Written and maintained by CASRAI Editorial Board
Last updated
Healthcare information security officers, clinical laboratory directors, and research IT administrators implementing the HIPAA Security Rule (45 CFR Part 164, Subpart C) must operationalize the 3 safeguards of the HIPAA Security Rule: Administrative Safeguards (`45 CFR § 164.308`), Physical Safeguards (`45 CFR § 164.310`), and Technical Safeguards (`45 CFR § 164.312`). While technical encryption and identity management receive heavy attention, a substantial share of reportable healthcare data breaches—and multi-tiered HIPAA violation penalties—stem from physical security failures: stolen unencrypted laptops or backup drives, discarded laboratory analyzers and photocopiers containing residual electronic Protected Health Information (ePHI), and unlocked clinical workstations in high-traffic hospital corridors.
What Are the Four HIPAA Physical Safeguards Under 45 CFR § 164.310?
Codified at 45 CFR § 164.310, the HIPAA Physical Safeguards are defined in `45 CFR § 164.304` as “physical measures, policies, and procedures to protect a covered entity’s or business associate’s electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion.”
The regulation establishes four standards and eight nested implementation specifications (two standalone Required standards, two Required implementation specifications, and six Addressable implementation specifications):
| 45 CFR § 164.310 Standard | Implementation Specification & Citation | Required (R) vs. Addressable (A) | Required Engineering & Operational Controls |
|---|---|---|---|
1. Facility Access Controls§ 164.310(a)(1) |
Contingency Operations§ 164.310(a)(2)(i) |
Addressable (A) | Establish physical badge/key override and emergency escort procedures allowing authorized disaster-recovery staff physical entry into server rooms and clinical facilities while restoring lost data under an activated Emergency Mode Operation Plan. |
Facility Security Plan§ 164.310(a)(2)(ii) |
Addressable (A) | Document and maintain a written physical security plan safeguarding data centers, MDF/IDF network closets, and research core facilities from unauthorized physical access, tampering, and theft (perimeter locks, CCTV surveillance, environmental fire/flood sensors). | |
Access Control and Validation Procedures§ 164.310(a)(2)(iii) |
Addressable (A) | Enforce role-based physical access (RFID badge readers, biometric locks, PIN pads) based on job function, maintain visitor sign-in logs and escort rules, and restrict physical access to workstations used for software testing and revision. | |
Maintenance Records§ 164.310(a)(2)(iv) |
Addressable (A) | Maintain auditable logs of all physical security repairs and modifications to the facility—including door lock replacements, badge reader firmware updates, hinge/wall repairs, and HVAC/generator maintenance in server rooms. | |
2. Workstation Use§ 164.310(b) |
Standard is self-contained (no separate sub-specifications) | Required (R) | Specify in written policy the proper functions to be performed on each class of ePHI workstation, the manner in which functions are performed (e.g., automatic inactivity lockouts, prohibition of unauthorized local file downloads), and the physical attributes of the surroundings (e.g., inpatient nursing stations vs. remote home offices). |
3. Workstation Security§ 164.310(c) |
Standard is self-contained (no separate sub-specifications) | Required (R) | Implement physical protections on all workstations accessing ePHI to restrict access to authorized users—including 3M-style privacy louver filters on public-facing monitors, Kensington cable locks on laptops, locked workstation-on-wheels (WoW) carts, and positioning screens away from patient/visitor sightlines. |
4. Device and Media Controls§ 164.310(d)(1) |
Disposal§ 164.310(d)(2)(i) |
Required (R) | Implement policies and procedures to address the final disposition of ePHI and/or the hardware or electronic media on which it is stored (sanitizing or destroying hard drives, SSDs, USB drives, backup tapes, and embedded medical device memory per NIST SP 800-88). |
Media Re-use§ 164.310(d)(2)(ii) |
Required (R) | Implement procedures for removing ePHI from electronic media before the media are made available for re-use (e.g., cryptographic erase or NIST Purge before redeploying a clinician laptop, iPad, or laboratory workstation to another department). | |
Accountability§ 164.310(d)(2)(iii) |
Addressable (A) | Maintain a hardware and electronic media asset inventory and chain-of-custody log recording every person responsible for moving ePHI-bearing devices into, out of, or within the facility. | |
Data Backup and Storage§ 164.310(d)(2)(iv) |
Addressable (A) | Create a retrievable, exact copy of ePHI, when needed, before moving equipment containing ePHI (such as backing up an on-premise clinical trial database server or diagnostic imaging array prior to physical rack relocation). |
Crucial Regulatory Rule on “Addressable” Specifications (`45 CFR § 164.306(d)(3)`): Under HIPAA, Addressable never means “optional.” For every Addressable specification in `§ 164.310`, a covered entity or business associate must assess whether the specification is a reasonable and appropriate safeguard in its environment. If it is, the entity must implement it. If it is not, the entity must document in writing why it is not reasonable and appropriate and implement an equivalent alternative physical measure that achieves the statutory standard (for example, relying on inherited AWS/Azure/GCP physical data center controls documented in a cloud provider’s HITRUST CSF report when the entity has no on-premise server room).
HIPAA Workstation Security: What Counts as a “Workstation” Under 45 CFR § 164.304?
In HHS Office for Civil Rights (OCR) audits, a frequent compliance blind spot is treating “workstation” as synonymous with a fixed desktop PC. Under 45 CFR § 164.304, HHS defines a workstation broadly as “an electronic computing device, for example, a laptop or desktop computer, or any other device that performs similar functions, and electronic media stored in its immediate environment.”
In hospital and clinical research environments, `45 CFR §§ 164.310(b)` and `164.310(c)` apply to:
- Fixed nursing station PCs, examination room terminals, and mobile Workstations on Wheels (WoWs).
- Clinician and trial coordinator laptops, iPads/tablets running Epic Haiku/Canto, and shared hospital clinical smartphones.
- Laboratory Information System (LIS) and instrument-controller PCs attached to flow cytometers, mass spectrometers, DNA sequencers, and point-of-care analyzers.
- Telehealth / Remote Workstations: Home-office computers used by tele-radiologists, remote medical scribes, revenue-cycle coders, and biostatisticians accessing virtual desktop infrastructure (VDI) or cloud Electronic Data Capture (EDC) systems.
How Do HIPAA Device and Media Controls Govern ePHI Disposal? (45 CFR § 164.310(d) & NIST SP 800-88)
Under 45 CFR § 164.310(d)(2)(i) (Disposal) and § 164.310(d)(2)(ii) (Media Re-use), simply deleting files or formatting a partition does not remove ePHI. Cross-referencing HHS’s Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals, covered entities and business associates follow NIST Special Publication 800-88 Rev. 1 (Guidelines for Media Sanitization) across three technical tiers:
- Clear: Applies logical overwriting techniques across all user-addressable storage locations using standard read/write commands. Suitable only for internal device re-allocation within the same high-trust security boundary when media is not leaving organizational control.
- Purge (Standard for Media Re-Use Under § 164.310(d)(2)(ii)): Applies physical or logical techniques—such as ATA Secure Erase, NVMe Format/Sanitize commands, or Cryptographic Erase (CE) of self-encrypting drives (SEDs) where the AES-256 media encryption key is zeroized—rendering ePHI recovery infeasible even using state-of-the-art laboratory forensics.
- Destroy (Standard for End-of-Life Disposal Under § 164.310(d)(2)(i)): Physically disintegrates, pulverizes, melts, incinerates, or shreds magnetic hard drives, solid-state drives (SSDs, typically to ≤2 mm particle size for flash chips), optical discs, and backup tapes, accompanied by a signed Certificate of Destruction recording each asset’s serial number, make/model, date, and witness signature.
Embedded ePHI Traps in Clinical & Lab Equipment: Before returning leased multifunction copier/fax/scanner machines, decommissioning ultrasound/CT consoles, or excessing automated laboratory analyzers, biomedical engineering and IT asset teams must sanitize or remove internal non-volatile hard drives and flash memory modules (`45 CFR § 164.310(d)(2)(i)`).
HIPAA Physical Safeguards Audit Checklist for Clinics and Research Labs
Use this 8-point operational checklist alongside our full HIPAA compliance checklist to prepare for an internal risk analysis or OCR audit:
- [ ] Facility Security Plan & Server Room Access (`§ 164.310(a)(2)(ii)–(iii)`): Confirm all on-premise server closets, wiring panels, and research data rooms have badge/biometric access logs reviewed quarterly and rapid termination revocation.
- [ ] Visitor Escort & Physical Maintenance Logs (`§ 164.310(a)(2)(iii)–(iv)`): Verify paper or electronic visitor sign-in sheets and facility door/lock/camera maintenance logs are retained for at least 6 years (`45 CFR § 164.316(b)(2)(i)`).
- [ ] Cloud Data Center Control Inheritance Documentation: For cloud-hosted EHR/EDC workloads, retain the cloud service provider’s current SOC 2 Type 2 or HITRUST report in your compliance binder to document inherited `§ 164.310(a)` facility controls.
- [ ] Workstation Classification & Remote Work Policy (`§ 164.310(b)`): Maintain an explicit policy governing clinical workstations, lab instrument PCs, and home-office telework setups (prohibiting split-tunnel unencrypted local downloads of ePHI).
- [ ] Physical Screen Privacy & Tap-to-Lock Controls (`§ 164.310(c)`): Fit privacy filters on check-in and corridor monitors, anchor portable devices in public clinical zones, and enforce RFID badge tap-out / proximity lockouts.
- [ ] Hardware & Media Chain-of-Custody Inventory (`§ 164.310(d)(2)(iii)`): Track every laptop, tablet, external drive, and diagnostic medical device containing ePHI by serial number, custodian, encryption status, and location.
- [ ] Pre-Move Verified Backups (`§ 164.310(d)(2)(iv)`): Document verified backups before physically relocating any server or lab workstation holding unique clinical or research datasets.
- [ ] NIST SP 800-88 Certificates of Sanitization/Destruction (`§ 164.310(d)(2)(i)–(ii)`): Require serialized Purge or Destroy certificates for every retired computer, SSD, copier hard drive, and clinical analyzer before disposal or vendor lease return.
Frequently Asked Questions
What are the four HIPAA physical safeguards under 45 CFR 164.310?
The four HIPAA Physical Safeguard standards under 45 CFR § 164.310 are: (1) Facility Access Controls (§ 164.310(a)(1), covering Contingency Operations, Facility Security Plan, Access Control and Validation Procedures, and Maintenance Records); (2) Workstation Use (§ 164.310(b), Required); (3) Workstation Security (§ 164.310(c), Required); and (4) Device and Media Controls (§ 164.310(d)(1), covering Disposal, Media Re-use, Accountability, and Data Backup and Storage).
How do HIPAA device and media controls govern ePHI disposal?
Under 45 CFR § 164.310(d)(2)(i) (Disposal, Required) and § 164.310(d)(2)(ii) (Media Re-use, Required), covered entities and business associates must render ePHI unusable, unreadable, or indecipherable before disposing of or re-using any hardware or electronic media. In accordance with HHS guidance, organizations apply NIST SP 800-88 Rev. 1 Purge methods (such as cryptographic erase or firmware sanitize commands) before media re-use and physical Destroy methods (such as shredding or pulverizing drives with serialized Certificates of Destruction) for final disposal.
What are the 3 safeguards of the HIPAA Security Rule?
The three safeguard categories of the HIPAA Security Rule (45 CFR Part 164, Subpart C) are Administrative Safeguards (45 CFR § 164.308, governing risk analysis, workforce security, contingency planning, and Business Associate contracts), Physical Safeguards (45 CFR § 164.310, governing facilities, workstations, and hardware/media lifecycle), and Technical Safeguards (45 CFR § 164.312, governing logical access control, audit logs, data integrity, authentication, and transmission encryption).
