Fact · Voice privacy and security
The HIPAA Security Rule lists automatic logoff, which ends an electronic session after a predetermined time of inactivity, as an addressable implementation specification.
Checked against its source on October 17, 2026
In the source's own words
“Automatic logoff (Addressable). Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.”
45 CFR 164.312: Technical safeguards (HIPAA Security Rule), U.S. Department of Health and Human Services (text reproduced by Cornell Legal Information Institute), 2013, § 164.312(a)(2)(iii).
Open the original- What it measures
- A dictation app left open on a shared clinic workstation is the case this safeguard addresses. Addressable specifications still need a decision that is documented, not a choice to skip them.
- What it does not show
- The rule does not set a number of minutes. The right timeout depends on the setting and on the covered entity's risk analysis.