164.310(a)(1) Facility access controls: evidence guide

What 164.310(a)(1) facility access controls asks for and why it is hard

45 CFR 164.310(a)(1) requires covered entities and business associates to maintain policies and procedures that limit physical access to their electronic information systems and to the facilities that house them, while still allowing properly authorized access. The standard is about physical reach, not logical reach: it asks who can stand next to a server, open a cabinet, or walk into a room where ePHI is stored or processed, and whether the organization can show that those rules are written down and followed. The rule sets the outcome. It does not prescribe locks, badges or cameras, so the organization must decide how to meet the outcome for its own sites and then be able to explain that decision. The risks are concrete: theft of a laptop or drive, tampering with network gear, unauthorized entry by a visitor or contractor, and a vendor technician who copies data from an unattended console. Under 45 CFR 164.304, a *facility* means the physical premises and the interior and exterior of a building or buildings, so the scope covers the parking lot camera, the loading dock, the shared hallway and the outside wall of a closet as well as the server room itself.

The standard is hard to meet for three reasons. First, ePHI sits in more places than a single data center: hospital closets, clinic back offices, colocation cages run by a third party, cloud regions reached through a provider's facilities, and remote or shared sites where staff work from home or a partner's office. Second, each site has a different owner, landlord or operator, so the organization may control the lock but not the building management system or the colocation provider's badge logs. Third, access has to remain possible for authorized staff during outages and emergencies, which pulls against tight restriction. Before choosing controls, confirm the inventory of physical locations that hold ePHI systems, the party that controls access at each one, and the contract or evidence that the other party follows the same rules. The four addressable implementation specifications that follow (contingency operations, facility security plan, access control and validation procedures, and maintenance records) each answer a part of that question.

Which facilities, systems and people fall under facility access controls

Before you write a facility access policy, decide which physical spaces, hardware and people it covers. Each decision below changes who controls the doors, who must be validated, and which evidence an assessor will ask to see for 164.310(a)(1) Facility access controls.

Owned data centers and server rooms

Where your organization owns the building or room, it controls every access point, so the full set of facility access specifications applies directly. Map each door, badge reader, key cabinet and cage that leads to a system holding ePHI, including network closets that are easy to overlook. Check that the facility security plan covers the interior and exterior of the building, since 45 CFR 164.304 defines a facility to include both. Record who approves access and how it is removed when someone leaves.

Cloud and colocation providers

When ePHI runs in a cloud region or a colocation cage, the provider operates the building, but your organization still owns its physical access policy for any space it controls, such as a leased cage, a rack, or an on-premises closet that connects to the environment. Request each provider's HIPAA terms and its physical security attestations, then confirm in writing which physical safeguards the provider performs and which remain yours. Do not assume that a provider's HIPAA terms cover every facility specification.

Workplace areas with workstations and media

Offices, clinics, reception desks, print rooms and storage closets often hold workstations, laptops or removable media that contain ePHI, even when no server is present. Include these areas in the access control and validation procedures, because a visitor or contractor walking through an unlocked workroom can reach the same data as one who enters a server room. Identify which rooms hold ePHI, which doors lock, and who holds keys or badges for each.

Third-party and contractor access

Cleaning crews, facilities staff, repair technicians, auditors and visiting vendors all need physical access at times, and each visit is a facility access event. Define how role-based access is granted for a limited window, how visitors are escorted, and how their entry and exit is logged. Maintenance records for repairs to locks, doors and walls belong with this card, since contractors often perform that work. Confirm that each contract requires the contractor to follow your access rules.

Emergency and remote access paths

Contingency operations procedures must allow authorized people into a facility during an emergency to restore data and run the emergency mode operation plan, so the access paths they use must be documented in advance. Remote access to systems is not physical facility access, but a home office, a remote workstation or a backup site creates its own physical surroundings that the workstation use and security standards address. Test the emergency entry procedure and confirm which remote paths reach ePHI.

Why the addressable label still requires a documented decision

All four implementation specifications under 164.310(a)(1) are addressable: contingency operations, facility security plan, access control and validation procedures, and maintenance records. Addressable does not mean optional. Under 45 CFR 164.306(d), the covered entity or business associate must first assess whether each specification is reasonable and appropriate for its environment. If it adopts the specification, it implements it. If it does not, it must document why and, where reasonable and appropriate, implement an equivalent alternative measure. A facility that simply skips the specification and says nothing has not met the rule, whatever the reason was internally.

Assessors reviewing this standard usually test the reasoning, not just the presence of a policy. For each specification they ask whether there is a dated assessment, who made the call, what facts drove it (for example, the building's ownership, the number of visitors, or whether the data center is shared with other tenants), and whether any alternative measure is actually running. A common finding is a blank or generic decision record: a policy that lists the four specifications without saying which were adopted, or a note that says 'not applicable' with no analysis behind it. Confirm with your assessor which format they expect, since the rule does not prescribe one.

The decision record should come out of the risk analysis required by 164.308(a)(1). Physical threats identified there, such as unescorted vendors in a server room or unlocked equipment closets, determine which specifications are reasonable and appropriate and which alternatives must be documented. Review the record whenever the facility changes, a new site or cloud region is added, or the risk analysis is updated. Illustrative example: a clinic that relocates its server closet may find that its contingency operations procedure is no longer adequate for the new building, and the record should show that change.

How an assessor tests facility access controls

This table compares how an assessor would test the facility access standard and each of its four addressable specifications, what evidence they would ask for, and where organizations usually fall short. Read each row as a test plan: the approach shows what the assessor does on site or in records, the evidence column shows what the organization should have ready, and the findings column shows where gaps tend to appear. The main takeaway is that an addressable specification still needs a documented decision, because an assessor will look for that decision first.

Test element	Assessor approach and evidence requested	Common findings
Standard overall (164.310(a)(1))	Walkthrough with the security official of how physical access to server rooms, network closets and data centers is limited to authorized people. Request the written access policy and a sample of access grants.	Policy exists but names no owners, or access to network closets is not covered at all.
Contingency operations	Ask how staff reach the facility during an emergency and whether that access is documented in the contingency plan. Review the plan and compare it with the disaster recovery and emergency mode operation plans.	Emergency access procedure is missing, or it was never tested and does not match the recovery plan.
Facility security plan	Walk the site and inspect perimeter doors, locks, cameras and alarms. Compare what is seen with the written plan and request evidence of the last review.	Plan describes controls that are not installed, or the plan has not been updated after a site change.
Access control and validation procedures	Sample visitor logs and badge or key issuance records for a set period. Check that access is tied to role, visitors are escorted, and software test environments are restricted.	Visitor logs are incomplete, badges are never revoked, or former staff keep access to restricted rooms.
Maintenance records	Request repair and modification records for doors, locks, walls and access hardware. Check a sample against work orders and confirm who approved each change.	Records are kept informally, or lock and door changes are made without any written record.
Documented decision on addressable specifications	Review the written assessment for each addressable specification, including why it was adopted, rejected or replaced with an alternative measure, and whether the reasoning is current.	No documented assessment, or a rejected specification with no equivalent measure recorded.
Evidence of testing	Ask for records showing that access controls were tested or reviewed, such as a drill, a review meeting or an inspection report, and the dates of those activities.	Controls exist on paper only, with no dated record that anyone has checked them.

Implementing facility access controls in sequence

This sequence moves an organization from knowing where its physical exposure sits to running facility access controls that protect electronic systems while letting authorized people in. Each step produces a document or record that an assessor can trace back to the standard.

Inventory every facility that houses ePHI systems
Start by listing each physical premises where electronic protected health information is created, stored, processed or transmitted, including data closets, server rooms, remote sites, colocation cages and any building where workstations or devices sit. Include the interior and exterior of each building, since the rule defines a facility as the premises and the building or buildings on them. The owner is usually the security official or facilities lead, working with the IT team that knows where systems physically live. The output is a facility inventory that maps each location to the systems and data it holds, and it becomes the scope for every later step.
Analyze existing physical security vulnerabilities
Walk each inventoried facility and test its physical protections against the threats that matter to ePHI, such as unescorted entry, tailgating, unlocked server cabinets, unmonitored loading docks, weak door hardware and exposed network ports. NIST SP 800-66 Rev. 2 lists this analysis as the first key activity for the standard. Record who performed the review, the date, and the method used, whether that is a walkthrough, badge log review or door hardware check. The output is a site vulnerability report that ranks each finding by the systems it could expose.
Identify and select corrective measures
Turn each vulnerability into a corrective measure, such as badge readers on server room doors, camera coverage of entry points, cable locks, or a visitor sign-in procedure. For each measure, record the risk it addresses, the owner, and why it is reasonable and appropriate for that facility's size and risk. Where a measure is not adopted, document the reasoning and any equivalent alternative, because each specification in this standard is addressable. The output is a corrective action register that links each finding to a decision and an owner.
Write the facility security plan
Document the policies and procedures that protect each facility and the equipment in it from unauthorized access, tampering and theft. The plan should name the physical safeguards in place, the people responsible for them, how exceptions are approved, and how the plan is reviewed after material changes such as a new site or a moved server rack. Have legal or compliance review the wording so it matches what the organization actually does. The output is an approved facility security plan with version history and a named owner.
Develop access control and validation procedures
Define who may enter each facility and each restricted area by role or function, how access is granted and revoked, and how visitors and vendors are escorted and logged. Include procedures for controlling access to software programs used for testing and revision, and for checking that a badge holder is who the badge says they are. Tie the procedure to the workforce termination and access modification steps so physical access is removed when employment ends. The output is an access authorization matrix and a visitor and vendor control procedure, both reviewed against actual badge records.
Establish contingency operations procedures
Plan how authorized staff gain access to facilities during an emergency so that lost data can be restored under the disaster recovery plan and the emergency mode operation plan can run. Confirm with the team that owns those plans which people hold emergency access, how their access is recorded, and how it is withdrawn once the emergency ends. Test the procedure at least once so the team knows whether badges, keys and vendor contacts work when the normal path is unavailable. The output is a contingency access procedure linked to the disaster recovery and emergency mode operation plans, with the results of the test.
Maintain maintenance records for physical security components
Set up a log that records repairs and modifications to security-related physical components, including doors, locks, walls, card readers, cameras and server racks. Each entry should state what changed, who performed the work, the date, and whether the change affected the facility security plan or access controls. Ask the facilities or vendor team to confirm which entries they will provide, since vendor-performed work is often the gap that surfaces during review. The output is a maintenance log template in use, with a periodic review that checks entries against the facility security plan.

Evidence that passes a facility access control review

Assessors testing 164.310(a)(1) look for records that show who was allowed into the facility, who actually went in, and whether the locks and procedures worked when tested. The cards below are the artifacts that connect those answers, and each one stays current only if a named owner reviews it on a fixed schedule and after specific trigger events.

Written facility security plan

The facility security plan is the policy document that describes how the premises, the equipment in them and the ePHI systems are protected from unauthorized physical access, tampering and theft. An assessor checks that it matches the building as it is today, not as it was at the original design. Review it at least annually, and again after any move, new suite, data room change or security incident. Name one owner, usually the security official or facilities lead, and keep a revision history that shows who approved each change.

Access authorization list by role

This list records which roles or named individuals are authorized to enter each area, such as the server room, network closet or records storage, and the reason for each grant. It is the baseline against which badge logs and visitor records are compared. Reconcile it against HR onboarding and offboarding data each month, and rerun the full review whenever a role is redefined or a new restricted area opens. Ask whether the list is kept by role or by person, since role-based lists are easier to keep accurate when staff change.

Badge and key issuance records

Issuance and revocation logs show each physical credential, the person it was issued to, the areas it opens and the date it was returned or deactivated. The most common gap is a credential that stays active after a departure or a lost card that was never reported. Require revocation to be logged on the same day as the departure, and treat a reported loss as a trigger for immediate deactivation and a new audit of that credential's access history. A quarterly sample comparing active credentials to current staff roster is a practical check.

Visitor logs and escort records

Visitor logs record each non-workforce person admitted to restricted areas, the time in and out, the host and the escort who stayed with them. Assessors sample these logs against access system events to see whether any visitor entered unescorted. Review the logs weekly for the restricted areas and treat any gap between a logged visit and a door event as an incident to investigate. Retention periods for these logs should be set in the facility security plan and confirmed with counsel.

Maintenance and repair records

Records of repairs, lock changes, door replacements and modifications to walls, doors, locks and access hardware show that security-related physical parts were kept working and changed under control. Each entry should state what was changed, who performed the work, who approved it and whether access control was tested afterward. Review the log at each facilities cycle and after any vendor visit, and require a test of the affected door or reader before the work order closes.

Contingency access procedures and test records

Contingency access procedures set out how authorized staff reach the facility during an emergency, such as a power failure, fire or failed badge system, so that data can be restored under the disaster recovery plan. The procedure is only credible if it has been exercised. Keep dated test records showing who tested emergency entry, what failed and what was corrected. Retest after any change to the badge system, after a fire or power event, and on a fixed schedule set by the security official.

What meeting facility access controls costs in money and effort

This table breaks down the cost and effort components of meeting 164.310(a)(1) Facility access controls, showing who is paid for each, whether it is one-time or recurring, what drives it up, and how to keep it down. No price or duration is stated because none is supplied, so use the rows as a checklist for an itemized quote tied to a written scope.

Cost component	One-time or recurring	What drives it	How to keep it down
Physical security hardware and access systems (badge readers, locks, cameras, alarms)	Mostly one-time purchase and installation, with recurring licensing, monitoring and replacement	Number of doors and rooms holding ePHI systems, need for audit-grade logs, and whether the building already has a system	Limit the access perimeter to server rooms and wiring closets, and reuse building systems where the landlord or provider already maintains them
Facility security plan and access policy drafting	One-time drafting, recurring review	Number of sites, complexity of tenancy, and how many staff must sign off	Reuse a single template across sites and assign one owner to keep it current
Staff time for access list reviews	Recurring	Headcount changes, role turnover, and how often access is granted outside a formal request process	Tie reviews to HR onboarding and offboarding events and export the list from the access system so reviewers do not rebuild it by hand
Visitor and escort procedures	Recurring	Foot traffic, vendor visits, and whether a sign-in and escort process is enforced in practice	Use a single sign-in method and restrict escort duties to named roles
Maintenance records for locks, doors, cameras and access hardware	Recurring	Number of vendor visits, repairs, and modifications to security-related physical parts	Ask vendors to deliver work orders in a standard format and file them in one repository
Contingency operations procedures and drills	One-time design, recurring testing	Whether emergency access depends on manual overrides, and how often the procedure is exercised	Test the procedure during scheduled recovery exercises already run for the disaster recovery plan
Site assessments and vulnerability reviews	Recurring, usually annual or after changes	Size of the premises, number of facilities, and whether the review is done internally or by an outside firm	Use the assessment to scope only the rooms and doors that hold ePHI systems, and confirm whether the landlord or colocation provider already supplies its own assessment
External review or testing of physical controls	Recurring, when commissioned	Scope of the test, whether it includes social engineering, and the qualifications of the tester	Define the rules of engagement in writing and agree the scope before testing starts
Auditor or assessor sampling time	Recurring, at each assessment	Number of facilities sampled, how well evidence is organized, and whether records are complete	Keep access lists, visitor logs and maintenance records in a form an assessor can sample quickly

Who does what: your team, an implementation partner, and the auditor

Your organization owns the control. Under 45 CFR 164.310(a)(1), the covered entity or business associate must have policies and procedures that limit physical access to its electronic information systems and the facilities that house them, while still allowing properly authorized people in. Those decisions stay with your leadership, and no vendor can take them over, because your organization remains accountable for the outcome and for any residual risk it chooses to accept.

Access decisions: Naming the roles or functions that may enter each room, rack, closet or building, and approving exceptions in writing.
Facility security plan approval: Signing off on the plan that protects the premises and the equipment in them from unauthorized access, tampering and theft.
Risk acceptance: Deciding which residual physical risks are reasonable to accept, and documenting how each addressable specification was assessed and, where needed, met by an equivalent measure.
Daily operations: Running badge administration, visitor logs, key control and escort rules, since only your staff can operate these in your buildings.
Workforce enforcement: Making sure staff and visitors follow the procedures and that breaches of them are handled under your sanctions policy.

Before any outside party starts work, check that every item above has a named owner, an approval date and a place in your records.

Where organizations fall short on facility access and how to close the gaps

Most facility access failures under 164.310(a)(1) are not missing locks. They are access decisions that were made once and never revisited, or safeguards that exist only as habit. Each card below names a gap, the closing action, and the evidence an assessor or OCR investigator would expect to see.

Access lists never reviewed after departures

Badge and key holders often outlive their job roles. The standard expects access to be limited to people who need it, so a list that still shows former staff, contractors and vendors is a direct gap. Close it by tying physical access to the same joiner, mover and leaver process used for system accounts, and by running a dated review of every holder of a server room, records room or data closet credential. Evidence: signed review records, the badge system export before and after the review, and deactivation tickets matched to HR separation dates.

Addressable decisions left undocumented

Each of the four specifications under this standard is addressable, which means the entity must assess whether it is reasonable and appropriate, and if not, document why and adopt an equivalent measure. Many organizations implement a control without recording the assessment, or skip one without explaining the choice. Close it with a short decision record per specification that states the assessment, the outcome and the owner. Evidence: dated assessment memos, risk acceptance signed by the security official, and the implementation artifact each memo points to.

Door hardware maintenance without records

Locks, door closers, card readers, cameras and the walls and doors around sensitive rooms are security-related physical parts of the facility. Repairs and replacements often happen through facilities tickets that never reach the security file, so no one can show when a lock was changed or why a reader was swapped. Close it by routing all work on security-related hardware through a logged maintenance queue that records the date, the technician, the reason and the change made. Evidence: maintenance logs, vendor service reports and a key or lock inventory with change history.

Visitor control that stops at the front desk

A sign-in sheet at the lobby does not show who reached a room containing ePHI systems. Escorts, badge loans and propped doors break the chain between the front desk and the server room. Close it by setting escort rules for each restricted area, requiring visitor badges that expire, and logging entries to restricted rooms by the card system rather than by the front desk. Evidence: visitor and escort logs covering restricted areas, badge issuance records and door access logs reviewed against them.

Contingency access that lives in one person's head

The contingency operations specification covers how staff get in during an emergency to restore data and run emergency mode operations. When the only person who knows how to reach the building after hours, or where the break-glass keys sit, is absent, recovery stalls. Close it by writing the emergency entry procedure into the contingency plan, storing break-glass credentials under dual control, and rehearsing entry with the people named in it. Evidence: the written procedure, custody logs for emergency credentials and exercise records showing who entered and when.

Landlord and colocation duties assumed, not written

When ePHI systems sit in a leased suite, a colocation cage or a shared data center, parts of the facility security plan belong to someone else, such as the landlord, the host or a building management firm. Organizations often assume those parties guard entry, log access and maintain locks without any written commitment. Close it by documenting each physical control, who performs it, and how you receive evidence, then reflecting those terms in the contract. Ask the provider for its access logs, maintenance records and visitor procedures before signing. Evidence: the executed contract or service schedule, the provider's physical security documentation and periodic access reports you request.

Common questions about facility access control costs, effort and audits

How long does facility access control work take to complete?

Duration depends mainly on how many sites and facilities hold ePHI systems, how much existing documentation you already have, and how many provider contracts need review. A single office with a documented access process moves much faster than several data rooms, leased colocation space and a mix of cloud regions. No researched timeline applies across organizations, so ask any implementation partner to break the estimate into discovery, site walkthroughs, procedure drafting, staff training and evidence collection, and to state which parts depend on your staff's availability. Ask for the schedule to be written into the agreed scope before work begins.

Can our in-house team implement facility access controls without outside help?

Yes, many covered entities and business associates do this work internally, provided someone owns the physical safeguards, has access to the facilities and can draft procedures that match how the site actually operates. The work includes a facility security plan, access validation procedures, contingency operations procedures and maintenance records. Teams that lack experience with facility security, or that run systems in third-party data centers, often bring in outside help for the site walkthroughs and the gap review. Whichever route you choose, the organization keeps ownership of the decisions and the evidence.

What does the organization need to provide during the engagement?

Expect to supply a named owner for the physical safeguards, escorted access to every facility in scope, and time from the people who open doors, manage badges, handle repairs and approve visitors. Staff interviews usually cover facility managers, IT operations, security guards and anyone who maintains locks, doors, cameras or server rooms. You should also provide existing floor plans, access logs, badge policies, vendor contracts and maintenance tickets. Confirm these inputs in writing before the engagement starts, because missing records are a common reason the work runs longer than planned.

Can a consultant certify that we comply with HIPAA facility access controls?

No. HHS states that no Security Rule standard requires an entity to certify compliance, and it does not endorse or recognize private certifications. A third-party consultant or assessor can review your facility controls, show how ready you are, and report findings against the standard, but that report is not a HIPAA certification and does not prevent OCR from later finding a violation. Ask any provider to state exactly what their deliverable is, and to confirm in writing that it does not claim certification.

Does addressable mean we can skip facility access specifications we do not need?

Addressable does not mean optional. For each of the four specifications under 164.310(a)(2), you must assess whether it is reasonable and appropriate for your environment. If it is not, you must document why and implement an equivalent alternative measure where that is reasonable and appropriate. The documented decision is the required output, so the record of your reasoning matters as much as the control itself. Ask your assessor to review both the assessment and the alternative measures, since OCR looks for that paper trail.

How do cloud and colocation providers change facility access control work?

They shift part of the physical control burden to the provider, but they do not remove your obligations. Your organization still needs documented procedures for any access it controls, such as cage keys, badge issuance, remote hands requests and visitor escorts. Review each provider contract for its physical security commitments, audit reports it can share, incident notification terms and how maintenance is logged. Business associate terms and the provider's own compliance evidence should be checked against your facility security plan. Confirm these points with each provider, since terms differ between vendors and regions.

What should we ask for in a quote for facility access control work?

Ask the provider to list the sites in scope, the four specifications covered, the deliverables for each, and the roles on both sides. Request a breakdown showing discovery and site visits, procedure drafting, evidence templates, staff training and any retesting or follow-up review. Confirm what is one-time work and what recurs, such as access reviews, maintenance log checks or annual plan updates, and whether ongoing support is priced separately. Also ask what is excluded, which assumptions the estimate depends on, and how changes to scope are handled in writing.

How DeployOpen prepares facility access controls and evidence

DeployOpen works on 164.310(a)(1) facility access controls as an implementation partner. We prepare the physical and system-side access records, procedures and evidence your organization owns, and an independent assessor decides whether they meet the standard. Each engagement starts from a written scope that defines which facilities and systems are covered.

How we scope

Agree in writing which facilities, server rooms and ePHI systems fall inside the engagement boundary.
Record the current state of physical access, including badge systems, keys, visitor logs and maintenance contracts.
Confirm which of the four addressable specifications your organization has already documented and which need work.

How we build

Draft the facility security plan and access control and validation procedures for your review and approval.
Configure badge, visitor and access logging on your own systems so that role-based access can be shown later.
Set up contingency operations procedures and maintenance record templates that match your existing change processes.

How we hand over

Deliver the policies, procedures, configuration records and sample logs as documents your staff can maintain.
Walk your security and facilities teams through each procedure and the evidence it produces.
Provide an evidence index mapping each deliverable to the 164.310(a)(1) specification it supports, for your assessor to review.

How we support

Ongoing support, upgrades and periodic review of access records are available as a retainer after handover.
Confirm with your legal or compliance lead how often access validation reviews should occur under your own policies.
Ask your independent assessor which evidence formats and sampling they expect before the engagement begins.