NIST SP 800-66 NISTSP66-5: Physical Safeguards: Facility Access, Workstation Use and Security, Device and Media Controls

Implement HIPAA Security Rule Physical Safeguards per 45 CFR 164.310. Facility Access Controls per 45 CFR 164.310(a): Contingency Operations + Facility Security Plan + Access Control and Validation Procedures + Maintenance Records (all Addressable). Workstation Use per 45 CFR 164.310(b): specify proper functions to be performed + manner of performance + physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI. Workstation Security per 45 CFR 164.310(c): implement physical safeguards for all workstations that access ePHI to restrict access to authorized users. Device and Media Controls per 45 CFR 164.310(d): Disposal (Required) + Media Re-use (Required) + Accountability (Addressable) + Data Backup and Storage (Addressable) covering hardware and electronic media that contain ePHI + procedures for receipt and removal of hardware and electronic media into and out of facility. Apply NIST SP 800-88 Guidelines for Media Sanitization for disposal and re-use.