Physical & Facility Security Policy

Scope

This Policy applies to all workforce members (employees, contractors, interns, and volunteers), to visitors and vendors who enter a controlled space, and to every location and physical asset that creates, receives, maintains, or transmits ePHI, including controlled offices, equipment rooms, approved home work areas, workstations and laptops, and any removable or paper media. Workforce members must acknowledge this Policy in writing before access is granted and at least annually thereafter.

Policy

1. Facility access controls (164.310(a)(1))

[Organization] limits physical access to facilities and to the systems and media that house ePHI to authorized workforce members, while ensuring that properly authorized access is allowed. For any controlled office or equipment room, entry is restricted by a physical control (locked door, badge reader, or keyed lock), access is granted by role on a least-privilege basis, and the set of people holding keys or badges is documented and kept current. Where production systems and ePHI are cloud-hosted, the corresponding datacenter facility controls are provided by the [cloud infrastructure provider] and inherited under the BAA (§2); [Organization]'s own facility controls focus on the offices, devices, and media within its custody. Workforce members must report any suspected unauthorized physical access promptly per the Security Incident Response Policy. (164.310(a)(1))

2. Inherited datacenter controls (shared responsibility)

Production services and the primary ePHI stores run on a contracted [cloud infrastructure provider] and [cloud productivity & storage suite] operating under a BAA. Under the shared-responsibility model:

• Provider responsibilities: physical site security (facility selection, perimeter and building access control, monitoring/CCTV, environmental controls (power, cooling, fire suppression), and media sanitization at end of life), managed by the provider and evidenced through its independent audits (e.g., SOC 2 / ISO 27001 reports).
• [Organization] responsibilities: configure and administer its tenants securely, restrict and review access, and maintain physical safeguards for the offices, workstations, and media within its control. [Organization] does not operate production datacenters of its own.

The provider's current attestations are obtained and reviewed under the Vendor & Third-Party Management Policy, which is the control of record for confirming that these inherited physical safeguards remain in force.

3. Facility security plan (164.310(a)(2)(ii))

[Organization] maintains a facility security plan that protects its facilities and the equipment therein from unauthorized physical access, tampering, and theft. The plan identifies each location where ePHI systems, devices, or media may be present (controlled offices and approved home work areas alike) and the safeguards applied to each:

• Controlled offices/facilities: locked entry and, where used, badge or alarm systems; ePHI equipment and media stored in locked rooms or cabinets; reception or sign-in control for visitors; clear-desk and screen-positioning expectations.
• Remote/home work areas: ePHI is accessed only from an approved home work area or another pre-approved private location that can be reasonably secured. Public or shared spaces (cafés, coworking hot-desks) are not permitted for ePHI access unless privacy controls are in place: a privacy screen, no shoulder-surfing risk, and the device never left unattended. While ePHI is displayed, others are not permitted in the immediate work area and the device is screen-locked the moment someone enters. Printing ePHI is prohibited unless explicitly authorized; if authorized, paper is secured and destroyed per §7.

The plan is reviewed at least annually and upon any material change to the ePHI environment. (164.310(a)(2)(ii))

4. Access control and validation (164.310(a)(2)(iii))

[Organization] controls and validates a person's physical access to facilities and workspaces based on their role and, for software/program testing and revision, their function:

• Only authorized workforce members may access ePHI, and only from approved locations on devices that meet the endpoint controls in the Device & Workstation Security Policy (full-disk encryption, [endpoint protection], host firewall, automatic updates, and screen-lock).
• Visitors and vendors to a controlled space are identified, signed in, authorized for the area they enter, and escorted while in any area where ePHI systems or media are present; they are not permitted in a work area while ePHI is displayed or processed. Visitor records are retained as evidence.
• Physical access rights are reviewed when a workforce member changes role and revoked at termination, in step with the logical-access removal governed by the Access Control Policy.

(164.310(a)(2)(iii))

5. Contingency operations (emergency facility access) (164.310(a)(2)(i))

[Organization] establishes procedures that allow facility access in support of restoring lost data under the disaster-recovery and emergency-mode plans during an emergency. Because production systems and backups are cloud-hosted, emergency restoration depends on continued access to the [cloud infrastructure provider] rather than on entry to a company datacenter; [Organization] therefore maintains multiple administrators with MFA and documented break-glass access so that recovery can proceed even if a key individual is unavailable. Where a controlled office holds equipment or media needed for recovery, designated personnel are pre-authorized to enter during an emergency, and such access is logged and reviewed afterward. This control operates together with the Contingency Planning Policy (data backup, disaster recovery, and emergency-mode operations). (164.310(a)(2)(i))

6. Maintenance records (164.310(a)(2)(iv))

[Organization] documents repairs and modifications to the physical components of a facility and to equipment that are related to security: for example, changes to locks, doors, badge readers, alarms, or the hardware of devices authorized to access ePHI. Each record captures the date, the component or device, the nature of the work, who performed it, and, for a device that has held ePHI, whether ePHI was present and how it was protected while the device was out of [Organization]'s control. Routine facility maintenance with no bearing on security need not be logged. Maintenance records are retained for six years. The operational steps live in the companion Physical & Facility Security Procedures. (164.310(a)(2)(iv))

7. Disposal and final disposition of ePHI and media (164.310(d)(2)(i))

[Organization] addresses the final disposition of ePHI and of the hardware or electronic media on which it is stored so that ePHI cannot be readily recovered or reconstructed:

• Electronic media (drives, removable media, devices) is sanitized using a method appropriate to the media (cryptographic erase, secure wipe, or physical destruction) consistent with NIST SP 800-88 before disposal or release for reuse. Media that cannot be reliably sanitized is physically destroyed.
• Cloud-resident ePHI is disposed of by deletion within the [cloud infrastructure provider] / [cloud productivity & storage suite]; the provider performs media-level sanitization at end of life under the BAA (§2).
• Paper containing ePHI, where any exists, is cross-cut shredded or destroyed by a bonded service.
• Final disposition is documented (item, method, date, performer); a certificate of destruction is retained where a third party performs it. The disposal schedule is suspended for any ePHI subject to an open investigation, audit, or litigation hold.
• On termination of a vendor relationship, business associates return or destroy ePHI per the BAA; where neither is feasible, the BAA limits further use.

Disposal aligns with the six-year HIPAA retention requirement: records are destroyed only after their retention period has elapsed. Media re-use sanitization and broader device/media handling are governed by the Device & Workstation Security Policy. (164.310(d)(2)(i))

Roles & Responsibilities

• [Security Official]: owns this Policy; approves the facility security plan, physical-access authorizations, and exceptions; ensures maintenance and disposal records are kept; reviews emergency facility access.
• Office / facilities manager (or [Security Official] if none): administers keys, badges, and visitor control for controlled spaces and records maintenance affecting security.
• [Privacy Officer]: advises on safeguards for any ePHI handled in paper form.
• Workforce members: secure their work area and devices, control visitor presence while ePHI is displayed, and report lost/stolen devices or suspected unauthorized access immediately.

Related documents

Physical & Facility Security Procedures · Access Control Policy · Device & Workstation Security Policy · Contingency Planning Policy · Vendor & Third-Party Management Policy · Security Incident Response Policy.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Security Official] and after any significant change to the ePHI environment or to [Organization]'s facilities. v1.0.