Is downloading a PDF from a browser-based app locally a HIPAA issue? [migrated]

Question

Here's a scenario:

1. An intranet CPOE application
2. User runs a report, which downloads as a PDF and opens in Acrobat on the local PC
3. User leaves the PC without logging out or closing Acrobat
4. CPOE times out and auto-logs the user out
5. The PDF with sensitive data stays open. It is also stored in the browser cache/download folder

Now, is this a HIPAA issue? Is there anything a CPOE vendor can do? There are other things like clipboard, screenshots, etc., all resulting in a similar issue.