Printer Friendly, PDF & Email Printer Friendly, PDF & Email

§170.315(d)(5) Automatic access time-out

Version 1.1 Updated on 09-21-2017
Revision History
Version # Description of Change Version Date
1.0

Final Test Procedure

01-08-2016
1.1

As of September 21, 2017, Test Procedure has been moved to Attestation/Developer self-declaration only.

09-21-2017
Regulation Text

Regulation Text

§170.315 (d)(5) Automatic access time-out

  1. Automatically stop user access to health information after a predetermined period of inactivity.
  2. Require user authentication in order to resume or regain the access that was stopped.

Standard(s) Referenced

None

Testing components

Gap Eligible
Self-Declaration: As of September 21, 2017, the testing approach for this criterion is satisfied by self-declaration.

The archived version of the Test Procedure is attached below for reference.

 

System Under Test

Test Lab Verification

The health IT developer submits their self-declaration to the ONC-ATL.

The Tester verifies the self-declaration document contains all of the required data elements.

 

 

Archived Version:
Version 1.0 Updated on 10-22-2015
Revision History
Version # Description of Change Version Date
1.0

Initial Publication

10-22-2015
Regulation Text

Regulation Text

§170.315 (d)(5) Automatic access time-out

  1. Automatically stop user access to health information after a predetermined period of inactivity.
  2. Require user authentication in order to resume or regain the access that was stopped.

Standard(s) Referenced

None

Certification Companion Guide: Automatic access time-out

This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product development. The CCG is not a substitute for the 2015 Edition final regulation. It extracts key portions of the rule’s preamble and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the 2015 Edition final rule or other included regulatory reference. The CCG is for public use and should not be sold or redistributed.
 

 

Certification Requirements

Quality management system (§ 170.315(g)(4)) and accessibility-centered design (§ 170.315(g)(5)) must be certified as part of the overall scope of the certificate issued to the product.

  • When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
  • When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively the developer must state that no accessibility-centered design was used.
Technical Explanations and Clarifications

 

Applies to entire criterion

Clarifications:

  • There is no standard required for this criterion.
  • This criterion has been renamed compared to the 2014 Edition “automatic log-off” criterion at § 170.314(d)(5). This name change does not change gap certification eligibility but is meant to more clearly convey that systems may be stateless, clientless, and/or run on any device rather than session-based. The change to “automatic access time-out” is intended to allow system architecture flexibility. [see also 80 FR 62656]
  • To meet the requirements of this criterion, health IT must terminate a user’s access and subsequently require the user to re-authenticate using the same credentials used to originally gain access. [see also 77 FR 54250]
  • This criterion is not meant to result in termination of network connections when user access is stopped after a period of inactivity, especially other network connections that are not in use by the health IT product. [see also 77 FR 54250]

Paragraph (d)(5)(i)

Technical outcome – The health IT Module must automatically stop a user’s access to health information after inactivity for a predetermined period.

Clarifications:

  • No additional clarifications available.

Paragraph (d)(5)(ii)

Technical outcome – A user will need to re-enter their credentials in order to resume or regain access to the health IT module after access was stopped.

Clarifications:

  • No additional clarifications available.

Content last reviewed on March 29, 2018
Was this page helpful?