Home NIST Guidelines PS-2(2)
PS-2(2) Personnel Security

Screening Criteria by Risk Designation

High Risk Moderate Medium Cost

PS-2(2) (Screening Criteria by Risk Designation) enhances base PS-2 within the NIST Personnel Security family. Base PS-2 sets the foundational expectation; this enhancement adds specificity: This enhancement strengthens PS-2 with requirements for screening criteria by risk designation in environments that create, receive, maintain, or transmit ePHI. Covered entities and business associates apply it to screening, onboarding, transfers, terminations, and sanctions for workforce and contractors who can reach ePHI.

Control Objective

Implement Screening Criteria by Risk Designation so organization-defined personnel security safeguards operate consistently on systems and networks that handle ePHI, with measurable evidence for HIPAA and NIST assessments.

Implementation Guidance

  1. Map PS-2(2) to systems in scope (EHR, imaging, lab, pharmacy, billing, identity, backups, and BA connections).\n2. Translate “Screening Criteria by Risk Designation” into technical settings, procedures, or architecture patterns owned by named roles.\n3. Prefer enforceable controls (config, automation, mediation) over awareness-only measures where feasible.\n4. Integrate with change, incident, and downtime processes so clinical operations are not surprised.\n5. Log and retain evidence of operation (tickets, configs, test results) aligned to audit needs.\n6. Include vendors/BAs in contracts and connection standards when they touch the control surface.\n7. Test after major EHR, network, or cloud changes — upgrades often reset protections.\n8. Review exceptions at least quarterly; expire “temporary” holes that expose ePHI paths.

Real-World Use Cases

How this control shows up in healthcare and HIPAA-covered environments.

Real-world scenario

EHR security admin screening (PS-2(2))\nPositions with standing rights to user security receive elevated screening before access is granted. Evidence labeled for PS-2(2).\n\n### Formal indoctrination for privacy roles (PS-2(2))\nROI and privacy investigators complete indoctrination on special protective measures for sensitive records. Evidence labeled for PS-2(2).\n\n### Rescreen on role change (PS-2(2))\nA registrar promoted into HIM disclosure is rescreened under the higher risk designation. Evidence labeled for PS-2(2).

Best Practices

  • Name an owner for PS-2(2) in the SSP control matrix.\n- Favor system enforcement on ePHI paths over informal email approval.\n- Measure coverage: percent of in-scope clinical systems where the enhancement operates.\n- Review exceptions quarterly with security and clinical informatics.\n- Feed relevant events to SIEM with a named use case.\n- Keep a one-page evidence pack (config + sample log + last test) ready for assessors.

Common Gaps & Violations

  • Policy cites PS-2(2) but production EHR/network paths show no enforcement of screening criteria by risk designation.\n- Permanent exceptions with no expiry for vendors or “special” clinics.\n- Control implemented only on corporate IT — clinical devices and interfaces omitted.\n- No logs or test records; reliance on tribal knowledge.\n- Major upgrade silently disabled the enhancement.

Required Documentation

  • Procedure/standard for Screening Criteria by Risk Designation (PS-2(2))\n- Architecture or configuration baselines showing enforcement points\n- Exception register with owners and expiry\n- Sample logs, alerts, or test results\n- Training or runbook references for clinical/IT operators

How to Test & Validate

  1. Attempt a prohibited or out-of-policy action related to screening criteria by risk designation; confirm block, alert, or required workflow.\n2. Complete an authorized clinical/IT path; confirm success and logging.\n3. Sample open exceptions for approval and expiry.\n4. Verify at least one EHR-adjacent and one BA/vendor path are in scope.\n5. Confirm evidence retained for the last 90 days (or per policy).

Audit Considerations

Assessors look for operating evidence of Screening Criteria by Risk Designation on systems touching ePHI — configs, logs, restore/DR artifacts, or failed-test results — not only a policy paragraph referencing PS-2(2).

HIPAA Mapping

How this NIST control supports HIPAA Security Rule expectations.

  • 164.308(a)(3) Workforce Security — authorize, supervise, clear, and terminate workforce access to ePHI.\n- 164.308(a)(3)(ii)(B) Workforce Clearance Procedure — determine access appropriateness.\n- 164.308(a)(3)(ii)(C) Termination Procedures — end access when employment ends.\n- 164.308(a)(1)(ii)(C) Sanction Policy — apply appropriate sanctions for violations.

Compliance Tips

  • List PS-2(2) explicitly in the system security plan with system inventory references.\n- Prioritize emergency department, inpatient EHR, and remote access paths first.\n- Bundle evidence with related HIPAA evaluation, integrity, or workforce-security narratives where they overlap.

References & Resources

  • NIST SP 800-53 Rev. 5 — PS-2(2)\n- Related controls: PS-2\n- Note: PS-2(2) is retained in this knowledge base for coverage continuity; confirm applicability against your adopted baseline and current NIST catalog.

Related Guidelines

Related controls that commonly accompany PS-2(2).

PS-2 High

Position Risk Designation

PS-2 requires assigning a risk designation to all organizational positions, establishing screening criteria for individuals filling those…
PS-1 High

Personnel Security Policy and Procedures

PS-1 requires personnel security policy and procedures addressing purpose, scope, roles, management commitment, coordination, and…
PS-3 High

Personnel Screening

PS-3 requires screening individuals prior to authorizing access to the system, and rescreening on an organization-defined frequency and…

Need Help Implementing PS-2(2)?

Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.

Contact Our Experts View All Guidelines