Physical Security for systems containing EPHI An important step in protecting electronic protected health information (EPHI) is to implement reasonable and appropriate physical safeguards for information systems and related equipment and facilities. In order to do so, it is necessary to have a proper inventory of all physical devices and properly secure access to areas where any equipment reside. Partners HealthCare information systems containing EPHI must be physically located in areas where unauthorized access is minimized. [Ref. Policy, Ref. Inventory] PH-529 Facility Security Plan 1.0: All physical access rights to Partners HealthCare areas where information systems containing EPHI are maintained must be clearly defined and documented. Such rights must be provided only to Partners HealthCare workforce members having a need for specific access in order to accomplish the responsibilities of their positions. All physical access rights to Partners HealthCare areas where information systems containing EPHI are maintained must be regularly reviewed and revised as necessary. All Partners HealthCare workforce members must visibly wear the organization’s employee identification. Employees should be encouraged to report unescorted strangers or anyone not wearing visible identification. Some common controls to prevent unauthorized physical access, tampering, and theft that covered entities may want to consider include: Locked doors, signs warning of restricted areas, surveillance cameras, alarms Property controls such as property control tags, engraving on equipment Personnel controls such as identification badges, visitor badges and/or escorts for large offices Institution security service or patrol for the facility Reference: Security Standards: Physical Safeguards Workstation Security Device and Media controls Paper
Physical Security for systems containing EPHI An important step in protecting electronic protected health information (EPHI) is to implement reasonable and appropriate physical safeguards for information systems and related equipment and facilities. In order to do so, it is necessary to have a proper inventory of all physical devices and properly secure access to areas where any equipment reside. Partners HealthCare information systems containing EPHI must be physically located in areas where unauthorized access is minimized. [Ref. Policy, Ref. Inventory] PH-529 Facility Security Plan 1.0: All physical access rights to Partners HealthCare areas where information systems containing EPHI are maintained must be clearly defined and documented. Such rights must be provided only to Partners HealthCare workforce members having a need for specific access in order to accomplish the responsibilities of their positions. All physical access rights to Partners HealthCare areas where information systems containing EPHI are maintained must be regularly reviewed and revised as necessary. All Partners HealthCare workforce members must visibly wear the organization’s employee identification. Employees should be encouraged to report unescorted strangers or anyone not wearing visible identification. Some common controls to prevent unauthorized physical access, tampering, and theft that covered entities may want to consider include: Locked doors, signs warning of restricted areas, surveillance cameras, alarms Property controls such as property control tags, engraving on equipment Personnel controls such as identification badges, visitor badges and/or escorts for large offices Institution security service or patrol for the facility Reference: Security Standards: Physical Safeguards Workstation Security Device and Media controls Paper
Physical%20Security%20for%20systems%20containing%20EPHI%20Fact%20Sheet.docx