Physical safeguards: what 45 CFR 164.310 actually requires

The physical safeguards are the part of the Security Rule people skim, because the text smells like 2003: facilities, workstations, maintenance records for doors and locks. A clinic owner reads it and thinks, I rent two rooms and my staff work in families’ homes, this is not about me.

It is about you more than anyone. The rule’s authors pictured ePHI living in a server room, so they wrote rules about the room. Your ePHI lives on devices that travel, which does not shrink the family of obligations; it relocates them. The room you have to think about is a living room you do not control, a school hallway, and the back seat of a car, and the four standards below apply to all of it (45 CFR 164.310, read against the general rules).

Facility access controls

45 CFR 164.310(a)(1). Limit physical access to your electronic information systems and the facilities in which they are housed, while ensuring that properly authorized access is allowed.

“The room you have to think about is a living room you do not control, a school hallway, and the back seat of a car, and the four standards below apply to all of it”

Four implementation specifications, all addressable: contingency operations, procedures for facility access to support data restoration in an emergency (164.310(a)(2)(i)); a facility security plan, protecting the facility and equipment from unauthorized access, tampering, and theft (164.310(a)(2)(ii)); access control and validation procedures, controlling who gets in based on role, including visitors (164.310(a)(2)(iii)); and maintenance records, documenting repairs and modifications to security-relevant parts of the facility, doors, locks, hardware (164.310(a)(2)(iv)).

Addressable means the honest assessment, and for a small clinic the honest assessment is refreshingly small. You are not building a badge system. Your facility questions are: who has keys or codes, is there a list, does it change when staff leave, where does the equipment that holds ePHI sit relative to the waiting room, and can a parent waiting for intake see the front desk screen. If you rent inside a larger building, your suite is your facility, and the questions are about your suite. Write the answers down; that document is most of the standard at your scale.

The trap at your scale is the second specification’s phrase “and theft.” A facility plan that thinks only about intruders misses that the likeliest physical loss is a laptop walking out with a departing employee or a break-in taking the office iPads overnight. Both are facility security events, and both end at the same question the whole family keeps returning to: were the devices encrypted.

Workstation use

45 CFR 164.310(b). Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI.

No implementation specifications; the standard itself is the obligation. And before it can mean anything, you need the definition: a workstation is an electronic computing device, for example a laptop or desktop computer, or any other device that performs similar functions, and the electronic media stored in its immediate environment (45 CFR 164.304). The tablet running your data collection app is a workstation. The phone an RBT texts parents from is a workstation. The BCBA’s home laptop, if the portal opens on it, is a workstation.

Notice what the standard asks for: not technology, but rules about use and surroundings, written by class of workstation. For a clinic the classes are obvious, and the surroundings rules are where ABA reality gets its due. The field tablet class: signed into the data app only, screen not visible to siblings during sessions, never left in the car, comes home to the charging shelf. The clinic desktop class: positioned so the screen faces away from the waiting area, locked when stepped away from. The personal phone class, if you allow it at all: which apps may touch PHI, and which never (the camera roll question, the personal cloud backup question). This is the standard that turns “be careful out there” into a document a new hire can actually be trained on.

Workstation security

45 CFR 164.310(c). Implement physical safeguards for all workstations that access ePHI, to restrict access to authorized users.

Also no implementation specifications. If workstation use is the rules, workstation security is the restraints: the measures that keep an unauthorized person from using the device at all.

In the office that is the old vocabulary: rooms that lock, screens positioned away from public view, maybe a cable lock on the front desk machine. In the field it is the new vocabulary: the device auto-locks in under a minute, unlocking requires a passcode or biometric, the RBT’s bag does not sit open in a home with curious children, and there is a rule for the two hours between sessions when the tablet would otherwise ride in a parked car. Physical security for a mobile fleet is mostly habits plus device settings, which is why this standard and automatic logoff in the technical safeguards are two halves of one answer.

Device and media controls

45 CFR 164.310(d)(1). Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, and the movement of these items within the facility.

This is the standard your clinic lives in daily, because your hardware’s whole job is receipt, removal, and movement. Four implementation specifications, and here the labels bite.

Disposal (Required, 164.310(d)(2)(i)). Policies and procedures for the final disposition of ePHI and the hardware or media it is stored on. Required. A device that leaves your clinic still holding client data is a disclosure to whoever holds it next. Deleting files and emptying trash does not remove data from storage; disposal means destruction or proper sanitization of the media, and it applies to the sneaky inventory too: the office copier with a hard drive, the old phone in the drawer, the dead laptop nobody wiped before donating it.

Media re-use (Required, 164.310(d)(2)(ii)). Remove ePHI from media before reusing it. Also required. This is the standard governing the most routine event in your device fleet: the tablet reassigned from a departing RBT to the new hire. Reassignment without a wipe hands the new employee whatever the old one left, and the rule’s answer is a factory reset in the reassignment checklist, every time, with the date recorded.

Accountability (Addressable, 164.310(d)(2)(iii)). Maintain a record of the movements of hardware and media and the person responsible. For a fleet of tablets in the field, the honest assessment lands at yes with unusual force: a simple register, which device, assigned to whom, since when, is the difference between “an iPad is missing” and “iPad 7, assigned to J., last synced Tuesday, encrypted.” One of those sentences starts a breach analysis. The other one mostly ends it.

Data backup and storage (Addressable, 164.310(d)(2)(iv)). Create a retrievable exact copy of ePHI, when needed, before movement of equipment. In a cloud-synced clinic this is often genuinely satisfied by architecture, and the honest documentation says exactly that: the data lives in the platform, not on the device, and here is how we verified it. That sentence, written down, is a legitimate addressable answer, and it is a better one than most clinics ever produce.

The thread through all four

Every standard above eventually arrives at the same cliff: a device with ePHI on it left your control. The facility plan, the workstation rules, the register, the disposal procedure all exist to make that event rare, known, and small.

And one decision, made once, changes what the cliff is. If the device was encrypted to the standards in HHS guidance, the data on it is not unsecured PHI (45 CFR 164.402), and a lost device is a hardware cost instead of a notification event. The physical safeguards are where you work to keep devices from being lost. Encryption is why losing one does not have to be a crisis. A clinic that does the first without the second is holding its breath and calling it a plan.

What may change

The January 2025 proposed rule (90 FR 800) would reach this family mainly through its general machinery: a required written inventory of technology assets and an ePHI map, which would turn the accountability register above from an addressable judgment into table stakes, and the end of the addressable category itself. It is a proposal, not law, with final action currently shown for mid 2027. But an inventory of where your ePHI physically lives is not something to wait for permission to need; it is page one of the risk analysis you were already required to do.

Where clinics actually fail

Never at the locked door. The failures are the copier sold with its drive intact, the tablet reassigned without a wipe, the laptop in the car overnight, the departed RBT whose device came back three weeks later or not at all, and no register that would even show it. Physical security for a field-based clinic is not guards and cameras. It is a list, a checklist, a habit, and encryption underneath all of it for the day a habit fails.