Physical safeguards: what 45 CFR 164.310 actually requires

The physical safeguards are the part of the Security Rule people skim, because the text smells like 2003: facilities, workstations, maintenance records for doors and locks. A clinic owner reads it and thinks, I rent two rooms and my staff work in families’ homes, this is not about me.

It is about you more than anyone. The rule’s authors pictured ePHI living in a server room, so they wrote rules about the room. Your ePHI lives on devices that travel, which does not shrink the family of obligations; it relocates them. The room you have to think about is a living room you do not control, a school hallway, and the back seat of a car, and the four standards below apply to all of it (45 CFR 164.310, read against the general rules).

Facility access controls

45 CFR 164.310(a)(1). Limit physical access to your electronic information systems and the facilities in which they are housed, while ensuring that properly authorized access is allowed. Four Addressable implementation specifications sit under it: contingency operations for emergency data restoration (164.310(a)(2)(i)), a facility security plan against unauthorized access, tampering, and theft (164.310(a)(2)(ii)), access control and validation procedures including visitors (164.310(a)(2)(iii)), and maintenance records for security-relevant repairs (164.310(a)(2)(iv)). The trap is reading the second specification’s “and theft” as a fire-and-flood checklist: theft is a facility security event too, and a laptop that walks out routes to the same question the whole family keeps returning to, was the device encrypted. The full treatment, including how small the honest assessment actually is at clinic scale, is in Facility access controls: the questions are smaller than you think.

“The room you have to think about is a living room you do not control, a school hallway, and the back seat of a car, and the four standards below apply to all of it”

Workstation use and security

45 CFR 164.310(b) and (c). Two Required standards with no implementation specifications: workstation use requires policies specifying the proper functions and the surroundings for a workstation or class of workstation that can access ePHI (164.310(b)), and workstation security requires physical safeguards restricting workstation access to authorized users (164.310(c)). The definition is the key: a workstation is any electronic computing device and the media in its immediate environment (45 CFR 164.304), so the field tablet, the RBT’s phone, and the BCBA’s home laptop are all workstations. Write the use rules by class of device and back them with physical restraint, screens turned away from the waiting room in the office, auto-lock and a rule for the tablet in a parked car in the field. The full treatment is in Workstation use and security: the tablet in the living room is a workstation.

Device and media controls

45 CFR 164.310(d)(1). Implement policies and procedures governing the receipt, removal, and internal movement of hardware and electronic media that contain ePHI. Four implementation specifications: disposal (Required, 164.310(d)(2)(i)) and media re-use (Required, 164.310(d)(2)(ii)), plus accountability (Addressable, 164.310(d)(2)(iii)) and data backup before movement (Addressable, 164.310(d)(2)(iv)). The point that catches clinics is that disposal is not deletion: a device that leaves still holding client data is a disclosure to whoever holds it next, deleting files does not remove data from storage, disposal means destruction or proper sanitization, and re-use means a factory reset before a tablet is reassigned. The full treatment is in Device and media controls: the standard your clinic lives in daily.

The thread through all four

Every standard above eventually arrives at the same cliff: a device with ePHI on it left your control. The facility plan, the workstation rules, the register, the disposal procedure all exist to make that event rare, known, and small.

And one decision, made once, changes what the cliff is. If the device was encrypted to the standards in HHS guidance, the data on it is not unsecured PHI (45 CFR 164.402), and a lost device is a hardware cost instead of a notification event. The physical safeguards are where you work to keep devices from being lost. Encryption is why losing one does not have to be a crisis. A clinic that does the first without the second is holding its breath and calling it a plan.

What may change

The January 2025 proposed rule (90 FR 800) would reach this family mainly through its general machinery: a required written inventory of technology assets and an ePHI map, which would turn the accountability register above from an addressable judgment into table stakes, and the end of the addressable category itself. It is a proposal, not law, with final action currently shown for mid 2027. But an inventory of where your ePHI physically lives is not something to wait for permission to need; it is page one of the risk analysis you were already required to do.

Where clinics actually fail

Never at the locked door. The failures are the copier sold with its drive intact, the tablet reassigned without a wipe, the laptop in the car overnight, the departed RBT whose device came back three weeks later or not at all, and no register that would even show it. Physical security for a field-based clinic is not guards and cameras. It is a list, a checklist, a habit, and encryption underneath all of it for the day a habit fails.