Definition
Physical safeguards are physical measures, policies, and procedures used to protect a covered entity's or business associate's electronic information systems and related buildings and equipment.
In practice
- A clinic can restrict access to network closets and use a documented process for returned laptops.
- A remote workforce policy can address screen visibility, printing, and device storage.
Who this applies to
- Organizations operating facilities or workstations with ePHI
- Cloud and data-center customers with shared physical responsibilities
- Workforce members using portable devices or media
What the rule asks for
- Control facility access and validate that workstations and devices are appropriate for their use.
- Establish workstation security and device and media controls.
- Address disposal, reuse, movement, and access to equipment and media.
How teams put it into practice
- Inventory locations, devices, removable media, and physical access roles.
- Define secure disposal and reuse evidence for storage media.
- Include remote work, shipping, repairs, and shared spaces in walkthroughs.
Common mistakes
- Assuming cloud hosting removes all customer physical-safeguard duties.
- Ignoring printers, paper-to-electronic workflows, and removable media.
- Failing to document device disposal or reuse.
Questions that come up
Do remote workers need physical safeguards?
Remote work changes the environment but does not remove the need to analyze workstations, devices, media, and physical access to ePHI.
References
- Physical safeguards guidance HHS Office for Civil Rights