HIPAA Security Implementation, Version 1.0

The physical safeguards are a series of security measures meant to protect a CE's electronic information systems, as well as related buildings and equipment, from natural hazards, environmental hazards, and unauthorized intrusion. The measures include both administrative policies and physical controls. The specific standards of the physical safeguards are:

• Facility access controls: Implementing policies and procedures that limit physical access to electronic information systems and the facilities in which they are housed, while ensuring that properly authorized access is allowed.

• Workstation use: Implementing policies and procedures that specify the proper workstation functions to be performed, the manner in which those functions are to be performed, and the characteristics of the physical surroundings of workstations that can access EPHI.

• Workstation security: Implementing physical safeguards for all workstations that can access EPHI, so as to limit access to only authorized users.

• Device and media controls: Implementing policies and procedures for the receipt and removal of hardware and electronic media that contain EPHI into and out of a CE, and the movement of those items within a CE.