Here's a scenario:
- An intranet CPOE application
- User runs a report, which downloads as a PDF and opens in Acrobat on the local PC
- User leaves the PC without logging out or closing Acrobat
- CPOE times out and auto-logs the user out
- The PDF with sensitive data stays open. It is also stored in the browser cache/download folder
Now, is this a HIPAA issue? Is there anything a CPOE vendor can do? There are other things like clipboard, screenshots, etc., all resulting in a similar issue.