HIPAA Administrative and Physical Safeguards Explained: Every Standard in 164.308 and 164.310

HIPAA administrative safeguards are the policies and management actions that run a security program: the risk analysis, training staff on security policies and procedures, access approvals, contingency planning and vendor contracts. HIPAA physical safeguards are the controls on buildings, workstations and media: locked doors, visitor control, screen placement and drive disposal.

In the rule’s own words, physical safeguards are “physical measures, policies, and procedures to protect a covered entity’s or business associate’s electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion” (45 CFR 164.304). Administrative safeguards are “administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information” (ePHI), and to manage the workforce’s conduct in protecting it. The physical side is four standards in 45 CFR 164.310; the administrative side is nine standards in 45 CFR 164.308, from the risk analysis to business associate contracts.

This guide covers all 13 standards, the enforcement cases behind them and the proposed changes; HIPAA technical safeguards have their own guide. Invadel’s part is the testing evidence, not the compliance program: a physical penetration test (from $6,800) shows whether facility and workstation controls stop someone who walks in, and a phishing simulation (from $3,600) shows whether training changes behavior. HIPAA penetration testing covers the systems side, and healthcare penetration testing covers EHR integrations, patient portals and connected devices.

What physical safeguards and administrative safeguards are

Most of the Security Rule (45 CFR Part 164, Subpart C) sits in three kinds of safeguards; organizational requirements (164.314) and documentation requirements (164.316) sit beside them. Two more definitions in 164.304 set the reach of the physical ones. A facility is “the physical premises and the interior and exterior of a building(s),” so loading docks and side doors count. A workstation is a laptop, desktop “or any other device that performs similar functions, and electronic media stored in its immediate environment,” so a clinic-cart tablet and the USB drive in the desk drawer count too.

	Administrative	Physical	Technical
Section	164.308	164.310	164.312
Standards	9	4	5
Implementation specifications	21 (10 required, 11 addressable)	8 (2 required, 6 addressable)	7 (2 required, 5 addressable)
What it governs	The program, the workforce, vendors, planning	Buildings, workstations, hardware and media	Controls inside the systems
Test that evidences it	Phishing, internal network and ransomware readiness tests	Physical penetration test	Network, application and cloud tests

Administrative safeguards are half of the 18 safeguard standards and 21 of their 36 implementation specifications. They include the risk analysis (164.308(a)(1)(ii)(A)), and a missing or incomplete one is a cited failure in two of the four settlements below (Affinity and Lafourche).

Required, addressable, and standards with no specifications

Specifications are labeled “Required” or “Addressable” (164.306(d)). An addressable one must be assessed: implement it if it is reasonable and appropriate; if not, document why and implement an equivalent alternative measure if that is reasonable and appropriate (164.306(d)(3)). It never means optional. Two points get missed:

• A standard with no specifications is itself the requirement. Assigned security responsibility, evaluation, workstation use and workstation security have none, so each applies as written.
• A standard whose specifications are all addressable is still mandatory. Every facility access control specification is addressable, but the standard itself is not. A practice in a shared building can meet it differently from a hospital, but it has to meet it.

For the evidence to keep per specification, use the HIPAA compliance checklist; this guide covers what each standard means, how to classify a control and where OCR has enforced it.

HIPAA administrative safeguards: the nine standards in 164.308

The full text is in 45 CFR 164.308, and HHS’s Security Series paper on administrative safeguards explains each standard.

1. Security management process

Policies “to prevent, detect, contain, and correct security violations,” with four required specifications: risk analysis, risk management, a sanction policy, and information system activity review (regularly reviewing audit logs, access reports and incident tracking reports). Every addressable choice hangs from the risk analysis; our guide to the HIPAA security risk assessment walks through it. Activity review is often the specification that exists only on paper, and a test answers it directly: did anyone notice the tester?

2. Assigned security responsibility

Identify the security official responsible for developing and implementing the Security Rule policies. One named person, documented; a committee can advise but cannot hold the role.

3. Workforce security

Staff get the access their jobs require and nobody else gets any. Three addressable specifications: authorization and/or supervision, a workforce clearance procedure, and termination procedures. Termination is where it fails: the leaver’s EHR account is disabled, but the VPN account, the shared mailbox and the vendor portal login are not. An internal penetration test finds directory and VPN accounts that survived; vendor portals and SaaS logins need an access review against the leaver list.

4. Information access management

Authorize access consistently with the Privacy Rule, which in practice means role-based, minimum necessary access. Isolating health care clearinghouse functions is required where a clearinghouse sits inside a larger organization; access authorization and access establishment and modification are addressable.

5. Security awareness and training

A program “for all members of its workforce (including management),” with four addressable specifications: security reminders, protection from malicious software, log-in monitoring and password management. Completion records prove attendance, not effect. A phishing simulation measures whether training changed behavior.

6. Security incident procedures

One required specification, response and reporting: identify and respond to incidents, mitigate harm where practicable, and document outcomes. A test gives the plan something real to respond to.

7. Contingency plan

Procedures for an emergency that damages ePHI systems; the rule’s examples are “fire, vandalism, system failure, and natural disaster,” and ransomware belongs on that list now. Required: data backup plan, disaster recovery plan, emergency mode operation plan. Addressable: testing and revision procedures, applications and data criticality analysis. A backup policy cannot tell you whether an attacker with domain administrator rights can reach and delete the backups; a ransomware readiness assessment, from $6,000, can.

8. Evaluation

A “periodic technical and nontechnical evaluation” of how well your safeguards meet the rule, repeated after environmental or operational changes. NIST’s HIPAA guide, SP 800-66 Rev. 2 (February 2024), lists penetration testing, where reasonable and appropriate, among the evaluation’s key activities. A penetration test with a retest is direct evidence for the technical part of that evaluation; a physical test does the same for the controls at the door.

9. Business associate contracts

A covered entity may let a business associate handle ePHI only after obtaining “satisfactory assurances,” documented in a written contract or other arrangement (required) that meets 164.314(a), and business associates need the same from their subcontractors. Hospital customers often ask for evidence behind it, such as a penetration test, SOC 2 or HITRUST report (see HITRUST vs SOC 2); our HITRUST penetration testing page covers the testing a HITRUST assessment draws on.

HIPAA physical safeguards: the four standards in 164.310

The text is in 45 CFR 164.310, and HHS’s Security Series paper on physical safeguards explains each one.

1. Facility access controls

Limit physical access to systems and the facilities that house them, “while ensuring that properly authorized access is allowed.” Four addressable specifications:

• Contingency operations: facility access for staff restoring data in an emergency. If the badge system is down, who holds the server room key?
• Facility security plan: protect the facility and equipment “from unauthorized physical access, tampering, and theft.”
• Access control and validation procedures: access by role or function, “including visitor control,” and control of access to software programs for testing and revision.
• Maintenance records: document security-related repairs and modifications to hardware, walls, doors and locks, such as rekeying after a departure.

NIST SP 800-66 Rev. 2 (Section 5.2.1) looks past the data center to wiring closets, storage areas, exam rooms and workstation locations. In a physical test the usual failures are tailgating through a controlled door, a reception desk that badges a plausible story, a proximity badge cloned from a pocket, and a network closet on the same key as the supply room.

2. Workstation use

Policies on what workstations do, how, and “the physical attributes of the surroundings” of those that reach ePHI: registration screens angled away from the waiting room, no ePHI on lobby kiosks, rules for laptops at home.

3. Workstation security

Physical safeguards restricting every ePHI workstation to authorized users: cable locks, locked rooms or carts, privacy screens, placement out of public reach. The quickest physical test finding is the logged-in workstation in an empty office.

4. Device and media controls

Govern hardware and media containing ePHI entering, leaving and moving within a facility:

• Disposal (required): final disposition of ePHI and the hardware or media holding it.
• Media re-use (required): remove ePHI before media are reused.
• Accountability (addressable): a record of hardware and media movements and who is responsible.
• Data backup and storage (addressable): an exact copy of ePHI, when needed, before equipment moves.

HHS’s breach safe harbor guidance treats media cleared, purged or destroyed consistent with NIST SP 800-88 as secured, so proper disposal keeps a discarded drive from becoming a reportable breach. NIST published Revision 2 of SP 800-88 in September 2025. Leased copiers, multifunction printers and imaging equipment often contain drives too, as Affinity Health Plan found.

Outside your own building

A cloud provider, as your business associate, answers for its own data center’s physical safeguards. Remote staff take the workstation with them: a home office is not a facility you control, so workstation policies, device accountability and encryption do the work there.

Which of these is a physical safeguard? A sorting table

Classification is a staple of HIPAA training quizzes and audits. Near the boundary, the section number settles it.

Control	Category	Where it lives
Badge readers and locked doors on rooms with ePHI systems	Physical	164.310(a)(1)
Visitor sign-in, badges and escorts	Physical	164.310(a)(2)(iii)
Privacy screens, screen placement, cable locks	Physical	164.310(b) and (c)
Wiping or destroying drives	Physical	164.310(d)(2)(i) and (ii)
Log of who holds which laptop	Physical	164.310(d)(2)(iii)
Copy of the data before moving a server	Physical	164.310(d)(2)(iv)
Routine backups and restore plan	Administrative	164.308(a)(7)
Security training and password rules	Administrative	164.308(a)(5)
Removing a leaver’s access	Administrative	164.308(a)(3)(ii)(C)
Screen lock after inactivity	Technical	164.312(a)(2)(iii)
Laptop encryption	Technical	164.312(a)(2)(iv)
Multi-factor authentication	Technical	164.312(d)

The traps: the privacy screen is physical but the automatic screen lock is technical; the copy before moving equipment is physical but the backup plan is administrative; and laptop encryption is technical even though the risk it answers is mostly theft.

What OCR has penalized

Four settlements whose facts map to administrative and physical standards:

Case	What happened	Safeguards at issue	Amount
Affinity Health Plan, 2013	Leased photocopiers returned with unerased hard drives holding ePHI of up to 344,579 people; the drives were missing from the risk analysis	Device and media controls, risk analysis	$1,215,780
Pagosa Springs Medical Center, 2018	A former employee kept access to a web-based calendar holding 557 patients’ ePHI; no business associate agreement with the vendor	Termination procedures, business associate contracts (cited by OCR as impermissible disclosures, 164.502(a))	$111,400
Lifespan, 2020	Unencrypted laptop stolen from an employee’s car; no policy to encrypt or inventory all work devices	Device and media controls, encryption	$1,040,000
Lafourche Medical Group, 2023	Phishing opened an owner’s mailbox, affecting about 34,862 people; no risk analysis and no procedures to review system activity	Security management process	$480,000

HHS announced Lafourche as OCR’s first-ever settlement of a phishing attack investigation. None needed a sophisticated exploit; a walk-through, an access review or a test would have surfaced each gap.

How Invadel tests these safeguards, and what it costs

A policy shows a safeguard was designed; a test shows whether it works, which is what the evaluation standard asks. Prices are published starting prices, fixed in writing from your scope with no sales call, and every penetration test includes a free retest of remediated findings (phishing, with nothing to retest, is the exception).

Safeguard	What a test shows	Test, from
Facility access, workstation and device controls, 164.310	Whether an outsider gets in, reaches the server room or a network closet, and plants a device unnoticed	Physical penetration test, $6,800
Security awareness and training, 164.308(a)(5)	Click, credential-submission and reporting rates by department	Phishing simulation, $3,600
Workforce security and access management, 164.308(a)(3) and (4)	Stale and over-privileged accounts, and paths from one user to domain administrator	Internal network penetration test, $6,000
Contingency plan, 164.308(a)(7)	Whether an attacker could reach and destroy the backups	Ransomware readiness assessment, $6,000
Activity review and incident procedures, 164.308(a)(1) and (a)(6)	Whether anyone noticed and escalated a realistic attack	Red team engagement, $12,500 (red team pricing)

The physical test covers one NYC-metro office of up to about two floors: two operators, up to three days on site under a signed authorization letter, no forced entry or damage, photo evidence, and a free re-check of the doors, readers or procedures you fix. A guarded building or two nearby sites starts at $10,500 with an after-hours attempt; sites outside the metro are quoted. In clinics, the rules of engagement name off-limits areas such as patient rooms and treatment spaces. Adding voice (vishing) or SMS to a phishing campaign, which tests the help desk’s reset procedure, starts at $5,500. Our physical security assessment checklist lists checks to run yourself first, and the pricing calculator totals several tests.

What we do not do: write policies, act as your security official, own your risk analysis, run incident response, or certify you. There is no official HIPAA certification, as our HIPAA compliance checklist explains. We supply findings mapped to the Security Rule, retest results and an attestation letter; for the systems that hold ePHI, see HIPAA penetration testing. For the wider budget, see HIPAA compliance cost.

New York general hospitals have a state rule on top of these safeguards. 10 NYCRR 405.46 requires penetration testing by a qualified internal or external party at least annually, a designated CISO and notice to the Department of Health within 72 hours of determining a cybersecurity incident occurred, and it accepts a risk assessment performed for HIPAA if it meets the section’s requirements. Our New York hospital cybersecurity regulation page maps the testing to it.

What the proposed Security Rule would change

On January 6, 2025, HHS proposed a rewrite of the Security Rule (90 FR 898) that would drop the required and addressable labels. For these safeguards, the proposed text would:

• Add standards for a technology asset inventory and network map, patch management (critical risks within 15 calendar days, high within 30) and a compliance audit every 12 months.
• Terminate a leaver’s access within one hour, and notify other regulated entities within 24 hours of a change in a workforce member’s access to their systems.
• Train new staff within 30 days of first access and everyone every 12 months, including on social engineering.
• Require written procedures to restore critical systems and data within 72 hours, and test contingency plans every 12 months.
• Require annual written verification from each business associate that its technical safeguards are in place.
• Review and test facility procedures for each facility every 12 months, and extend workstation policies to moving workstations outside the facility.
• Rename device and media controls technology asset controls, with media sanitized so ePHI “cannot be recovered.”

As of November 2026 it is still a proposal. An earlier regulatory agenda targeted May 2026, which passed; the 2026 Unified Agenda lists it as a long-term action, with final action projected for July 2027 (reginfo.gov, RIN 0945-AA22). OCR enforces the current rule, but an annual duty to test facility procedures is exactly what a physical test evidences.

Frequently asked questions

What are physical safeguards under HIPAA? Physical measures, policies and procedures that protect electronic information systems and the related buildings and equipment from natural and environmental hazards and unauthorized intrusion (45 CFR 164.304). The four standards in 164.310 are facility access controls, workstation use, workstation security, and device and media controls.

What are the HIPAA administrative safeguards? The administrative actions, policies and procedures that manage security measures and workforce conduct around ePHI: nine standards in 164.308, from the risk analysis through training, contingency planning and evaluation to business associate contracts.

Which of the following is a physical safeguard under HIPAA: a locked server room, a password policy, or encryption? The locked server room, a facility access control under 164.310(a). A password policy is administrative and encryption is technical. Visitor logs, privacy screens, cable locks and drive destruction are physical too.

Which action is an administrative safeguard? Of the usual quiz options, educating employees on security policies and procedures: that is the security awareness and training standard, 164.308(a)(5). Limiting physical access to the facility is a physical safeguard (164.310(a)). Antivirus software is a technical measure, although the procedures and training for guarding against malicious software sit in that same administrative standard.

How many HIPAA administrative safeguards are there? Nine standards in 164.308, with 21 implementation specifications between them: 10 required and 11 addressable. Two of the nine, assigned security responsibility and evaluation, have no specifications and apply as written.

Who is responsible for physical safeguards in a shared building? You are, for your own space and equipment. The facility access controls standard applies to the covered entity or business associate whatever the landlord provides, so a small practice in a shared office documents what the building supplies (a staffed lobby, a badge system) and controls the rest itself: the suite door, who holds keys, where the server or network closet sits, and how visitors are escorted.

Are HIPAA physical safeguards required or addressable? All four standards must be met. Of the eight specifications, disposal and media re-use are required and six are addressable. Workstation use and workstation security have no specifications, so they apply as written.

Does HIPAA require a physical penetration test? No. The rule requires a periodic technical and nontechnical evaluation and names no method. A physical test is the most direct evidence that facility and workstation controls work, and the proposed update would require facility procedures to be tested every 12 months.

The short version

Physical safeguards are the four 164.310 standards protecting buildings, workstations and media; administrative safeguards are the nine 164.308 standards that run the program. Both are judged on whether they work, and OCR’s settlements turn on the gap between policy and practice. To test your office at a fixed price, with a free re-check of the controls you fix, see physical penetration testing and its published pricing, or scope an engagement.