By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: AUP (Acceptable Use Policy)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
An acceptable use policy (AUP) is an organization’s written guidance on how employees and other workforce members may use its information technology resources and data. The HIMSS Dictionary describes it as guidance on appropriate use. In a health system it usually applies to physicians, nurses, students, volunteers, contractors, and vendors who receive an account, a badge, or a device.
A typical AUP covers use of workstations and mobile devices, email and messaging, internet access, personal devices, removable media, passwords and multifactor authentication, remote access, handling of patient information, social media, monitoring and privacy expectations, reporting of incidents, and consequences for violations. Staff are generally asked to read the policy and acknowledge it before access is granted.
| Document | Purpose | Example |
|---|---|---|
| Acceptable Use Policy | Defines allowed and prohibited use by the workforce | No sharing of credentials; no PHI on personal email |
| Security Policy | Sets the organization’s overall security requirements | Access control, encryption, incident response |
| Privacy Policy | Sets rules for handling patient information | Minimum necessary, patient access rights |
| Social Media Policy | Guides online communication | What may be posted about work |
| Sanction Policy | Describes consequences for violations | Progressive discipline |
| Business Associate Agreement | Binds outside vendors handling PHI | Vendor safeguards and breach reporting |
⚠️ Exam Alert: An AUP applies to the workforce and tells them what they may and may not do with IT resources and data. It is not a substitute for the security policy or the HIPAA sanction policy, though it often references them. NIST uses the term rules of behavior for the same idea.
🌐 Why It Matters: Real-World Healthcare IT Context
Technology rules fail when people do not know them or cannot follow them. The AUP puts expectations in writing, gives managers something concrete to point to, and provides a basis for training and for discipline when needed.
The HIPAA Security Rule does not use the phrase acceptable use policy, but several of its requirements point directly at it. Covered entities and business associates must apply appropriate sanctions against workforce members who fail to comply with security policies and procedures. They must implement a security awareness and training program for all workforce members, including management, with attention to periodic security reminders, protection from malicious software, log-in monitoring, and password management. The physical safeguards require policies and procedures specifying proper functions, the manner of performing them, and the physical surroundings of workstations that can access electronic protected health information, along with workstation security to restrict access to authorized users. An AUP is the most common place these expectations come together in plain language.
NIST describes the same concept in its control catalog. In SP 800-53 Revision 5, the rules of behavior control calls on organizations to establish and provide to individuals requiring access the rules that describe their responsibilities and expected behavior for system usage, security, and privacy; to receive documented acknowledgment that they have read, understand, and agree to abide by the rules before access is authorized; to review and update the rules; and to require re-acknowledgment when the rules change. A related enhancement covers social media and external site or application usage restrictions. That pattern of provide, acknowledge, review, and re-acknowledge is a good template for any AUP program.
Health care adds special pressures. Clinicians share workstations, move between units, use mobile devices at the bedside, and work under time pressure. A rule that ignores this reality, such as an automatic logout interval that interrupts care or a ban on any messaging tool without an approved alternative, invites workarounds. The best AUPs reflect clinical workflows and offer approved options for common needs.
Social media deserves special attention. The National Council of State Boards of Nursing publishes a guide for nurses on social media, noting that posted content can be discoverable in court even when deleted, that nurses are welcome to use social media in their personal lives but must not identify patients or share details that could identify them, and that organizational policies often cover use on employer equipment but typically do not address personal use outside work. That last gap is where nurses can face serious consequences, because the professional duty of confidentiality still applies. An AUP that explains this plainly protects both patients and staff.
Monitoring and privacy expectations should be stated clearly. Organizations log and review system activity, including access to patient records, so staff should know that their use may be monitored and that accessing records without a job-related reason is a violation even if the person means no harm.
Common AUP problems:
- A long legal document that no one reads
- Click-through acknowledgment with no training
- Rules that conflict with real clinical workflow
- No guidance on personal devices or messaging apps
- Unclear consequences, or inconsistent enforcement
- No re-acknowledgment when the policy changes
What supports an effective AUP:
- Plain language with clinical examples
- Acknowledgment before access and again after major changes
- Approved tools for common needs so staff do not improvise
- Training that explains why each rule exists
- Consistent, documented enforcement
- Regular review with input from clinical staff and legal counsel
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
For nurses, the AUP shapes everyday decisions about screens, devices, messages, and posts.
At the Bedside
Logging out or locking a workstation before stepping away, never sharing a password, and keeping screens out of view of visitors are small habits that the AUP and HIPAA workstation rules reinforce. Taking photos of patients or screens on a personal phone, texting orders or results through unapproved apps, and looking up records of family or coworkers are common violations, even when intentions are good.
In Clinical Workflow
Nurse managers support the AUP by modeling it, answering staff questions, and reporting problems. When an approved tool is missing, they raise the need rather than allowing workarounds to become routine. After a privacy incident, they work with compliance on corrective action that is consistent and fair.
Nurse informaticists help make policy practical. They review whether lockout settings, single sign-on, and approved messaging tools fit the pace of care, and they translate policy language into short job aids for units.
Outside work, the NCSBN guidance applies. A post that never names a patient can still reveal identifying details, and venting online about a shift can breach confidentiality or professional standards.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, many people receive access at once, including trainers, students, and visiting support staff. Acknowledging the AUP is part of that access process. At-the-elbow support analysts remind staff to use their own credentials, never to share badges or logins to save time, and to report anything suspicious through the proper channel.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
The AUP appears in security governance, privacy, and workforce management questions:
| CAHIMS Domain | How the AUP Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA Security Rule, professional standards for confidentiality |
| Clinical Informatics | Clinical workflow impact of controls, mobile and messaging use |
| Healthcare Information & Systems Management | Access, devices, monitoring, incident reporting |
| Management & Leadership | Policy governance, training, enforcement, sanctions |
Key Terms to Know Alongside the AUP
- Rules of Behavior — NIST term for expectations on system use, acknowledged before access
- Sanction Policy — documented consequences for workforce violations
- Security Awareness Training — program that teaches workforce members security responsibilities
- Workstation Use — HIPAA physical safeguard on proper use of workstations
- BYOD (Bring Your Own Device) — use of personal devices for work
- Acknowledgment — documented confirmation that a person has read and agreed to a policy
HIMSS Organizational Position
HIMSS supports healthcare cybersecurity and workforce education through its Healthcare Cybersecurity Community, research, and professional development programs. Members can find related resources through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (Rules of Behavior) https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
- eCFR — 45 CFR 164.308, Administrative Safeguards (Sanction Policy and Security Awareness and Training) https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
- eCFR — 45 CFR 164.310, Physical Safeguards (Workstation Use and Workstation Security) https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.310
- NCSBN — A Nurse’s Guide to the Use of Social Media https://www.ncsbn.org/public-files/NCSBN_SocialMedia.pdf
- HHS — The HIPAA Security Rule https://www.hhs.gov/hipaa/for-professionals/security/index.html
- HHS 405(d) — Health Industry Cybersecurity Practices https://405d.hhs.gov/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply