Are there existing standards on inactivity timeouts we can reference?
HIPAA Weekly Advisor, September 6, 2004
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Our doctors complain that the 15-minute inactivity timeout is too short. They want us to change it to 30 minutes. Are there existing standards we can reference?
No universally accepted standard exists for how quickly an inactive session should time out. A CMS publication titled Information Security Acceptable Risk Safeguards calls for a 15-minute timeout. But there are problems with this.
It is important to understand that the risk of an "open" connection on an unattended workstation largely depends on the physical surroundings. On an open floor in a hospital or in a busy emergency room accessible to the public, the risk is high and the timeout should be shorter than 15 minutes.
In a private office or other secure location off limits to unattended visitors, it's reasonable to make the inactivity timeout longer. Unfortunately, few application vendors provide a timeout feature a provider can set by location. Organizations should press vendors for this flexibility to better address risk and avoid unnecessarily short timeouts that irk users.
Editor's Note: Kate Borten, CISSP, CISM, is president and founder of The Marblehead Group, Inc., a national consulting firm focusing on the healthcare industry. This is not legal advice. Please consult your attorney for legal matters.
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Related Products
Most Popular
- Articles
-
- Q/A: Volume requirement for reporting hydration services
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- Catch up on what's new with injections and infusions
- Topic: CMS, OESS post new security compliance review information, checklist
- Capturing all necessary codes for IUD insertion and removal can be challenging
- HIPAA Q&A: Level of encryption needed for email
- What does case-mix index mean to you?
- QA:Coding multiple initial infusions
- News and briefs: Oklahoma Osteopathic Association against residency bill change
- OB services: Coding inside and outside of the package
- E-mailed
-
- Q/A: Volume requirement for reporting hydration services
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- HIPAA Q&A: Level of encryption needed for email
- CMS has reformulated payments for some bilateral procedures
- Catch up on what's new with injections and infusions
- New conflicts of interest create new challenges
- Q/A. One injection code or two?
- What does case-mix index mean to you?
- Hospitals are not bound by InterQual criteria for determining patient status
- ED-to-inpatient transfers are flawed with safety gaps
- Searched