Facility Access and Control
A provider must limit physical access to its facilities while ensuring that authorized access is allowed.
Workstation and Device Security
A provider must implement policies and procedures to specify the proper use of and access to workstations and electronic media. A provider also must have in place policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media to ensure appropriate protection of electronic protected health information (e-PHI).