Domain F: Physical Safeguards
Facility access controls, workstation security, and device/media disposal.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Facility security plan for any location housing ePHI systems
45 C.F.R. §164.310(a)(2)(ii) · Source: www.ecfr.gov/current/title-45/section-164.310
Facility access control and validation procedures
45 C.F.R. §164.310(a)(2)(iii) · Source: www.ecfr.gov/current/title-45/section-164.310
Contingency operations procedure for facility access during an emergency
45 C.F.R. §164.310(a)(2)(i) · Source: www.ecfr.gov/current/title-45/section-164.310
Maintenance record log for physical security repairs and modifications
45 C.F.R. §164.310(a)(2)(iv) · Source: www.ecfr.gov/current/title-45/section-164.310
Written workstation-use policy defining permitted functions and environment
45 C.F.R. §164.310(b) · Source: www.ecfr.gov/current/title-45/section-164.310
Physical workstation security controls in place (siting, screen privacy, locking)
45 C.F.R. §164.310(c) · Source: www.ecfr.gov/current/title-45/section-164.310
Device and media disposal procedure
45 C.F.R. §164.310(d)(2)(i) · Source: www.ecfr.gov/current/title-45/section-164.310
Device and media re-use (sanitization) procedure
45 C.F.R. §164.310(d)(2)(ii) · Source: www.ecfr.gov/current/title-45/section-164.310
Media movement accountability log
45 C.F.R. §164.310(d)(2)(iii) · Source: www.ecfr.gov/current/title-45/section-164.310
Data backup and storage procedure prior to equipment relocation
45 C.F.R. §164.310(d)(2)(iv) · Source: www.ecfr.gov/current/title-45/section-164.310
Physical security vulnerabilities are analyzed, with an inventory of every facility access point
45 C.F.R. §164.310(a)(2)(ii) · Source: www.ecfr.gov/current/title-45/section-164.310
Corrective measures for facility vulnerabilities are tracked to completion
45 C.F.R. §164.310(a)(2)(ii) · Source: www.ecfr.gov/current/title-45/section-164.310
Workstations and devices, including mobile, IoT and medical devices, are inventoried and classified by permitted function
45 C.F.R. §164.310(b) · Source: www.ecfr.gov/current/title-45/section-164.310
Expected performance and permitted uses are defined for each type of workstation and device
45 C.F.R. §164.310(b) · Source: www.ecfr.gov/current/title-45/section-164.310
The physical surroundings of workstations are analyzed for unauthorized viewing and access
45 C.F.R. §164.310(b) · Source: www.ecfr.gov/current/title-45/section-164.310
Every method of physical access to workstations and devices is identified and its risk analyzed
45 C.F.R. §164.310(c) · Source: www.ecfr.gov/current/title-45/section-164.310
Device encryption, screen locks, multi-factor sign-in and mobile device management are applied to workstations and devices
45 C.F.R. §164.310(c) · Source: www.ecfr.gov/current/title-45/section-164.310
Media are sanitized to NIST SP 800-88 before disposal, with the method recorded
45 C.F.R. §164.310(d)(2)(i) · Source: www.ecfr.gov/current/title-45/section-164.310
A named custodian records the receipt and removal of hardware and media, including media that leave the facility
45 C.F.R. §164.310(d)(2)(iii) · Source: www.ecfr.gov/current/title-45/section-164.310