§170.315(d)(5) Automatic access time-out
§ 170.315 (d)(5) Automatic access time-out—
- Automatically stop user access to health information after a predetermined period of inactivity.
- Require user authentication in order to resume or regain the access that was stopped.
None
Design and performance: Quality management system (§ 170.315(g)(4)) and accessibility-centered design (§ 170.315(g)(5)) must be certified as part of the overall scope of the certificate issued to the product.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
| Version # | Description of Change | Version Date |
|---|---|---|
| 1.0 |
Initial publication |
03-11-2024
|
- Regulation Text
-
Regulation Text
§ 170.315 (d)(5) Automatic access time-out—
- Automatically stop user access to health information after a predetermined period of inactivity.
- Require user authentication in order to resume or regain the access that was stopped.
- Standard(s) Referenced
-
None
- Certification Dependencies
-
Design and performance: Quality management system (§ 170.315(g)(4)) and accessibility-centered design (§ 170.315(g)(5)) must be certified as part of the overall scope of the certificate issued to the product.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
- Revision History
-
Version # Description of Change Version Date 1.0 Initial publication
03-11-2024
Testing components
Attestation: As of September 21, 2017, the testing approach for this criterion is satisfied by attestation.
The archived version of the Test Procedure is attached below for reference.
System Under Test | ONC-ACB Verification |
|---|---|
The health IT developer will attest directly to the ONC-ACB to conformance with the §170.315(d)(5) Automatic access time-out requirements. | The ONC-ACB verifies the health IT developer attests conformance to the §170.315(d)(5) Automatic access time-out requirements. |
§ 170.315 (d)(5) Automatic access time-out—
- Automatically stop user access to health information after a predetermined period of inactivity.
- Require user authentication in order to resume or regain the access that was stopped.
None
Design and performance: Quality management system (§ 170.315(g)(4)) and accessibility-centered design (§ 170.315(g)(5)) must be certified as part of the overall scope of the certificate issued to the product.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
| Version # | Description of Change | Version Date |
|---|---|---|
| 1.0 |
Initial publication |
03-11-2024
|
- Regulation Text
-
Regulation Text
§ 170.315 (d)(5) Automatic access time-out—
- Automatically stop user access to health information after a predetermined period of inactivity.
- Require user authentication in order to resume or regain the access that was stopped.
- Standard(s) Referenced
-
None
- Certification Dependencies
-
Design and performance: Quality management system (§ 170.315(g)(4)) and accessibility-centered design (§ 170.315(g)(5)) must be certified as part of the overall scope of the certificate issued to the product.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
- Revision History
-
Version # Description of Change Version Date 1.0 Initial publication
03-11-2024
Certification Companion Guide: Automatic access time-out
This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product certification. The CCG is not a substitute for the requirements outlined in regulation and related ONC final rules. It extracts key portions of ONC final rules’ preambles and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the Certification Regulations page for links to all ONC final rules or consult other regulatory references as noted. The CCG is for public use and should not be sold or redistributed.
The below table outlines whether this criterion has additional Maintenance of Certification dependencies, update requirements and/or eligibility for standards updates via SVAP. Review the Certification Dependencies and Required Update Deadline drop-downs above if this table indicates “yes” for any field.
| Base EHR Definition | Real World Testing | Insights Condition | SVAP | Requires Updates |
|---|---|---|---|---|
| Not Included | No | No | No | No |
Applies to entire criterion
Clarifications:
- There is no standard required for this criterion.
- To meet the requirements of this criterion, health IT must terminate a user’s access and subsequently require the user to re-authenticate using the same credentials used to originally gain access. [see also 77 FR 54250]
- This criterion is not meant to result in termination of network connections when user access is stopped after a period of inactivity, especially other network connections that are not in use by the health IT product. [see also 77 FR 54250]
|
Clarifications:
|
Paragraph (d)(5)(i) Stop user access after inactivity
Technical outcome – The Health IT Module must automatically stop a user’s access to health information after inactivity for a predetermined period.
Clarifications:
- No additional clarifications.
|
Technical outcome – The Health IT Module must automatically stop a user’s access to health information after inactivity for a predetermined period. Clarifications:
|
Paragraph (d)(5)(ii) User authentication to regain access
Technical outcome – A user will need to re-enter their credentials in order to resume or regain access to the Health IT Module after access was stopped.
Clarifications:
- No additional clarifications.
|
Technical outcome – A user will need to re-enter their credentials in order to resume or regain access to the Health IT Module after access was stopped. Clarifications:
|