Workstation use and security: the tablet in the living room is a workstation

Read “workstation” and most people picture a desk, a monitor, an office. The rule was written in 2003, when that picture was accurate for almost every covered entity. It is not accurate for an ABA clinic, and the definition does not care what picture comes to mind.

What the rule actually requires

Two Required standards, both with no implementation specifications, meaning the standard itself is the entire obligation:

• Workstation use (164.310(b)). Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI.
• Workstation security (164.310(c)). Implement physical safeguards for all workstations that access ePHI, to restrict access to authorized users.

Before either can mean anything, the definition matters: a workstation is an electronic computing device, for example a laptop or desktop computer, or any other device that performs similar functions, and electronic media stored in its immediate environment (45 CFR 164.304). The tablet running your data collection app is a workstation. The phone an RBT texts parents from is a workstation. The BCBA’s home laptop, if the portal opens on it, is a workstation.

Workstation use: rules by class of device

Notice what the standard asks for: not technology, but rules about use and surroundings, written by class of workstation, because a single policy cannot honestly cover a clinic desktop and a field tablet at the same time.

“The tablet running your data collection app is a workstation. The phone an RBT texts parents from is a workstation.”

The field tablet class needs rules for a living room, a car, a coffee shop. The clinic desktop class needs rules for a shared office with a waiting room nearby. The personal phone class needs rules for a device the clinic does not own and cannot fully control. This is the standard that turns “be careful out there” into a document a new hire can actually be trained on, because it names the classes and states the rule for each one instead of leaving it to instinct.

Workstation security: the restraints

If workstation use is the rules, workstation security is what enforces them physically, the measures that keep an unauthorized person from using the device at all.

In the office, that is the familiar vocabulary: rooms that lock, screens positioned away from public view, maybe a cable lock on a shared machine. In the field, it is a newer vocabulary: the device auto-locks in under a minute of inactivity, the case does not advertise what app is open, the tablet is never left in view in an unattended car. This standard and automatic logoff under access control (164.312(a)(2)(iii)) are two halves of one answer, physical restraint and technical restraint, aimed at the same failure: an unattended, unlocked device.

What real workstation policy looks like, next to what most clinics have

	What the rule requires	What most clinics actually have
Definition of workstation	Any device reaching ePHI, wherever it sits	“The computers in the office,” unofficially
Field devices	Their own named class with written rules	No rules written for them at all
Personal devices	A defined class, even without clinic ownership	Assumed to be outside the policy’s reach
Physical restraint	Auto-lock, screen positioning, considered by class	Whatever the device’s factory default happens to be

The common failure is not a bad policy for the office desktop. It is the complete absence of a policy for the devices that actually carry ePHI out of the building every day.