What are physical safeguards for HIPAA?


Editorial team Published on

HIPAA physical safeguards are physical measures, policies, and procedures designed to protect electronic information systems, related equipment, and buildings from unauthorized intrusion, theft, and environmental hazards.

Under the Summary of the HIPAA Security Rule provided by the U.S. Department of Health and Human Services (HHS), these safeguards are divided into four main standards:

Core Standards

  • Facility Access and Control: Policies to limit physical access to facilities and buildings that house electronic protected health information (ePHI) while ensuring authorized access is permitted. (Examples: Keycards, visitor logs, security guards, and locked server rooms).
  • Workstation Use: Policies and procedures that specify the proper functions, manner of use, and physical surroundings of workstations that access ePHI. (Examples: Positioning computer screens away from public view and auto-logoff settings).
  • Workstation Security: Physical safeguards for all workstations that access ePHI to restrict access only to authorized users. (Examples: Privacy screens, cable locks, and secure physical placement).
  • Device and Media Controls: Policies governing the receipt, movement, removal, and final disposal of hardware and electronic media containing ePHI. (Examples: Wiping or destroying hard drives before reuse or disposal, and tracking inventory of mobile devices like laptops).