Physical & Facility Security Procedures

For a [remote-first] organization that issues no physical credentials, record that no controlled space exists and skip steps 1–5; home-work-area expectations are covered by the Physical & Facility Security Policy §3.

2. Visitor and vendor control / access validation (164.310(a)(2)(iii))

1. Visitors and vendors to a controlled space sign in (name, organization, host, date, time in/out) and are issued a temporary visitor identifier where badges are used.
2. The host validates that the visitor is expected and authorized for the area, and escorts them while in any area where ePHI systems or media are present. Visitors are not left alone with ePHI equipment.
3. While ePHI is displayed or processed, workforce members ensure visitors are not in the immediate work area; devices are screen-locked before anyone enters.
4. Visitors sign out and return any temporary badge on departure; the visitor log is retained as evidence.
5. In remote/home work areas, the same intent applies informally: ePHI is not displayed when a non-authorized person (including household members) is present, and the device is locked when stepping away.

3. Emergency facility access (contingency operations) (164.310(a)(2)(i))

1. Because production systems and backups are cloud-hosted, data restoration in an emergency proceeds through the [cloud infrastructure provider]; [Organization] maintains at least two administrators with MFA so recovery is possible if one is unavailable.
2. Designated recovery personnel and any break-glass access paths are named in advance in the Contingency Planning Policy; invocation is logged.
3. Where a controlled office holds equipment or media needed for recovery, pre-authorized personnel may enter during the emergency using a documented method (e.g., an escrowed key or alarm code).
4. Each emergency-access event is recorded (who, when, why, what was accessed). Within [24 hours] the [Security Official] reviews it, confirms it was warranted, and rotates any shared credential or code that was used.

4. Maintenance log for physical-security components (164.310(a)(2)(iv))

1. Before any repair or modification to a security-relevant component (locks, doors, badge readers, alarms, or the hardware of a device authorized to access ePHI), the requester opens a maintenance record in the [ticketing system] (or a maintenance log).
2. The record captures: date, component/device identifier, nature of the work, who performed it (internal or external), and whether ePHI was present on any affected device.
3. If a device that has held ePHI leaves [Organization]'s control for repair, ePHI is first removed (secure wipe) or the storage medium is retained in-house; this is noted in the record.
4. For a temporary office or coworking space used for ePHI work, any maintenance by building staff or access to the work area by non-authorized individuals is documented.
5. Completed records are retained for six years.

5. Disposal of ePHI and media (SOP) (164.310(d)(2)(i))

1. Identify the item for disposal and confirm it is past its retention period and not subject to any open investigation, audit, or litigation hold (if it is, suspend disposal and notify the [Security Official]).
2. Select the method by media type:
   • SSDs / self-encrypting drives → cryptographic erase, or destruction if keys are unavailable;
   • magnetic drives / removable media → secure wipe to NIST SP 800-88 (clear/purge), or shredding;
   • devices being retired → full-disk wipe; physically destroy if the device cannot be reliably sanitized;
   • cloud-resident ePHI → delete within the [cloud infrastructure provider] / [cloud productivity & storage suite] (provider sanitizes media at end of life under the BAA);
   • paper → cross-cut shred or use a bonded destruction service.
3. Execute the disposal. For media re-use rather than disposal, render ePHI inaccessible per the Device & Workstation Security Policy before reissue.
4. Document the disposal record: item/identifier, method, date, and performer; attach a certificate of destruction for any third-party service.
5. For vendors holding ePHI, confirm return or destruction at contract end per the BAA and file the confirmation.
6. Disposal records are retained for six years.

Disposal record (representative fields): item/serial · media type · method · date · performed by · witness/approver · certificate ref.

Records produced (evidence)

Key/badge register · visitor logs · emergency facility-access records · maintenance log (security components & ePHI devices) · disposal records and certificates of destruction · vendor return/destruction confirmations. These are the artifacts an auditor will request to confirm the physical safeguards operate.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Security Official]. v1.0.