Facility Access and Control 

A provider must limit physical access to its facilities while ensuring that authorized access is allowed. 

Workstation and Device Security 

A provider must implement policies and procedures to specify the proper use of and access to workstations and electronic media. A provider also must have in place policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media to ensure appropriate protection of electronic protected health information (e-PHI).