HIPAA Physical Safeguards (45 CFR 164.310)
Four standards covering facility access controls, workstation use and security, and device and media controls including disposal and re-use.
Primary source
45 CFR 164.310 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.310
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.310 sets four physical safeguard standards.
Facility Access Controls (a)(1): policies for limiting physical access to systems and facilities housing ePHI. Specs: contingency operations (A), facility security plan (A), access control and validation procedures (A), maintenance records (A).
Workstation Use (b): policies governing the proper functions and physical attributes of workstations that access ePHI. Required specification.
Workstation Security (c): physical safeguards for workstations to restrict access. Required.
Device and Media Controls (d): policies for receipt and removal of hardware and electronic media containing ePHI. Specs: disposal (R), media re-use (R), accountability (A), data backup and storage (A).
Disposal and re-use failures are a recurring enforcement theme — improperly wiped photocopiers, lost laptops, and end-of-life servers shipped to disposal vendors without sanitization. NIST SP 800-88 r1 ("Guidelines for Media Sanitization") is the standard reference for satisfying the disposal and media re-use specifications.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Device and Media Controls (45 CFR 164.310(d))Required specifications for disposal of hardware and electronic media containing ePHI, and media re-use procedures.
- RegulationHIPAA Security Rule: General Rules (45 CFR 164.306)Required objectives — confidentiality, integrity, and availability of ePHI — plus the flexibility provisions that govern how covered entities select and implement specific safeguards.
- RegulationHIPAA Technical Safeguards (45 CFR 164.312)Five standards covering access control, audit controls, integrity, person or entity authentication, and transmission security for ePHI.
- ComplianceHIPAA Mobile Device & BYOD Policy Template (45 CFR § 164.310(d) + 164.308(a)(1)(ii)(B))2026 HIPAA mobile and BYOD policy template — 45 CFR § 164.310(d), § 164.308(a)(1)(ii)(B), NIST SP 800-124r2, enrollment and offboarding workflow.
- SRAThe HHS SRA Tool vs Paid HIPAA Risk Analysis OptionsWhat the free HHS/ONC Security Risk Assessment Tool actually does, where it stops, and how to evaluate paid alternatives without overpaying for what the free tool already covers.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- GlossaryAccess ControlsTechnical policies and procedures that allow only authorized persons or software programs to access ePHI.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.