--- title: "Data Security Guidance: What are the HIPAA Security Rule Physical Safeguards? Workstation Security Controls" description: Compliancy Group Help Center --- [Skip to content](https://knowledge.compliancygroup.com/home/support/solutions/articles/48001252975-what-are-the-hipaa-security-rule-physical-safeguards-workstation-security-controls#main-content) English - United States Show submenu for translations [Submit a Ticket](https://knowledge.compliancygroup.com/home/kb-tickets/new?hsLang=en-us) [Go To Customer Portal](https://help.compliancygroup.com/home?hsLang=en-us) ![Compliancy Group](https://knowledge.compliancygroup.com/hs-fs/hubfs/Compliancy%20Group%20Logo%20Full%20RBG-sized.png?width=300&height=54&name=Compliancy%20Group%20Logo%20Full%20RBG-sized.png) Open main navigation Close main navigation - English - United States Show submenu for translations - [Submit a Ticket](https://knowledge.compliancygroup.com/home/kb-tickets/new) - [Go To Customer Portal](https://help.compliancygroup.com/home) How can we help you? - There are no suggestions because the search field is empty. 1. [Help Center](https://knowledge.compliancygroup.com/home?hsLang=en-us) 2. [Healthcare Compliance](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us) 3. [Data Security](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#data-security) # Data Security Guidance: What are the HIPAA Security Rule Physical Safeguards? Workstation Security Controls **DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.** **Introduction** The HIPAA Security Rule requires covered entities and business associates to develop and implement a series of administrative, technical, and physical safeguards to protect ePHI. The required physical safeguards consist of four standards. These [standards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.310) include: 1\. Facility Access Controls 2\. Workstation Use 3\. Workstation Security 4\. Device and Media Controls This article covers the third of these four standards, "[Workstation Security](https://www.ecfr.gov/current/title-45/part-164/section-164.310#p-164.310(c))." The Workstation Security standard requires covered entities and business associates to "Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users." The standard covers both facilities as well as offsite workstations that can access ePHI, including teleworker workstations. **How Can the Workstation Security Standard be Implemented?** The Workstation Security standard is similar to the [Workstation Use](https://compliancygroup.freshdesk.com/support/solutions/articles/48001252974-what-are-the-hipaa-security-rule-physical-safeguards-workstation-use-controls) standard. Both require the protection of workstations. However, while the [Workstation Use standard](https://compliancygroup.freshdesk.com/support/solutions/articles/48001252974-what-are-the-hipaa-security-rule-physical-safeguards-workstation-use-controls) addresses the policies and procedures for how workstations should be *used and protected,* the Workstation Security standard requires the workstation to be physically protected from *unauthorized users*. Covered entities and business associates may implement a variety of strategies to restrict access to workstations with ePHI to prevent unauthorized use  One way may be to completely restrict physical access to a secure room where only authorized personnel work. This action physically protects the workstations from [unauthorized users](https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/physsafeguards.pdf).  Per [HHS guidance](https://www.hhs.gov/sites/default/files/cybersecurity-newsletter-may-2018-workstation-security.pdf), workstation security measures, including offsite worksite security measures (e.g., measures for telecommuters), can include the following:  1\. Using privacy screens to prevent someone from viewing computer screens. 2\. Using cable locks to deter theft. 3\. Installing port and device locks that physically restrict access to USB ports or devices such as CD/DVD drives. This third measure is of particular importance, as unrestricted access to USB ports and removable media devices can facilitate the unauthorized copying of data to removable media. Unrestricted access to removable media devices means access to devices that might be infected with malicious software that can propagate. 4\. Positioning workstation screens away from areas from which they could be viewed. 5\. Keeping electronic equipment and media in secured areas, including locked rooms. 6\. Deploying HIPAA-compliant security cameras, and posting signs accordingly. 7\. Using security guards. - [Getting started](https://knowledge.compliancygroup.com/home/getting-started?hsLang=en-us#main-content) - [Onboarding](https://knowledge.compliancygroup.com/home/getting-started?hsLang=en-us#onboarding) - [Product Overviews](https://knowledge.compliancygroup.com/home/getting-started?hsLang=en-us#product-overviews) - [Workforce](https://knowledge.compliancygroup.com/home/workforce?hsLang=en-us#main-content) - [Policies](https://knowledge.compliancygroup.com/home/workforce?hsLang=en-us#policies) - [Settings Module](https://knowledge.compliancygroup.com/home/workforce?hsLang=en-us#settings-module) - [3rd Party Risk](https://knowledge.compliancygroup.com/home/3rd-party-risk?hsLang=en-us) - [Incident Management](https://knowledge.compliancygroup.com/home/incident-management?hsLang=en-us) - [Risks & Assessments](https://knowledge.compliancygroup.com/home/risks-assessments?hsLang=en-us) - [Healthcare Compliance](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#main-content) - [Privacy](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#privacy) - [Data Security](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#data-security) - [OSHA Workplace Safety](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#osha-workplace-safety) - [Clinical & Quality](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#clinical-quality) - [State Requirements](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#state-requirements) - [Fraud, Waste & Abuse](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#fraud-waste-abuse) - [Compliance Operations](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#compliance-operations) - [Legacy Guard Features](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#main-content) - [Admin - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#admin-legacy) - [Assets - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#assets-legacy) - [Documents - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#documents-legacy) - [Incidents - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#incidents-legacy) - [My Documents - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#my-documents-legacy) - [My Tasks - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#my-tasks-legacy) - [People - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#people-legacy) - [Programs - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#programs-legacy) - [Reports - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#reports-legacy) - [The Dashboard - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#the-dashboard-legacy) - [Training - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#training-legacy) - [Vendors - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#vendors-legacy) - [Account & Billing](https://knowledge.compliancygroup.com/home/account-billing?hsLang=en-us) - [The Guard Support](https://knowledge.compliancygroup.com/home/the-guard-support?hsLang=en-us#main-content) - [P&P Drafts](https://knowledge.compliancygroup.com/home/the-guard-support?hsLang=en-us#pp-drafts) - [Settings](https://knowledge.compliancygroup.com/home/the-guard-support?hsLang=en-us#settings) [![compliancy-group-logo-white](https://knowledge.compliancygroup.com/hs-fs/hubfs/compliancy-group-logo-white.png?width=200&height=37&name=compliancy-group-logo-white.png "compliancy-group-logo-white")](http://compliancy-group.com) Contact Us - [support@compliancygroup.com](mailto:support@compliancygroup.com) Copyright © 2026, Compliancy Group LLC Cookie Settings