HIPAA physical safeguards for small practices

By ComplyCreate Research Team  ·  Published Oct 4, 2026  ·  Last reviewed Oct 4, 2026

Most HIPAA guidance for small practices is about software: encryption, passwords, which vendors sign a BAA. The physical office gets less attention. It is still covered by the rules, and it is where a lot of everyday exposure happens. A chart left on the front desk overnight, a monitor facing the waiting room, or a recycling bin full of intake forms is a physical safeguards problem.

This guide covers what the rules require, what a small practice should do about it, and how to handle the people who are in your office when you are not.

What the rules say

Two parts of HIPAA apply to the physical office.

1. The Privacy Rule requires covered entities to have "appropriate administrative, technical, and physical safeguards" to protect PHI in any form, including paper and spoken information (45 CFR 164.530(c)).
2. The Security Rule sets physical safeguards for electronic PHI (45 CFR 164.310). It has four standards.

"Addressable" does not mean optional. It means you assess whether the specification is reasonable for your practice, implement it if it is, and document an equivalent measure or your reasoning if it is not.

The Privacy Rule also allows incidental disclosures, as long as you have reasonable safeguards in place and follow the minimum necessary standard (45 CFR 164.502(a)(1)(iii)). A patient overhearing a name called in the waiting room is incidental. A stack of lab results left on an unattended counter is not, because a reasonable safeguard would have prevented it.

The front desk and waiting room

The front desk is where paper PHI and patients are closest together.

1. Position monitors so patients at the counter cannot read them. Use privacy filters where repositioning is not possible.
2. Keep sign-in sheets limited to what you need. A name and arrival time is enough. Do not ask patients to write the reason for the visit on a shared sheet.
3. Do not leave charts, faxes, or printed schedules face-up on the counter.
4. Lock screens when staff step away. A short auto-lock timer is the simplest control.

Paper records

Paper is where small practices most often fall short.

1. Store charts in locked cabinets or a locked room when the office is closed.
2. Put a lidded, locked shred bin near every printer and fax machine. Paper PHI should never go in regular trash or recycling.
3. Use a shredding vendor that provides a certificate of destruction. A shredding vendor handles PHI as part of the job, so it likely is a business associate and needs a BAA. See Does your cleaning company need a BAA? for how HHS draws that line.

Devices and disposal

The device and media controls standard has two required specifications: disposal and media re-use.

1. Keep an inventory of devices that store ePHI. That includes computers, external drives, and copiers or multifunction printers with internal hard drives.
2. Wipe or destroy storage before a device leaves the office for resale, recycling, or a lease return. Get written confirmation.
3. Record who has each portable device and when it moves.

After-hours access

Many small practices never write down who can enter the office after closing. That list usually includes a landlord or building manager, an IT contractor, a maintenance or HVAC technician, and a cleaning crew.

Facility access controls ask you to know who can get in and to limit access to what each person needs. For a small office, that means the following.

1. Keep a written list of everyone with a key, code, or badge. Update it when staff or vendors change.
2. Give vendors their own access codes so entries can be traced to a person or company.
3. Change codes and collect keys when a vendor relationship ends.
4. Keep maintenance records for repairs to locks, doors, and alarm systems. This is one of the addressable specifications under 164.310(a).
5. Lock the rooms and cabinets that hold paper records before leaving for the day.

Cleaning crews

Janitorial staff are in the office more often than any other outside vendor, usually when no one from the practice is there. HHS says a routine janitorial service is generally not a business associate, because any contact with PHI while cleaning is incidental (HHS FAQ 243). That does not remove the practice's duty to have reasonable safeguards around the crew.

Practical steps:

1. Put a confidentiality clause in the cleaning contract. It should say the crew will not read, copy, photograph, move, or remove documents or devices.
2. Ask how the crew is trained to work around patient information. A cleaning company that works in medical offices and treatment rooms should be able to describe its policy in plain terms, for example cleaning around paperwork without reading or repositioning it.
3. Keep shred bins locked so the crew never handles their contents. Tell the crew that shred bins are not trash.
4. Make sure the crew uses its own access code, not a shared staff code.
5. Write down what changes if the scope grows. If the cleaning company starts handling records, shredding, or devices that hold ePHI, its access is no longer incidental, and you need a BAA.

Cleaning in a clinical space also falls under OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030), which is separate from HIPAA. It requires the practice to keep a written cleaning schedule and decontamination methods for areas that may be contaminated. Ask your cleaning vendor whether its staff have bloodborne pathogen training.

A one-page checklist

1. Monitors at the front desk are not readable from the patient side.
2. Sign-in sheets collect only name and arrival time.
3. Charts and paper PHI are locked away at close.
4. Every printer and fax has a locked shred bin nearby.
5. The shredding vendor has a signed BAA and provides certificates of destruction.
6. A device inventory exists, and storage is wiped before devices leave.
7. A written list of everyone with after-hours access is current.
8. Each vendor has its own access code.
9. The cleaning contract has a confidentiality clause.
10. Facility repairs to locks and doors are logged.

Frequently asked questions

Does HIPAA require a locked office?

HIPAA does not name specific locks or hardware. It requires reasonable physical safeguards. For most practices that means locked storage for paper records and limited, tracked access to the space after hours.

Are physical safeguards only about electronic records?

No. The Security Rule's physical safeguards cover ePHI. The Privacy Rule's safeguards requirement covers PHI in every form, including paper charts and printed schedules.

Do I need a BAA with my landlord or cleaning company?

Usually not. HHS treats routine building access and janitorial work as incidental contact with PHI. A vendor that handles records, shreds documents, or services devices that hold ePHI likely does need one.

What should I document?

Document your access list, your device inventory, your disposal records, and your reasoning for any addressable specification you did not implement as written.

Sources

1. 45 CFR 164.310, Physical safeguards. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.310
2. 45 CFR 164.530(c), Safeguards. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530
3. HHS FAQ 243, business associate contracts and incidental contact with PHI. https://www.hhs.gov/hipaa/for-professionals/faq/243/is-a-business-associate-contract-required-for-inadvertent-contact-with-phi/index.html
4. OSHA Bloodborne Pathogens Standard, 29 CFR 1910.1030. https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.1030