The four standards
| Standard | What it asks for | Implementation specifications |
|---|---|---|
| §164.310(a) Facility access controls | Limit physical access to systems holding ePHI and the facilities they are in, while letting authorized people in | Contingency operations, facility security plan, access control and validation procedures, maintenance records (all addressable) |
| §164.310(b) Workstation use | Define how workstations that access ePHI are used, and their surroundings | None listed; the standard applies directly |
| §164.310(c) Workstation security | Physical safeguards that restrict workstations to authorized users | None listed; the standard applies directly |
| §164.310(d) Device and media controls | Govern hardware and media containing ePHI as it moves in, out and within the facility | Disposal and media re-use (required); accountability and data backup and storage (addressable) |
"Addressable" does not mean optional. It means you assess whether the specification is reasonable for you, implement it if it is, and document what you do instead if it is not.
In January 2025 HHS proposed changes to the Security Rule, including removing the distinction between required and addressable specifications. Check whether the rule has been finalized when you read this. We are not lawyers, and this is not legal advice.
What to test on site
- Whether doors to server rooms, records rooms and network closets are controlled, and whether the access list matches who actually needs to be there.
- Whether badges and keys are removed when staff leave. See why a terminated employee’s badge still works.
- Workstations in reception, nursing stations and exam rooms: screen position, auto-lock, and whether an unattended session can be used.
- Where retired drives, laptops and copiers go, and whether anyone can show they were wiped or destroyed.
- Whether maintenance on doors and locks is recorded, as the facility access standard expects.
How we test it
Our compliance physical controls testing walks the facility the way an unauthorized person would, tests the controls behind your policies, and maps every finding to the safeguard it affects, with a price range on each.
Last reviewed October 7, 2026.