§ 164.312(a)(2)(iii) · HIPAA SCREEN LOCK REQUIREMENTS

HIPAA Screen Lock Requirements:
What Healthcare IT Must Implement

§164.312 mandates automatic logoff and workstation session controls — but a standard screen timeout only satisfies part of the requirement. PHI visual protection means detecting threats before a screen is left unattended.

SEE HOW IT WORKS READ THE REQUIREMENTS

The Regulation

What HIPAA Screen Lock Requirements Actually Say

Three provisions together define what HIPAA compliant screen security looks like. Each has distinct enforcement risk.

§ 164.312(a)(2)(iii)

Automatic Logoff

"Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity." This is the core screen lock requirement — and in 2026 it loses its "addressable" opt-out.

§ 164.310(b)

Workstation Use

Physical safeguards must specify the physical surroundings of each workstation. OCR expects you to control who can see the screen — not just who can log in.

§ 164.312(b)

Audit Controls

"Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI." Screen events must be logged to survive an OCR investigation.

The Gap

Why a Screen Timeout Is Not HIPAA Compliant Screen Security

A screen timeout only responds after inactivity. HIPAA requires you to prevent unauthorized viewing — which can happen in seconds, with the authorized user still present.

Threat

Screen Timeout Response

HIPAA Gap

✕ Visitor looks at screen

None — timeout only triggers on inactivity

PHI viewed, no log entry

✕ Colleague photographs screen

None — session still active with authorized user

PHI captured, no detection

✕ User steps away for 30 sec

Timeout fires after 2–5 minutes (if configured)

Minutes of exposed PHI unlogged

✓ ScreenStop

Computer vision detects each threat type the moment it occurs — locks screen and logs the event automatically

Audit log entry per incident

PHI Visual Protection

The Four Threats Screen Lock Alone Cannot Stop

PHI visual protection means covering all four vectors — not just the unattended screen case.

Unattended Workstation

Authorized user leaves — ScreenStop detects absence and locks within seconds, logging departure time and session context.

Shoulder Surfing

Unauthorized face detected near screen — session terminates immediately. Works while the authorized user is still seated.

Phone Camera Capture

Phone aimed at screen triggers instant display blackout and USB disable — before any image can be captured or transmitted.

Continuous Identity

Confirms the right person remains at the workstation throughout the session. Catches credential sharing and unauthorized access switching.

Implementation Checklist

HIPAA Compliant Screen Security Checklist

What OCR expects to see documented in your next audit.

✓

Automatic session termination configured

§164.312(a)(2)(iii) — timeout period documented and enforced on all ePHI workstations

✓

Physical surroundings policy in place

§164.310(b) — documented control of who can view each workstation, including remote/home office positions

✓

Audit log for every screen security event

§164.312(b) — timestamped record of all lockouts, detections, and unauthorized access attempts

✗

Screen timeout alone

Does not satisfy §164.310(b) — no detection of shoulder surfing, camera capture, or active unauthorized viewing

✗

Privacy filters only

Passive physical control — generates no audit log and does not respond to threats automatically

Satisfy all three provisions in one deployment

HIPAA Compliant Screen Security — Active, Not Passive

ScreenStop runs on-device, requires no cloud connection, works with existing webcams, and generates the audit log OCR expects to find. Deployment takes hours, not months.

REQUEST DEMO compliance@screenstop.co