Portal 500 shows SQL with MRN
SI-11 fix returns generic apology page; detailed error stays in restricted logs without full PHI where possible.
Error Handling
Medium Risk
Moderate
Low Cost
SI-11 requires generating error messages that provide information necessary for corrective actions without revealing information that could be exploited, and revealing error messages only to authorized personnel. Stack traces with SQL and patient identifiers on patient portals are a classic ePHI disclosure.
Control Objective
Ensure applications and services handling ePHI handle errors securely — user-facing messages stay generic while detailed diagnostics go only to authorized operators under protection.
Implementation Guidance
- Define error-handling standards for ePHI apps (generic user messages, detailed server logs).
- Prohibit patient identifiers, tokens, and secrets in end-user error pages.
- Protect diagnostic logs as sensitive; restrict access and retain appropriately.
- Include error handling in code review/SA-11 tests.
- Configure web servers to hide stack traces in production.
- Train support staff not to paste full errors with ePHI into tickets unprotected.
- Apply to BA-hosted portals via contract.
- Monitor for verbose error patterns in production.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Interface engine dumps HL7 in UI errors
Admin console errors sanitized; full payloads only in access-controlled logs.
Helpdesk ticket with stack trace
Process change redacts ePHI before storing tickets in lower-trust systems.
Best Practices
- Generic user-facing errors.
- Restricted detailed logs.
- No secrets/PHI on error pages.
- Test error paths pre-prod.
- Redact tickets.
- BA portal requirements.
Common Gaps & Violations
- Stack traces on public portals.
- Verbose IIS/Apache errors in prod.
- Logs world-readable with ePHI.
- Tickets containing clear PHI dumps.
- No error-path testing.
Required Documentation
- Error handling standard (SI-11)
- Application secure-coding requirements
- Production web error configurations
- Log access controls
- Ticket redaction guidance
How to Test & Validate
- Trigger controlled errors on portal/EHR web — inspect user message.
- Verify stack traces disabled in prod.
- Review log access for diagnostic stores.
- Sample tickets for unredacted dumps.
- Check BA portal error behavior if accessible.
Audit Considerations
Verbose errors are both an information disclosure and HIPAA risk. SI-11 is easy to demonstrate with a few controlled tests on public-facing apps.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.530(c) Safeguards — prevent unintentional disclosure of PHI via system messages.
- 164.312(a) Access Control — error detail should not bypass access restrictions.
- 164.308(a)(1) Risk Management — information leakage via errors is a treatable risk.
- 164.312(b) Audit Controls — detailed errors belong in controlled audit/diagnostic channels.
Compliance Tips
- Add error-message checks to release testing.
- Turn off detailed errors in all production web tiers.
- Provide support with safe correlation IDs instead of PHI-laden traces.
Frequently Asked Questions
Should logs never contain ePHI?
Minimize; when needed for diagnostics, protect logs as ePHI stores with access control and retention limits.
Do device consoles need SI-11?
Yes where error displays could show ePHI to bystanders — apply PE-19 awareness too.
How related to SI-10?
SI-10 is information input validation; SI-11 is how errors are handled and revealed.
References & Resources
- NIST SP 800-53 Rev. 5 — SI-11
- Related controls: SI-10, SA-11, AU-2, SC-4, AC-3
Related Guidelines
Related controls that commonly accompany SI-11.
Need Help Implementing SI-11?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.