Does your application automatically lock or log-out an account after a period of inactivity?

This question is asking whether your application has an automatic timeout feature that either locks a user's session or logs them out completely after a period of inactivity. In the context of HIPAA (Health Insurance Portability and Accountability Act), this is a critical security control because it helps prevent unauthorized access to Protected Health Information (PHI) when a legitimate user leaves their workstation unattended with an active session. Without automatic timeouts, if a healthcare professional logs into your application and then walks away from their computer without logging out, anyone who has physical access to that computer could potentially view, modify, or steal sensitive patient information. The HIPAA Security Rule specifically addresses this in its technical safeguards under Access Control (45 CFR § 164.312(a)(2)(iii)), which requires implementation of 'automatic logoff' procedures to terminate electronic sessions after a predetermined time of inactivity. When answering this question, you should: 1. Clearly state whether your application has automatic timeout functionality 2. Specify the default timeout period (e.g., 15 minutes, 30 minutes) 3. Mention if the timeout period is configurable by administrators 4. Describe what happens when a timeout occurs (full logout vs. session lock requiring re-authentication) 5. Note any exceptions or special cases where timeouts might behave differently