What are the HIPAA Security Rule Physical Safeguards? Facility Access Controls

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.

Introduction

The HIPAA Security Rule defines physical safeguards as “physical measures, policies, and procedures to protect a covered entity’s electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion.” 

There are four physical safeguard security standards. These are:

1. Facility access controls
2. Workstation use
3. Workstation security
4. Device and media controls

This article covers the first of these standards, the Facility Access Controls Standard. This standard requires covered entities and business associates to: “Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.”

What is a Facility?

A facility is defined in the Security Rule as “the physical premises and the interior and exterior of a building(s)”.

What are the Facility Access Controls Standard Implementation Specifications?

The Facility Access Controls standard has four implementation specifications - that is, the regulations require covered entities and business associates to implement four specific requirements to meet the standard. These requirements are:

1. Contingency Operations (Addressable)
2. Facility Security Plan (Addressable)
3. Access Control and Validation Procedures (Addressable)
4. Maintenance Records (Addressable)

Each requirement is discussed in turn, below.

Contingency Operations

This requirement obligates covered entities and business associates to "Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency."

1. Allowing only authorized workforce members or business associates access to facilities to support restoration of lost data. The Disaster Recovery Plan should identify which individuals are allowed such access.
2. Defining workforce members' roles in the Disaster Recovery Plan.
3. Addressing ePHI systems and electronic media in the Emergency Mode Operation Plan - specifically, preparing an asset inventory.

4. Defining, in the Disaster Recovery Plan, how the actions taken by the workforce members in (2) above are tracked and logged, and how unauthorized access can be detected and prevented.

5. Defining in the Emergency Mode Operations Plan which workforce members are authorized to enter facilities to enable continuation of processes and controls that protect the confidentiality, integrity, and availability of ePHI while operating in emergency mode.
5. Define workforce members' specific roles in the Emergency Mode Operations Plan.
6. Ensuring that the Emergency Mode Operations Plan defines how the actions taken by these workforce members are tracked and logged, and how unauthorized access can be detected and prevented.
7. Requiring that only authorized workforce members are permitted to administer or modify processes and controls that protect the security of ePHI.

This requirement is designed to protect the physical facility housing the ePHI and software programs, through "people controls" - control and validation of facility access based on role or function, and control of visitor access.

Visitor controls include:

1. Sign-in sheets/front desk sign-in and sign-out logs 

2. Requiring visitors to present a government-issued ID or other photo ID
3. Requiring visitors to wear badges
4. Providing a security escort for visitors.

These measures ensure that visitors are not permitted entry at will, without monitoring when they come in, who they are, or what their purpose is.

Entities can adopt and implement visitor control procedures that are reasonable and appropriate for their environment. For example, when a visitor with whom a medical practice is familiar enters the facility, the practice can require the visitor to sign a front desk log. If a visitor is someone with whom the practice is not familiar, the practice could require both presentation of photo ID and front desk log signing.