Physical safeguards: facility, workstation, device and media controls

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.310: facility access controls (a), workstation use (b), workstation security (c), device and media controls (d).

Approved by Dr. Maria Lindqvist, Owner. Responsible officer: Janelle Okafor, Office Manager.

Purpose

This policy protects the buildings, rooms, computers, phones and media of Granite City Family Dental from theft, loss and unauthorized use. The device inventory in section 4 is a required register and the first thing the practice will need after a theft.

1. Facility access controls

Authority: 45 CFR 164.310(a).

Locations

Controls in place

• Keyed or coded entry doors
• Alarm system
• Security cameras
• Locked server / network closet
• Locked records room or cabinets
• Visitor sign-in

Facility security plan

• Doors to the building, the records area and the server or network closet are locked outside business hours and whenever the area is unattended.
• Keys, codes and badges are issued by name, recorded in the key-holder list below, and recovered on the person's last day under the termination checklist (document 14). Door and alarm codes are changed when any holder leaves.
• Vendors with after-hours access: Bright Clean LLC (cleaning, Tue/Fri evenings). They do not have keys to the records room or the server closet, and workstations are locked or shut down before they arrive. Their access is reviewed at the annual walkthrough.- Visitor and contractor rule: Visitors sign in, wear a badge and are escorted beyond the waiting room. Vendors working on systems are supervised; after-hours vendors do not have access to records rooms or unlocked workstations.
• Repairs and changes to locks, doors, alarms, cameras and the closet are written in the facility maintenance log (registers appendix) with the date, what was done and by whom (45 CFR 164.310(a)(2)(iv)).
• In an emergency (fire, flood, power loss) the Security Officer or backup designee controls who enters to recover equipment and records; the contingency plan (document 17) applies.

Key, code and badge holders

Authority: 45 CFR 164.310(a)(2)(iii).

2. Workstation use

Authority: 45 CFR 164.310(b).

A workstation is any desktop, laptop, tablet or phone used to reach PHI, in the office or elsewhere. The rules at Granite City Family Dental:

Workstations are for practice business; personal use is limited and never on systems that hold PHI. Screens lock when unattended. No PHI is stored on local drives, desktops or personal cloud accounts. Remote work happens only on practice-managed, encrypted devices over approved remote access.

• Workstations in reception and exam rooms are placed so patients and visitors cannot read the screen; privacy screens or screen placement away from public view are in place.- Users lock the screen (Windows key + L) whenever they step away; the system locks itself after 10 minutes in any case.
• Nothing containing PHI is saved to the local desktop, downloads folder, a personal cloud account, a personal email or a personal device.
• Personal devices (BYOD): Not permitted for PHI.- Remote work: only on practice-managed, encrypted devices through the approved VPN or secure remote tool with MFA.

3. Workstation security

Authority: 45 CFR 164.310(c).

• Laptops that leave the office are encrypted (document 21), carried in a bag, never left in a vehicle, and stored out of sight at home.
• Desktops in public-facing areas are cable-locked or placed where they cannot be carried off unnoticed.
• The server or network closet, where one exists, holds only IT equipment, is locked, and is entered only by key holders and supervised vendors.
• Printers and multifunction devices that print PHI sit in staff-only areas; print jobs are collected at once.
• A lost or stolen workstation or phone is reported the same day under document 16 and assessed under document 22.

4. Device and media controls

Authority: 45 CFR 164.310(d).

Device inventory

Authority: 45 CFR 164.310(d)(2)(iii) (accountability). Every desktop, laptop, server, phone, tablet, printer, network device and external drive the practice owns or uses for PHI. Reconciled against what is physically present once a year and whenever a device is bought, moved or disposed of.

Server Dell PowerEdge T350 (GCFD-SRV1) holds ePHI and is not encrypted. Required control: encrypt or retire within 30 days. Recorded in the risk register as "Unencrypted device", owner Janelle Okafor.

Disposal

Authority: 45 CFR 164.310(d)(2)(i).

• No device or drive that has ever held PHI leaves the practice (sale, donation, return to lessor, recycling, trash) until its storage has been purged or destroyed and the action recorded in the disposal log.
• Who disposes: CRU Technologies. Method: NIST 800-88 purge by IT provider with record.
• The standard is NIST Special Publication 800-88 Rev. 1: Clear (overwrite) is acceptable only for media that will be re-used inside the practice; Purge (cryptographic erase or secure erase with a written record) or Destroy (shredding, with a certificate naming the serial numbers) is required before any media leaves the practice.
• Copiers, printers and fax machines contain hard drives; they are purged or the drive is removed before they are returned or sold.
• Paper PHI is destroyed by Shred-It, locked console, monthly pickup with certificate; certificates of destruction are kept with the disposal log.

Media re-use

Authority: 45 CFR 164.310(d)(2)(ii).

A drive, laptop or phone handed from one user to another is wiped (NIST 800-88 Clear at minimum) and re-imaged by CRU Technologies before the new user receives it, so one user never inherits another's data or access.

Data backup before moves

Authority: 45 CFR 164.310(d)(2)(iv).

Before a server, workstation or drive holding ePHI is moved, repaired, upgraded or sent off site, the IT provider confirms a current, restorable backup exists under document 17.

Removable media

Removable media rule: Not permitted. USB drives, memory cards and external drives are not used for PHI. Patient copies on media are produced only through the record-request process in document 09 on encrypted practice-owned media.

Disposal log

Authority: 45 CFR 164.310(d)(2)(i). Retain six years.

5. Enforcement

Leaving a workstation unlocked, taking PHI on an unapproved device, or disposing of equipment outside this policy is handled under the sanction policy (document 05).

Approval

Policy approved by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Security Officer: Janelle Okafor Signature: ___________________________ Date: ______________

Annual facility walkthrough checklist

Granite City Family Dental — Completed once a year at every location, and after any move or remodel. File behind this policy.

Location: __________________________________________ Date: ______________ Walked by: ___________________________

Exterior and entry:

☐ All exterior doors lock and close fully; after-hours entry requires a key or code.

☐ Alarm is armed each night and codes are known only to current key holders.

☐ Cameras record and cover the entrances, if installed.

☐ Visitor sign-in sheet in use; badges available; escort rule understood by front desk.

Reception and waiting area:

☐ No screen is readable from the waiting area; privacy screens fitted where needed.

☐ Sign-in sheet collects name and time only.

☐ No charts, forms or printouts visible on the counter; fax and printer output collected.

☐ Conversations about care cannot be overheard from the waiting area.

Clinical and office areas:

☐ Workstations lock after 10 minutes; staff lock screens when leaving a room.

☐ Paper records stored locked when not in use; nothing left in exam rooms overnight.

☐ Shredding bins locked; shredding certificates on file.

☐ Laptops cable-locked or stored out of sight; none left in vehicles.

Server / network closet (where present):

☐ Door locked; key holders match the list; no non-IT storage inside.

☐ Firewall (UniFi Cloud Gateway Max) and network gear labeled and powered through a surge protector or UPS.

☐ Backup target (if local) present and not reachable by casual access.

Devices and media:

☐ Device inventory reconciled: every device present is listed, every listed device located or marked disposed.

☐ No unlisted personal drives, phones or laptops in use for PHI.

☐ Disposal log current; certificates on file for every disposed device.

Findings and actions (each becomes a risk-register item with owner and due date):

__________________________________________________________________________

__________________________________________________________________________

Walked by signature: ___________________________ Date: ______________

Security Officer review (Janelle Okafor): ___________________________ Date: ______________