Facility access, tracked against your access list

Facility access sounds like it was written for hospitals with badge readers. At clinic scale the questions are small, answerable, and almost never written down.

The policy is composed from your clinic’s facts

Your facility access policy is generated against your recorded clinic facts, and what appears depends on how you actually operate. A clinic with controlled premises gets clauses on limiting physical access, who may enter by role with keys or codes, and supervising visitors, parents, and vendors. A clinic doing in-home work gets a clause on securing clinic work in a home setting. A remote-only clinic gets neither, because neither applies.

The policy also renders your own recorded decisions on all four addressable specifications at 164.310(a)(2): contingency operations, the facility security plan, access control and validation, and maintenance records.

What gets tracked after the policy exists

Seven requirements, or six if you operate remote-only:

• The policy is active, adopted, reviewed within twelve months, and its facts have not drifted.
• Your facility access points are documented in an inventory, skipped if you are remote-only.
• No one recorded as terminated still holds an active facility access assignment.
• No unauthorized-entry or intrusion incidents are sitting open from the last twelve months.
• All four addressable decisions are finalized and recorded.

That third one is worth pausing on. It cross-checks your access list against your workforce records, so a departed employee still showing an active key or code assignment surfaces as a finding rather than waiting for someone to remember.

What this is, and what it is not

The system tracks records: your access point inventory, your access assignments, your incidents, your decisions. It does not observe doors, read badge readers, or know who physically walked in. When it flags a terminated person holding access, it means the assignment record was never closed, not that a key is confirmed to still be in their pocket.

Which is still the thing you want to know. The record staying open is usually how the physical key stays in the pocket.

What an investigator gets

A dated, adopted policy matched to how you actually operate. A documented inventory of access points. An access list that reconciles against your workforce. Four recorded addressable decisions. And with nothing recorded, this control reports a gap rather than staying quiet, an empty answer here is a real finding.