164.310(a)(2)(iv) Maintenance records: requirements and evidence

What 164.310(a)(2)(iv) maintenance records require of your facility

An auditor asks how a broken door closer, a re-keyed lock or a patched wall near a server room was documented, and who approved the work. Section 164.310(a)(2)(iv) asks for policies and procedures that record repairs and modifications to the physical components of a facility that relate to security, such as hardware, walls, doors and locks. The point is simple: if someone changed how a room holding ePHI systems can be entered, you should be able to show when it changed, what was done and who did it. Without that trail, it is hard to show that physical access controls under 164.310(a)(1) still work after the building has been touched.

This specification is addressable, not optional in the abstract. Under 45 CFR 164.306(d)(3), you must first assess whether it is reasonable and appropriate for your facility. If it is, you implement it. If it is not, you document why and adopt an equivalent alternative measure that is reasonable and appropriate. In practice, few facilities with server rooms or ePHI storage can argue that lock and door repairs need no record at all. Keep the assessment itself in writing, because an auditor will ask for it. Also note that HHS does not certify compliance with the Security Rule, so no third party can hand you a badge for this specification. An independent assessor can only test your records against your own documented decisions.

The hard part is usually location, not paperwork. Maintenance is performed by landlords, building management, locksmiths, alarm vendors and facilities contractors, and their tickets often sit in systems you never see. Start by listing every security-relevant component in each location that touches ePHI, then confirm which party performs work on each one and how that party reports it to you. Ask vendors to state, in their service terms, what records they will send after each visit. Confirm with your landlord whether lock and door work is logged centrally. A single ticketing system with a record per repair, linked to the affected asset, is the simplest way to keep the trail consistent across sites.

Which facility components and vendors fall under maintenance records

Maintenance records only help if the scope is drawn correctly. The cards below cover which facilities and physical components count as security-related under 164.310(a)(2)(iv), and which third parties perform work that must be logged, so the record set matches what an assessor will sample.

Facilities that house ePHI systems

Start with every location where ePHI is stored, processed or transmitted: data centers, server closets, clinic back offices, records rooms and any space holding backup media. Include sites you do not own, because the repair history of a leased suite still bears on the safeguards you claim. Confirm the list against your asset inventory and your facility security plan, so no room with ePHI equipment is left out of scope.

Doors, locks and badge readers

Doors, locking hardware, electronic strikes, keypads and badge readers control who reaches ePHI systems, so repairs and reprogramming to them are the core entries in this record. Log each repair, adjustment, lock change and access credential change with the date, the technician and the reason. Check that the record shows when a failed lock was replaced and whether access was reviewed afterward.

Walls, ceilings and raised floors

Physical barriers around a server room count when they resist unauthorized entry, such as a wall opened for cabling or a drop ceiling penetrated to reach the room. Modifications to these structures can silently weaken the protection a room was designed to give. Record structural changes that affect the perimeter of an ePHI space, and note when a contractor opened or closed a barrier, even for an unrelated project.

Cameras, alarms and environmental controls

Surveillance cameras, intrusion alarms, and the power and cooling systems that keep server hardware running are security-related because outages and tampering both affect ePHI availability and access monitoring. Document repairs, firmware changes, camera relocations and alarm rewiring. Confirm with your own environment which of these support physical access monitoring and which only support facility operations, and document the first group more carefully.

Server room hardware and racks

Racks, cabinets, locked enclosures and the servers, storage arrays and network equipment inside them are the components most directly tied to ePHI. Repairs that involve opening a chassis, replacing a drive or moving equipment between racks should appear in the maintenance record and be cross-checked with device movement records under 164.310(d). This is where the physical and asset records must agree.

Landlords, contractors and facilities vendors

Building owners, general contractors, locksmiths, HVAC and electrical vendors and managed facilities companies often perform the work that falls under this specification, even when your staff never touch the equipment. Require them to report work on security-related components to you in writing, and keep their invoices, work orders and sign-in logs with your records. Ask each vendor whether it will be bound by your confidentiality and access rules, and whether its staff will be escorted.

How an assessor tests maintenance records

This table compares each step an assessor takes when testing 164.310(a)(2)(iv) maintenance records against the evidence that satisfies it and the findings that commonly appear. Read it as a checklist for preparing the written policy, the repair log and the staff interviews before an assessment begins.

Test step	What the assessor does	Evidence to have ready	Common finding
Request the written policy	Confirms a documented policy and procedure exists for recording repairs and modifications to security-related physical components	Policy naming the facility components in scope, such as doors, locks, walls and access hardware, with owner and review date	No written policy, or a policy that covers IT equipment only and ignores physical security components
Define the population	Asks for every repair or modification to in-scope components over the review period and checks the list is complete	Facility work order log, vendor invoices and building change requests for the period	Log is incomplete because repairs were handled by phone or by a landlord and never entered
Sample events against work orders	Selects a sample of events and traces each to a work order showing what was changed, when and why	Work order with description, date, technician or vendor name and the component affected	Work orders exist but do not describe the security-relevant change or name the component
Check dates and approvals	Compares repair dates to approval dates and confirms a responsible person signed off before or after the work	Approval record, sign-off by facilities or security owner, and completion date	Missing approvals, or completion recorded without any approval for a lock or door change
Compare to access control changes	Matches door, lock and key changes against access control records to confirm access changes were recorded	Key or badge issuance logs, lock rekeying records and access list updates tied to the same event	Locks were replaced or rekeyed but no access list change or key log entry exists
Review undocumented landlord work	Asks whether building owners or third parties made changes to walls, doors or locks and whether the covered entity has records of them	Lease terms on maintenance responsibility, landlord notices and the covered entity's copy of any landlord work records	Landlord replaced locks or altered a server room wall with no record on the covered entity's side
Verify the addressable decision	Checks for a documented assessment of whether the specification is reasonable and appropriate, and any equivalent alternative measure	Signed decision memo explaining the assessment and, if not implemented, the alternative measure in use	No documented decision on whether this addressable specification applies to the facility
Interview facilities staff	Asks staff how changes are requested, recorded and reported to security and whether they know the policy	Staff can describe the workflow and point to where records are kept, consistent with the written policy	Staff describe informal practices that do not match the policy or the records produced

Implementing maintenance records in sequence

This sequence turns the addressable maintenance records specification into a working process: it identifies what is security-related, documents the decision to implement it, defines what gets logged, assigns owners and checks the records on a set cadence. Each step ends with an artifact an assessor can inspect.

Inventory security-related physical components
Start by listing the physical parts of each facility that protect systems holding ePHI, such as server room walls, doors, locks, badge readers, cabinets, cameras and network closets. Facilities or security staff usually compile this list, and the IT or compliance lead confirms that it matches the systems in the risk analysis. The step is complete when every component has an owner, a location and a link to the systems it protects.
Decide whether the specification is reasonable and appropriate
Because maintenance records are addressable, assess whether keeping them is reasonable and appropriate for your environment, using the inventory and your risk analysis. If you implement it, record that decision and the reasoning in your policy set. If you do not, document why and identify an equivalent alternative measure that is reasonable and appropriate. The output is a signed decision record that the security official or compliance lead can produce on request.
Define what counts as a repair or modification
Write a short definition of the events that must be logged, such as lock replacements, door hardware changes, camera or badge reader repairs, wall penetrations that affect a secured room, and changes to racks or cages holding ePHI systems. Include routine work that does not touch security, so staff know where the line sits. The output is a one-page definition approved by facilities and the security function, with examples drawn from your own facility.
Set up a logging workflow with named owners
Create a single place to record each event, such as a ticket queue in a self-hosted service desk tool, and set required fields: date, component, description of work, who performed it, who approved it, and verification that the security function was notified. Assign a named owner for each facility area and a backup. Open-source ticketing platforms such as GLPI, which offers ITIL-style tickets and changes, or Zammad, a ticketing system, can hold these records if configured to your workflow. Confirm the capabilities you need with the vendor before choosing. The output is a working queue with a test entry and documented owners.
Train staff and contractors on the workflow
Anyone who services a secured area, including building management, locksmiths, cabling contractors and facility vendors, needs to know that the event must be logged and what information to provide. Include a clause in contractor agreements that requires them to supply repair details for logging. Keep attendance records and the version of the procedure each person received. The output is a completed training roster and signed acknowledgments for internal and external staff.
Log events as they happen and link evidence
Each repair or modification should be recorded when it occurs, with the work order, invoice, photos or access-change confirmation attached. Link the record to the component in the inventory and, where relevant, to the change ticket or the system it affects. Gaps usually appear when work is done by a third party and no one files the record, so reconcile contractor invoices against the log each month. The output is a complete, searchable history for each component.
Review records on a set cadence
Choose a review cadence that suits the risk and the pace of change in your facilities, and document it in the procedure. At each review, check that logged events match the inventory, that approvals are present, that unresolved items have owners, and that the decision from the reasonable and appropriate assessment still holds. Record the review date, reviewer and findings. Confirm with your compliance or assessment advisors how often they expect this review to occur. The output is a dated review log that shows the process operates in practice.

Evidence that satisfies maintenance records

Maintenance records under 164.310(a)(2)(iv) are only as strong as the trail behind them. The cards below cover the artifacts an assessor typically asks for and the routine that keeps them accurate between reviews, so the record shows what was done, by whom and why.

Written maintenance policy and procedure

The policy states which physical components count as security-related, such as server room doors, badge readers, locks, cameras, cabinets and perimeter hardware, and who may authorize work on them. It also sets the required fields for every entry. Check that the policy names an owner, a review date and the link between maintenance and the facility security plan under 164.310(a)(2)(ii). An undated or generic policy is the first thing an assessor questions.

Asset list of security-related components

Maintain a register of every physical component in scope, with location, make, model, serial number, installation date and responsible owner. Without this list, no one can prove that a repair was complete or that a component was missed. Reconcile the list against walkthroughs of each facility at least as often as your risk analysis is refreshed, and record each change as it happens.

Dated work orders with technician and changes

Each repair or modification needs a work order that records the date, the requesting person, the technician or vendor, the component affected and the specific change made, such as a replaced strike plate or reprogrammed access panel. Note the before and after state and any temporary bypass removed afterward. Vague entries like "door fixed" give an assessor nothing to test. Ticketing tools such as GLPI's Assistance module can hold this workflow, but confirm the fields you need are configured before you rely on them.

Approvals before and after work

Record who approved each change before work began and who verified it afterward. Separation between the requester, the approver and the person who confirms completion reduces the chance that an unauthorized change to a locked room or badge system goes unnoticed. Keep approval timestamps in the same record as the work order, not in a separate inbox. Ask whether your security official or facility owner signs off on changes to access control hardware.

Vendor service reports and invoices

When an outside contractor services locks, access panels, cameras or cabinets, retain the service report, the parts list and the visit record. These documents corroborate internal entries and show what the vendor actually touched. Confirm that the vendor agreement requires written reports, and store them alongside internal work orders. Missing vendor paperwork is a common gap when a facility changes its maintenance provider.

Scheduled reviews between audits

Records go stale unless someone checks them on a fixed schedule. Set a recurring review that compares open and closed work orders against the asset list, flags components with no service history, and confirms that approvals were recorded. Document each review with its date, reviewer and findings. Ask your auditor or consultant which review cadence they consider reasonable for your facility profile, since the rule itself does not set one.

What meeting maintenance records costs in money and effort

This table breaks down the cost components of keeping repair and modification records for security-related physical parts of a facility. It shows who is paid for each component, whether it is one-time or recurring, and what drives it up or down. No figures are given because none were supplied, so use the quote questions to get numbers from your own environment.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it
Scoping which physical components count	Internal security or facilities lead, sometimes with an outside HIPAA consultant	One-time, revisited when the facility changes	Number of buildings, server rooms, doors, locks and access points that relate to ePHI systems
Staff time to run the record log	Facilities, IT operations and security staff who open and close entries	Recurring	Frequency of repairs and modifications, and whether staff record work at the time it happens
Ticketing tool and its administration	Software vendor if commercial, or internal staff and any support contractor if self-hosted	Recurring (licenses or hosting), plus one-time setup	Number of users, retention needs and integration with asset records
Vendor and contractor coordination	Internal coordinator, plus the repair vendor's time to supply work details	Recurring, per job	Number of outside vendors, whether contracts require written work summaries, and response time for paperwork
Landlord or lease terms for work records	Facilities or legal staff, and sometimes the landlord's property manager	One-time review, occasional follow-up	Whether the lease assigns building repairs to the landlord and how records are shared with the tenant
Evidence collection for audits	Compliance lead, with system owners pulling records for the assessor	Recurring around each assessment cycle	Sample size the assessor selects, how many records are missing, and how easily records can be exported
Remediation of gaps found in review	Internal staff, with an implementation partner if engaged	One-time per gap, plus process changes	Number of undocumented changes found and whether a documented alternative measure is needed

Who owns maintenance records, who can help, and what the auditor checks

Your organization owns the maintenance records. The Security Rule places the duty on the covered entity or business associate to write policies and procedures that document repairs and modifications to security-related physical components, such as hardware, walls, doors and locks. Facilities staff, the security official and the owners of any data center or office space where ePHI systems sit decide what counts as security-related, who approves work, and how long records are kept. Those decisions cannot be handed to a contractor.

Policy ownership: Define which components are in scope, such as badge readers, server room doors, locks, cabinets and cameras, and who must log work on each.
Approval of work: Require a documented request, a named approver and a reason for every modification that touches a security-related component.
Record content: Capture the date, the work performed, the people involved (including vendors and their escorts), and any change to access rights.
Retention and review: Set a retention period that matches your documentation policy and a periodic review in which the security official checks for gaps.
Addressable decision: If you decide this specification is not reasonable and appropriate for a component, document that reasoning and the alternative measure.

Confirm that your facilities and security leads can name the owner of every record type before any outside party is engaged.

How a repair ticket becomes audit evidence

The maintenance record is only as good as the trail behind it, so the useful question is how a repair request turns into something an assessor can sample. A workable flow has four stages: intake, approval, work and closure. Each stage should write a timestamped entry that names who acted, what was touched and what changed. A request for a badge reader repair on a server room door, for example, should be logged with the requester, the affected component, the reason, the vendor or technician, the approver and the date the lock was returned to service. If any of those fields lives only in an email thread or a clipboard, the record is weak. The open-source options that can hold this history are ticketing systems rather than facility management software. GLPI's Assistance module lets users create, follow and process tickets, problems and changes following ITIL practices, and its change records can carry the approval step before work starts. Zammad is a web-based helpdesk that gathers requests from email, chat and telephone into one ticket system with a full history of replies and status changes. Either tool can keep an audit trail of who did what and when. Neither was built around door hardware, HVAC or fire-suppression work orders, so confirm with the vendor whether asset linkage, attachments such as invoices and vendor sign-off, and retention settings meet the facility's needs before committing to one.

Closure is the stage most organizations skip, and it is the one that makes the record usable. A closed ticket should state what was repaired or modified, whether the change affected a security-related component such as a lock, door, camera or access panel, the person who verified the fix and the date it was checked. Those entries should link to the physical asset record so an assessor can start from a door or device and follow it back to its repairs. Set a rule that no security-relevant ticket closes without verification, and review a sample of closed tickets against the facility access logs and the facility security plan on a regular schedule. The HHS Security Rule places the documentation duty on the entity, so the retention period, access permissions on the ticket system and export procedure should be written into the policies and procedures under 164.316, not left to the tool's defaults.

Where maintenance records usually fall short

Maintenance records under 164.310(a)(2)(iv) are easy to describe and hard to keep complete. The gaps below tend to appear where work is done by someone outside the security team, where the building is not owned by the covered entity, and where a decision to skip a step is never written down.

Vendor work with no record

An HVAC contractor, locksmith or door installer works on a server room or secured corridor, and nobody logs the visit, the scope or the parts changed. The rule asks for documentation of repairs and modifications that relate to security, so a verbal handoff does not count. Check that every vendor visit to a secured area produces a ticket before the technician leaves, with the work performed, the person who approved it and the date.

Records held only by the landlord

When a leased suite is maintained by the building owner, the lock, door frame and wall changes may be recorded only in the landlord's systems. The covered entity still needs records it can produce during an OCR review. Write the lease or access agreement so the landlord shares maintenance history for security-related components, and keep a copy in your own records.

Door and lock changes not linked to access lists

A rekeyed door or replaced badge reader changes who can get in, but the maintenance log and the access validation list are often kept in separate places. An assessor testing facility access will ask whether the two agree. Link each lock or reader change to a dated update of the access list and confirm that the same person signed off on both.

Addressable decisions never documented

Maintenance records is an addressable specification. If the organization decides a log is not reasonable and appropriate for a particular component, 45 CFR 164.306(d) requires a written reason and an equivalent alternative measure where reasonable. Many organizations skip that step entirely. Record the assessment, the reason for any decision not to log, and the alternative measure in the same file as the maintenance procedure.

Ticket history that cannot be retrieved

Records scattered across email threads, spreadsheets and paper sign-in sheets are hard to produce on request. A helpdesk or ITSM tool with a dedicated category for physical and facility work keeps the history in one searchable place. Open-source options such as GLPI include change and problem handling that can hold these records. Confirm the tool can export the full history of a single door or room before you rely on it.

Questions buyers ask about maintenance records

Is maintenance record keeping required under HIPAA or can we skip it?

Maintenance records are an addressable specification, so you cannot simply ignore it. You must assess whether documenting repairs and modifications to security-related physical components is reasonable and appropriate for your facility. If you decide it is not, you must document why and implement an equivalent alternative measure that is reasonable and appropriate. In practice, most organizations find that a written log of repairs to doors, locks, badge readers and server room hardware is a low-effort way to meet the intent. The decision and its rationale belong in your documentation, and the organization, not a consultant, owns that determination. Confirm the exact wording of the requirement against the eCFR text of 164.310(2)(iv)).

How much does it cost to set up maintenance record tracking?

No cost figure for this specification has been researched, so treat any number you see as unverified. The cost has three parts: staff time to define the procedure and log format, the tooling used to record work orders, and the time spent keeping entries current. Setup is largely one-time, while the logging effort recurs with every repair or modification. Costs go up when facilities are large, when many vendors touch physical systems, or when records live in disconnected spreadsheets. They go down when an existing ticketing system already tracks facilities work. When requesting a quote from an implementation partner, ask for the scope in writing: which facilities, which asset classes, which tooling, and who owns the ongoing log.

How long does it take to put maintenance records in place?

No duration has been researched for this work, so confirm timing against your own environment rather than relying on a general estimate. The timeline depends on how many facilities and physical security components are in scope, whether a procedure already exists, and how quickly facilities and vendor teams can adopt a new logging step. A realistic plan starts with a short inventory of security-related physical components, then drafts the procedure, selects where entries are recorded, and trains the people who perform repairs. Ask any implementation partner to break the schedule into dated milestones in the written scope before work starts.

What does the organization need to supply for this work?

The organization must supply the facts that only it knows. These include an inventory of security-related physical components, such as doors, locks, badge systems, cameras, server room racks and workstation enclosures, along with the people and vendors who service them. You also need the policy owner, the approval path for repairs and modifications, and access to existing facilities tickets or work orders. Your compliance lead should confirm how long records are kept, since the documentation standard in 164.316 applies to written policies and procedures. An implementation partner can structure the records and configure tooling, but the organization must decide what is reasonable and appropriate and must keep the records current.

Can our own facilities team handle maintenance records without outside help?

Yes, many organizations run this specification in-house, provided someone owns it and the procedure is written down. The work is administrative rather than technical: define what counts as a security-related repair, require a record for each one, and review the log periodically. Internal teams often struggle with consistency across vendors, after-hours repairs and staff turnover, which is where a documented procedure matters most. If you have an open-source helpdesk or ITSM tool, such as GLPI, its ticketing and change workflows can hold repair records. Outside help is most useful for configuring that tooling and preparing evidence, and the decision to use it stays with your organization.

What evidence would an auditor sample for maintenance records?

An assessor typically asks for the written procedure first, then tests whether the organization follows it. They commonly select a sample of repairs or modifications to security-related components and check that each has a dated record describing what was changed, who performed the work, and why it was needed. They may also look at how the organization decided whether the specification was reasonable and appropriate, and whether any alternative measure was documented. Ask your auditor which sampling method they will use and what period they will cover, because those details are set by the assessor, not by the standard. Keep the procedure, the log, and a short explanation of your decision together so they can be retrieved quickly.

Does a third-party HIPAA assessment prove we meet this requirement?

No. HHS states that no Security Rule standard requires certification and that it does not endorse or recognize private certifications, so a third-party report does not prove compliance on its own. An independent assessor can examine your records and give an opinion, but the organization remains responsible for the controls and the evidence. OCR can still investigate and find a violation after an outside review. Treat any outside review as one input to your own risk analysis. For background, read the HHS FAQ on certifying compliance, and confirm the scope and limits of any assessor's report in writing before you rely on it.

How DeployOpen prepares maintenance record evidence

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, including the ticketing records that show repairs and modifications to security-related physical components. We prepare the systems and evidence for your compliance review, while your organization owns its safeguards and any assessor issues conclusions.

How we scope

Agree in writing which facilities, server rooms, doors, locks and security hardware fall under the maintenance record process.
Define which request types count as security-related repairs or modifications, such as lock changes, door hardware and camera mounting.
Confirm who in your organization approves maintenance work and who signs off on records before they are filed.

How we build

Configure a ticketing workflow, for example in GLPI or Zammad, that captures date, technician, component, work performed and approver.
Set up required fields and categories so each physical security change produces a retrievable, consistent record.
Document the maintenance policy and procedure that the addressable specification asks your organization to maintain.

How we hand over

Deliver the written procedure, workflow configuration and a sample record set for your review and sign-off.
Provide a walkthrough so staff can log a repair and find past maintenance history for a given door or device.
Document any addressable decision, including why a measure was judged unreasonable and what equivalent measure applies, for your records.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Review periodic maintenance record samples and update the workflow when facilities or vendors change.
Confirm with your auditor or assessor which record format and retention period they expect before go-live.