HIPAA Physical Safeguards: A Small Clinic Checklist

HIPAA’s physical safeguards standard is at 45 CFR 164.310. It governs the physical measures, policies, and procedures the clinic uses to protect electronic systems, equipment, and the facilities that house them from unauthorized physical access, tampering, and theft.

Physical safeguards apply to any location and any device through which ePHI is accessed, stored, or transmitted. That includes server rooms, exam room workstations, front-desk computers, laptops, portable devices, and the home offices of staff who access clinic systems remotely.

Facility access controls (164.310(a)(1))

The standard is required. All four implementation specifications are addressable.

Contingency operations (addressable). Procedures to allow facility access in support of disaster recovery or emergency operations. A small clinic should document who can authorize emergency access to server rooms or IT equipment and under what circumstances.

Facility security plan (addressable). Documented policies to safeguard the facility and equipment from unauthorized physical access, tampering, and theft. For most small clinics, this is a brief written policy describing key or badge access, visitor procedures, and how the clinic monitors access to its physical systems.

Access control and validation procedures (addressable). Procedures to control and validate a person’s access to facilities based on their role, including visitor control and control of access to software programs for testing and revision.

Maintenance records (addressable). Documentation of repairs and modifications to the physical components of the facility related to security, such as hardware, walls, doors, and locks.

Workstation use (164.310(b))

Required. The clinic must implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation that can access ePHI.

In plain terms, the clinic needs a written policy that says what staff are allowed to do on each workstation type, including rules about personal use, screen positioning, and use in shared spaces. This policy must extend to remote workstations. See workstation use policy for small clinics for a detailed breakdown.

Workstation security (164.310(c))

Required. Physical safeguards must be in place for all workstations that access ePHI to restrict access to authorized users only. This standard covers physical positioning (screens not visible to patients or visitors in waiting areas), cable locks for laptops, and screen privacy filters for high-traffic areas.

Device and media controls (164.310(d))

The standard is required. Implementation specifications vary.

Disposal (required). Documented policies and procedures for the final disposition of ePHI and the hardware or electronic media on which it is stored. Every clinic must have a written device disposal procedure.

Media re-use (required). Before electronic media is reused for another purpose, ePHI must be removed. This means wiping drives before reuse, not just deleting files.

Accountability (addressable). Maintain a record of the movements of hardware and electronic media and of the person responsible.

Data backup and storage (addressable). Create a retrievable, exact copy of ePHI before moving equipment that stores ePHI.

What a practical physical safeguard program looks like

For a clinic with 3–15 staff and no dedicated IT team, a defensible physical safeguard posture typically covers:

1. A written facility access policy — even a one-page document that names who can access the server closet or IT equipment room and how visitors are managed.
2. A workstation use policy that covers both office and remote workstations.
3. A device inventory with disposal and re-use procedures documented.
4. Screen privacy filters on workstations in patient-facing areas.
5. Automatic screen locks on all workstations accessing ePHI.

Physical safeguards connect directly to HIPAA technical safeguards and HIPAA administrative safeguards. The three categories work together; gaps in physical access controls often create the conditions for technical control failures.

PHIGuard maintains policy acknowledgement records and compliance task tracking for all three safeguard categories. Plans start at $99 per clinic, with a BAA at every tier. See HIPAA compliance for more.