This is an excerpt from a member-only article. To read the article in its entirety, please login or subscribe.

Critics of auto-lockouts--network policies that lock users out of the system after a certain number of unsuccessful log-on attempts--say they're a waste of time and money and don't add any value or security to a hospital's electronic health records system. Besides, these critics argue, there are other tools, such as stronger passwords and audit logs, that work just as well. But security experts agree that auto-lockouts should be a part of your overall information security plan. The trick is to understand their benefits and drawbacks and how to use them in conjunction with other tools and techniques.