The four physical safeguard standards in 45 CFR 164.310 and their implementation specifications: facility access, workstation use and security, and device and media controls including disposal and re-use.
The physical standard for limiting access to information systems and the buildings that house them while letting authorized people in. Parent of four addressable specifications: contingency operations, facility security plan, access validation and maintenance records.
Addressable procedures that allow facility access during an emergency to support restoring lost data under the disaster recovery plan and running the emergency mode operation plan.
Addressable policies and procedures to protect the facility and the equipment in it from unauthorized physical access, tampering and theft.
Addressable procedures to control and validate physical access to facilities by role or function, including visitor control and control of access to software programs for testing and revision.
Addressable documentation of repairs and modifications to security-related physical parts of a facility, such as hardware, walls, doors and locks.
The standard for policies that define the proper functions, manner of use and physical surroundings of each workstation or class of workstation that can access ePHI, including laptops and remote setups.
The standard requiring physical safeguards on every workstation that accesses ePHI so only authorized users can reach it. Where workstation use sets the rules, this standard sets the physical protections.
The standard governing how hardware and electronic media holding ePHI come into, leave and move within a facility. Parent of two required specifications (disposal, media re-use) and two addressable ones (accountability, data backup and storage).
The required policies and procedures for the final disposition of ePHI and the hardware or media it is stored on, and the sanitization methods HHS points to.
The required procedures for removing ePHI from electronic media before the media are reused, inside or outside the organization.
Addressable record of the movements of hardware and electronic media and the person responsible for each, the device-tracking side of asset management.
Addressable step of making a retrievable exact copy of ePHI, when needed, before equipment is moved. Narrower than the required data backup plan in 164.308(a)(7).
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.