45 CFR 164.310 — HIPAA Security Rule: Physical Safeguards

What this rule requires your agency to do

• 1Implement physical safeguards for all workstations that access ePHI to restrict access to authorized users (§ 164.310(c)).(45 CFR 164.310 — HIPAA Security Rule: Physical Safeguards)
• 2Maintain a record of the movements of hardware and electronic media and responsible persons, and create a retrievable exact copy of ePHI before movement of equipment when needed (addressable) (§ 164.310(d)(2)(iii)-(iv)).(45 CFR 164.310 — HIPAA Security Rule: Physical Safeguards)
• 3Implement policies and procedures governing the receipt, removal, and internal movement of hardware and electronic media containing ePHI, and implement disposal and media re-use procedures (required) (§ 164.310(d)(1)-(2)(i)-(ii)).(45 CFR 164.310 — HIPAA Security Rule: Physical Safeguards)
• 4Implement a facility security plan and access control/validation procedures, including visitor control, to safeguard the facility and equipment from unauthorized access, tampering, and theft (addressable) (§ 164.310(a)(2)(ii)-(iii)).(45 CFR 164.310 — HIPAA Security Rule: Physical Safeguards)
• 5Implement policies and procedures to document security-related repairs and modifications to the physical components of a facility (addressable) (§ 164.310(a)(2)(iv)).(45 CFR 164.310 — HIPAA Security Rule: Physical Safeguards)
• 6Implement policies and procedures to limit physical access to electronic information systems and the facilities housing them, while ensuring properly authorized access is allowed (§ 164.310(a)(1)).(45 CFR 164.310 — HIPAA Security Rule: Physical Safeguards)
• 7Establish and implement as needed contingency-operations procedures allowing facility access to restore lost data under the disaster recovery and emergency mode operations plans (addressable) (§ 164.310(a)(2)(i)).(45 CFR 164.310 — HIPAA Security Rule: Physical Safeguards)
• 8Implement policies and procedures specifying proper workstation functions, the manner of performance, and the physical attributes of surroundings for workstations that access ePHI (§ 164.310(b)).(45 CFR 164.310 — HIPAA Security Rule: Physical Safeguards)