OCR Highlights Importance Of Physical Safeguards To Protect PHI

The May 2018 cyber security newsletter from the U.S. Department of Health and Human Services Office for Civil Rights (OCR) focused on a topic often overlooked by covered entities and their business associates: physical security. The HIPAA Security Rule requires covered entities and business associates to implement "physical safeguards for all workstations that access ePHI to restrict access to authorized users."

Technical safeguards like encryption and access control are often top-of-mind when dealing with ePHI, but physical safeguards are equally important in protecting information. In addition, physical safeguards are often very simple and easy to implement. For example, a computer placed in a high traffic area without a privacy screen can expose PHI to unintended recipients as they pass by, even if the computer meets all technical standards. OCR's newsletter suggests various types of physical safeguards for electronic devices, such as using device locks to deter