- Citation
45 CFR 164.312(a)(2)(iii)- Standard
- Access control, 164.312(a)(1)
- Safeguard
- Technical safeguards
- Type
- Addressable
What the rule says
Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.45 CFR 164.312(a)(2)(iii), as currently in force
In plain English: Screens and sessions with patient information should lock themselves when nobody's using them, after a time you've chosen and written down, so a walk-away doesn't become a disclosure.
What it means in practice
- Applies to every session with ePHI: Windows and Mac screens, the EHR, email, cloud apps, phones and tablets.
- The rule sets no number. You choose a timeout per context, justify it in the risk analysis, and enforce it technically.
- Shared operatory or nursing station workstations need short timeouts and easy re-authentication; a locked office can be longer.
- Enforced centrally, not left to each user's settings.
- Addressable: implement it, or document why not and do the equivalent. There's rarely an equivalent.
The screen that walks away when you do. That's the short version of this requirement.Your engineer
What OCR looks for
If an investigation touches this requirement, the data request will ask for some or all of the following.
- The policy stating timeouts by context.
- Configuration exports or agent reports showing the setting is enforced.
- EHR session timeout settings.
- Mobile device management or agent evidence for phones and tablets.
Where entities get caught
Automatic logoff rarely appears alone in a settlement; it appears as part of access control failures and in the risk analysis finding, where an unexamined shared workstation is exactly the kind of risk OCR expects you to have rated.
How to meet it at a small organization
Reasonable, defensible settings many small practices use: 10 to 15 minutes for staff workstations in controlled areas, 2 to 5 minutes for shared workstations in operatories, exam rooms or the front desk, the EHR's own session timeout set in the same range, and phones locking within one to two minutes. Write the numbers in the policy and enforce them through Windows or macOS policy, Intune, Google endpoint management or an agent.
Under the proposed Security Rule update
The proposal would remove the addressable designation, making automatic logoff a required specification. The update was proposed in January 2025 and remains a proposal as of October 2026; see what's changing.
This page explains a federal regulation in plain language. It isn't legal advice, and AccuSights doesn't certify compliance; no one can. For every standard and specification, see the Security Rule, clause by clause.
With AccuSights: The endpoint agent reports the screen-lock setting on every workstation and flags any machine that drifts from your policy, so the evidence for this specification collects itself.