diff --git a/consul/catalog_endpoint_test.go b/consul/catalog_endpoint_test.go
index 957922e24..4b627abc8 100644
--- a/consul/catalog_endpoint_test.go
+++ b/consul/catalog_endpoint_test.go
@@ -816,6 +816,7 @@ func testACLFilterServer(t *testing.T) (dir, token string, srv *Server, client *
 			CheckID:   "service:foo",
 			Name:      "service:foo",
 			ServiceID: "foo",
+			Status:    structs.HealthPassing,
 		},
 		WriteRequest: structs.WriteRequest{Token: "root"},
 	}
diff --git a/consul/health_endpoint.go b/consul/health_endpoint.go
index 68c8760d6..6accd3aa6 100644
--- a/consul/health_endpoint.go
+++ b/consul/health_endpoint.go
@@ -25,7 +25,7 @@ func (h *Health) ChecksInState(args *structs.ChecksInStateRequest,
 		state.QueryTables("ChecksInState"),
 		func() error {
 			reply.Index, reply.HealthChecks = state.ChecksInState(args.State)
-			return nil
+			return h.srv.filterACL(args.Token, reply)
 		})
 }
 
diff --git a/consul/health_endpoint_test.go b/consul/health_endpoint_test.go
index b690802da..49e7412d1 100644
--- a/consul/health_endpoint_test.go
+++ b/consul/health_endpoint_test.go
@@ -316,3 +316,33 @@ func TestHealth_ServiceNodes_FilterACL(t *testing.T) {
 		t.Fatalf("bad: %#v", reply.Nodes)
 	}
 }
+
+func TestHealth_ChecksInState_FilterACL(t *testing.T) {
+	dir, token, srv, client := testACLFilterServer(t)
+	defer os.RemoveAll(dir)
+	defer srv.Shutdown()
+	defer client.Close()
+
+	opt := structs.ChecksInStateRequest{
+		Datacenter:   "dc1",
+		State:        structs.HealthPassing,
+		QueryOptions: structs.QueryOptions{Token: token},
+	}
+	reply := structs.IndexedHealthChecks{}
+	if err := client.Call("Health.ChecksInState", &opt, &reply); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	found := false
+	for _, chk := range reply.HealthChecks {
+		switch chk.ServiceName {
+		case "foo":
+			found = true
+		case "bar":
+			t.Fatalf("bad service 'bar': %#v", reply.HealthChecks)
+		}
+	}
+	if !found {
+		t.Fatalf("missing service 'foo': %#v", reply.HealthChecks)
+	}
+}