency power feeds, and uncontrolled electrical work near EHR racks threaten both availability of ePHI systems and physical integrity of the environment.
Control Objective
Protect power equipment and cabling that support ePHI systems from accidental damage, tampering, and environmental harm so clinical and administrative systems remain powered within design tolerances.
Implementation Guidance
- Identify critical power paths for ePHI systems (UPS, generators, PDUs, transfer switches).
- Physically protect cabling with conduit, trays, and locked electrical rooms as appropriate.
- Restrict access to power gear to authorized facilities/electrical staff (PE-3).
- Label circuits supporting clinical systems; avoid casual unplugging.
- Maintain UPS/generator per manufacturer; test under load with CP exercises.
- Separate power for safety systems as designed; document SPOFs.
- Inspect IDFs for daisy-chained consumer power strips on EHR switches.
- Coordinate construction so contractors cannot cut live ePHI power feeds unnoticed.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Data center cabling chew risk
Rodent damage in a basement chase. Protected trays and inspection routes under PE-9 reduce cable exposure.
Generator test trips EHR UPS
Poor coordination causes transfer issues. PE-9 maintenance and CP-linked testing validates power equipment behavior before an outage.
Best Practices
- Locked electrical/UPS rooms.
- Protected cable routes.
- Labeled critical circuits.
- Scheduled UPS/generator maintenance.
- Ban unsafe power strips in IDFs.
- Construction coordination for power work.
Common Gaps & Violations
- Critical switches on extension cords.
- Open PDU access in shared closets.
- No UPS for IDFs hosting EHR edge gear.
- Generator never tested with clinical load.
- Contractors cutting unmarked cables.
Required Documentation
- Power protection standard (PE-9)
- Critical power path diagrams for ePHI systems
- Access control evidence for electrical rooms
- UPS/generator maintenance and test logs
- IDF power inspection records
How to Test & Validate
- Tour sample IDFs/data center for protected cabling and PDU access.
- Verify UPS maintenance currency.
- Confirm labeled circuits for EHR-related gear.
- Review last generator/UPS test results.
- Check work-order process for electrical contractors.
Audit Considerations
Physical tours and contingency tests reveal power weaknesses. Downtime from preventable power loss is both a care and HIPAA availability issue.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.310(a) Facility Access Controls — facility security plan protects equipment from hazards and unauthorized access.
- 164.308(a)(7) Contingency Plan — power resilience supports ePHI availability during emergencies.
- 164.310(a)(2)(ii) Facility Security Plan — safeguard equipment from tampering and environmental damage.
- 164.306 Ensure CIA — availability of ePHI systems depends on protected power.
Compliance Tips
- Add PE-9 checks to quarterly IDF walkthroughs.
- Tie UPS battery replacement calendars to CP evidence packs.
- Train EVS staff never to unplug labeled IT power.
Frequently Asked Questions
Does PE-9 require redundant power everywhere?
It requires protecting power equipment and cabling; redundancy is risk-based via contingency and PE-11 related controls.
Are clinic closets in scope?
Yes when they house switches, ePHI servers, or other components whose power loss impacts ePHI systems.
How does PE-9 relate to PE-11?
PE-9 protects power infrastructure; PE-11 addresses emergency power capacity for the system.
References & Resources
- NIST SP 800-53 Rev. 5 — PE-9
- Related controls: PE-11, PE-12, CP-2, PE-3
Related Guidelines
Related controls that commonly accompany PE-9.
Need Help Implementing PE-9?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.