There is no HIPAA-mandated session timeout. Not 10 minutes, not 15, not any number. The regulation requires you to implement electronic procedures that terminate a session after “a predetermined time of inactivity” — and leaves the determining to you. That is not a loophole; it is the actual design of the rule, and it means the defensible answer is not a number you copied from a blog post. It is a number you can explain, varied by where the workstation physically sits, documented, and set so that clinicians do not have to defeat it to do their jobs.
There is no HIPAA timeout number
The provision is 45 CFR 164.312(a)(2)(iii), inside the Access control standard of the technical safeguards:
That is the whole text. Read what it does not contain: no duration, no range, no default, no distinction between clinical and administrative systems. The only temporal word is predetermined, and that word is pointing at you. The rule requires that a time exists and was decided in advance. It does not tell you what the time is.
So when someone says “HIPAA requires a 15-minute timeout,” they are quoting a convention, a vendor default, or a control from a framework their organization adopted. All three can be perfectly reasonable. None of them is the regulation, and it matters, because a team that believes 15 minutes is legally mandated will not do the analysis the rule actually asks for — and will not be able to justify the setting when someone asks.
What “addressable” obligates you to do
Automatic logoff is labeled (Addressable), and this is the most misread word in the Security Rule. Addressable does not mean optional.
HHS puts it directly in its risk analysis guidance: “An addressable implementation specification is not optional; rather, if an organization determines that the implementation specification is not reasonable and appropriate, the organization must document why it is not reasonable and appropriate and adopt an equivalent measure if it is reasonable and appropriate to do so.”
The mechanism lives at 45 CFR 164.306(d). Your options are:
- Implement it, if it is reasonable and appropriate for your environment. (For automatic logoff in a clinical setting, this is almost always the answer.)
- Document why it is not reasonable and appropriate, and implement an equivalent alternative measure if one is reasonable and appropriate.
There is no third door where you skip it and say nothing.
Note the contrast within the same paragraph of the rule. Two of Access control's four specifications are Required, not addressable:
| Specification | Cite | Label |
|---|---|---|
| Unique user identification | 164.312(a)(2)(i) | Required |
| Emergency access procedure | 164.312(a)(2)(ii) | Required |
| Automatic logoff | 164.312(a)(2)(iii) | Addressable |
| Encryption and decryption | 164.312(a)(2)(iv) | Addressable |
Unique user identification being Required is worth pausing on, because it is the one shared credentials violate, and shared credentials are the most common downstream consequence of a timeout that is too aggressive. Setting the addressable control badly is a good way to break the required one.
Set it by zone, not by system
Most organizations set one timeout for the whole EMR, then argue about the number. That framing is the problem. The rule itself points somewhere better.
45 CFR 164.310(b), the workstation use standard, requires policies and procedures specifying “the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information.”
Two phrases there are load-bearing. Physical attributes of the surroundings — the rule cares about the room. And class of workstation — the rule expects you to group them. Alongside it, 164.310(c), workstation security, requires physical safeguards for all workstations that access ePHI, to restrict access to authorized users.
So the coherent question is not “what is our timeout?” It is “what is the exposure of this class of workstation, and what timeout follows from that?” A screen a stranger can read from the waiting room is a different risk from a screen behind a locked door, and the same number for both means at least one of them is wrong.
A defensible zoning looks roughly like this — the categories are yours to set, but the reasoning should be visible:
- Public-facing or shared — reception, check-in, kiosks, hallway carts. Highest exposure: unauthorized viewing and unattended sessions with foot traffic. Shortest timeout, plus physical measures like privacy filters and screen angle.
- Semi-private clinical — exam rooms. The patient is present and unattended, which is a real and often overlooked exposure. Moderate timeout, tuned so a clinician stepping out briefly does not lose work.
- Private, access-controlled — provider offices, billing rooms behind badge access. Lower exposure because 164.310(a)(1) facility access controls are doing some of the work. Longer timeout is defensible, and the facility control is part of why.
- Mobile and off-site — laptops, tablets, home use. Highest exposure of all, because the physical safeguards you rely on elsewhere do not travel. Shortest timeout, and this is where encryption at 164.312(a)(2)(iv) earns its keep.
This is not the rule prescribing four zones. It is what falls out of taking “physical attributes of the surroundings” seriously.
Do not break emergency access
Whatever you set, check it against 164.312(a)(2)(ii), Emergency access procedure, which is Required: “Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.”
A timeout aggressive enough to lock a clinician out mid-code, with no procedure for getting back in, is a configuration that has traded a required specification for an addressable one. Test the interaction deliberately rather than discovering it during an actual emergency.
The workaround problem
This is where a technically compliant configuration becomes a genuine security regression, and it deserves to be stated plainly because it is the most common failure in the field.
Set the timeout too short and people do not become more careful. They adapt:
- They share credentials so a session stays live — defeating the Required unique user identification specification at 164.312(a)(2)(i) and, with it, your audit trail.
- They wedge a key down, run a mouse jiggler, or leave a video playing.
- They stop locking screens manually, because “it does that by itself.”
- They write notes on paper and enter them later, which creates ePHI's paper cousin sitting on a counter, and delays the chart.
Every one of those makes the organization less secure than a longer, well-reasoned timeout would have. And the audit-trail damage compounds: 164.312(b) requires audit controls that record and examine activity in systems containing ePHI, and 164.308(a)(1)(ii)(D) requires regular review of that activity. Shared logins turn both into fiction. You cannot review what you cannot attribute.
If you want to know whether your timeout is set correctly, do not re-read the policy. Go and look at the reception desk.The presence of workarounds is your answer, and it is better evidence than any document.
Screen lock is not the same control
Worth separating, because these get used interchangeably in practice and they do different things.
- OS screen lock — blanks the display and demands a credential. The EMR session persists underneath.
- Application session timeout — terminates the EMR session itself.
The rule's words are “terminate an electronic session.” A screen lock does not terminate a session; it obscures it. That does not make screen lock worthless — it is fast, it is what clinicians will actually use, and it meaningfully addresses the shoulder-surfing exposure at 164.310(c). But if your only control is an OS lock, be honest that you have chosen an alternative measure, and document it as one under the 164.306(d) procedure. Most organizations run both: a short OS lock for the person who walked away, and a longer application timeout that ends the session.
Documenting the decision
HHS is explicit about what makes an addressable decision defensible: “The outcome of the risk analysis process is a critical factor in assessing whether an implementation specification or an equivalent measure is reasonable and appropriate.” The decision is supposed to fall out of your risk analysis, not precede it.
So the record should show the chain: this class of workstation, in this physical setting, carries this exposure, therefore this setting. Under 164.316(b)(1), if an action, activity, or assessment is required to be documented, you maintain a written or electronic record of it. Under 164.316(b)(2)(i), you retain it for six years from creation or from when it was last in effect, whichever is later. And 164.316(b)(2)(iii) requires periodic review and update in response to environmental or operational changes.
That last one has teeth here. Moving the check-in desk, opening a second location, or rolling out carts is an environmental change to the physical attributes of the surroundings. The timeout decision should be revisited when the floor plan changes, not only when the policy comes up for review.
A working checklist
- Inventory workstations by class, per 164.310(b)'s own language, and record the physical setting of each class.
- Set the timeout per class, from exposure, not from a number you inherited.
- Verify unique user identification holds at each setting. If the timeout is producing shared logins, the timeout is wrong.
- Test emergency access against the setting, deliberately.
- Pair short timeouts with physical measures — privacy filters, screen orientation, and facility access controls under 164.310(a)(1).
- Walk the floor after rollout and count the workarounds.
- Document the rationale, tie it to the risk analysis, retain it six years.
- Re-examine when the environment changes, not just annually.
The goal is a setting you can explain in one sentence, that nobody on the floor is fighting. If the number came from an article and the staff have found a way around it, you have neither.
Common questions
What is the HIPAA required session timeout for an EMR?
There isn't one. 45 CFR 164.312(a)(2)(iii) requires you to implement electronic procedures that terminate an electronic session after a predetermined time of inactivity. It does not name a number of minutes. Any specific figure quoted as the HIPAA timeout, whether 10 minutes or 15, is a convention or a vendor default rather than a regulatory requirement. The rule requires you to determine the predetermined time, and to be able to explain how you determined it.
Is automatic logoff required or addressable under HIPAA?
Automatic logoff at 45 CFR 164.312(a)(2)(iii) is an addressable implementation specification. Addressable does not mean optional. Under 45 CFR 164.306(d), you must assess whether the specification is reasonable and appropriate in your environment and implement it if it is, or document why it would not be reasonable and appropriate and implement an equivalent alternative measure if one is reasonable and appropriate. By contrast, unique user identification at 164.312(a)(2)(i) and emergency access procedure at 164.312(a)(2)(ii) are both labeled Required.
Can different workstations have different timeout values?
Yes, and varying them by location is well aligned with how the rule is written. 45 CFR 164.310(b), the workstation use standard, requires policies and procedures specifying the proper functions to be performed, the manner of performance, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI. The phrase class of workstation contemplates grouping. A workstation in a locked private office and one at an open reception desk have different physical attributes of the surroundings, so a different timeout for each is a defensible outcome of the same analysis.
How do I document an automatic logoff decision?
Record what you set, for which class of workstation, and why, referencing the risk analysis that informed it. HHS states that the outcome of the risk analysis process is a critical factor in assessing whether an implementation specification or an equivalent measure is reasonable and appropriate. Under 45 CFR 164.316(b)(1), if an action, activity, or assessment is required to be documented, you maintain a written or electronic record of it, and 164.316(b)(2)(i) requires retention for six years from creation or from when it was last in effect, whichever is later. If you chose an alternative measure instead of automatic logoff, document why the specification was not reasonable and appropriate and what you implemented instead.