[{"data":1,"prerenderedAt":114},["ShallowReactive",2],{"guide-hipaa-physical-safeguards-clinic-design-en-US":3},{"guide":4,"related":97},{"title":5,"seoTitle":6,"description":7,"summary":8,"sections":9,"faq":60,"cta":67,"date":69,"updated":69,"service":70,"order":71,"sources":72,"slug":95,"locale":96},"Designing a clinic around HIPAA physical safeguards","HIPAA Office Layout: Cameras, Locks, Network Closet","How door hardware, cameras, workstation placement, a secure network closet and separated networks in a NYC clinic support the HIPAA Security Rule.","HHS does not certify buildings, products or rooms under the Security Rule, and it does not recognize private certifications of compliance. What a build-out can do is support the practice's physical safeguards under 45 CFR 164.310: controlled doors, a locked and cooled network closet, workstations out of public view, cameras aimed where they belong and cabling for separated networks. These decisions are fixed when the walls close, so they belong in the plan before drywall.",[10,38,44,49,54],{"heading":11,"paragraphs":12,"table":14,"after":36},"What 45 CFR 164.310 covers",[13],"The Security Rule's [physical safeguards](https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F45\u002F164.310) consist of four standards. Some implementation specifications are required. [Others are addressable](https:\u002F\u002Fwww.hhs.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Focr\u002Fprivacy\u002Fhipaa\u002Fadministrative\u002Fsecurityrule\u002Fphyssafeguards.pdf), which means the practice assesses whether each is reasonable and appropriate for its office and documents the decision. The building touches all four.",{"caption":15,"head":16,"rows":20},"Physical safeguard standards and the build-out",[17,18,19],"Standard","Implementation specifications","What the build-out provides",[21,25,29,32],[22,23,24],"Facility access controls, 164.310(a)","Contingency operations, facility security plan, access control and validation procedures, maintenance records (all addressable)","A zoned suite, electrified locks and credential readers, entry logs, and records of changes to doors, locks and walls",[26,27,28],"Workstation use, 164.310(b)","No separate specifications","Front desk and exam room layouts that keep screens out of public view",[30,27,31],"Workstation security, 164.310(c)","Cable locks, lockable CPU mounts, printers and fax machines outside the waiting room",[33,34,35],"Device and media controls, 164.310(d)","Disposal and media re-use (required); accountability, data backup and storage (addressable)","Locked storage for retired drives and laptops, and a secured location for copiers with hard drives",[37],"A quote that presents a product or a room as certified for HIPAA describes [a certification HHS does not issue](https:\u002F\u002Fwww.hhs.gov\u002Fguidance\u002Fdocument\u002Ffaq-2003-are-we-required-certify-our-organizations-compliance-standards). Compliance is the practice's program: its risk analysis, policies, training and business associate agreements. The design supports that program and cannot replace it.",{"heading":39,"paragraphs":40},"Doors, readers and the network closet",[41,42,43],"We divide the suite into public, semi-public, clinical and restricted zones. Credential readers go on the restricted rooms, which are typically the network closet, records storage and the medication room. The access control system logs entries, which supports access validation, and the practice keeps a record of repairs and changes to doors, locks, walls and hardware, which is the maintenance records specification.","Egress comes first. Access control never prevents free exit, and magnetic locks on egress doors need a code-compliant release, usually a motion sensor and push button with release on fire alarm. Whether each door fails secure or fails safe when power is lost is settled with the architect under the building code, and the practice's contingency plan should state how staff will enter the suite and the closet during an outage.","In older buildings the network closet often ends up in a janitor's closet with a slop sink and no cooling. We plan it as a room: lockable, on a dedicated circuit, with exhaust or a ductless split system, and with space for the camera recorder, which belongs inside it. For practices that host their EMR and data on site, we build [dedicated server rooms](\u002Fguides\u002Fmedical-office-server-room-emr).",{"heading":45,"paragraphs":46},"Workstations and the front desk",[47,48],"The counter design sets the monitor orientation at check-in. Screens face staff and away from the waiting room, privacy filters cover what the angle cannot, and the accessible counter section required by ADA Standards 904.4 is located where it does not expose a screen. Kiosks, printers and fax machines go where patients cannot read their output.","In exam rooms the provider's computer faces the patient and sits away from the door and any window. Laptops need a check-out shelf or a lockable cabinet.",{"heading":50,"paragraphs":51},"Where cameras belong",[52,53],"Cameras serve entrances, the waiting room, the patient side of the front desk, and the doors of the medication room and network closet. They have no place in exam rooms, treatment areas, restrooms or changing areas, and [New York General Business Law 395-b](https:\u002F\u002Fwww.nysenate.gov\u002Flegislation\u002Flaws\u002FGBS\u002F395-B) prohibits devices used to surreptitiously view restrooms, toilets, bathrooms, washrooms, showers and fitting rooms.","A camera aimed at the front desk for safety often records the screens and the sign-in sheet, so we aim it at the patient side of the counter instead. Audio is a separate legal question. Under [New York Penal Law 250.00](https:\u002F\u002Fwww.nysenate.gov\u002Flegislation\u002Flaws\u002FPEN\u002F250.00) and 250.05, mechanical overhearing of a conversation without the consent of at least one party, by a person not present, is eavesdropping, a class E felony. We install video-only systems in public areas unless the practice's counsel approves audio. Retention periods and who may view recordings are policy decisions for the practice.",{"heading":55,"paragraphs":56},"Separated networks and sound privacy",[57,58,59],"The [HHS 405(d) program](https:\u002F\u002Fhhscyber.hhs.gov\u002FDocuments\u002FHICP\u002Ftech-vol1-508.pdf) advises small health care organizations to keep guest Wi-Fi internet-only and separate from the staff network. A clinic usually needs four segments: clinical systems, staff business systems, guest Wi-Fi, and building systems such as cameras, access control, HVAC controls and vaccine temperature loggers. Building devices placed on the clinical network are a familiar weak point. Amendments to the Security Rule proposed on January 6, 2025 would make network segmentation an explicit requirement, and the practice's IT provider should check their current status in the Federal Register.","The building's share is physical: enough data drops, separate patch fields, labeled cabling and [a conduit path for a second internet provider](\u002Fguides\u002Finternet-service-entrance-planning). Configuring VLANs, accounts, logging and backups is the work of the practice's IT or managed service provider, and we coordinate the rough-in to their design.","Sound privacy is part of reasonable safeguards as well. Hollow-core doors with deep undercuts carry more conversation than the walls do. Exam and consult rooms receive solid-core doors and insulated partitions, and consult rooms receive walls built full height to the deck.",[61,64],{"q":62,"a":63},"Can a medical office put security cameras in exam rooms?","Cameras should stay out of exam rooms, treatment areas, restrooms and changing areas. General Business Law 395-b prohibits surreptitious viewing of restrooms and similar rooms, and recording patients during care raises privacy questions for the practice's counsel. Entrances, the waiting room and the doors of restricted rooms are the appropriate locations.",{"q":65,"a":66},"Who is responsible for HIPAA compliance in a new clinic?","The practice. The contractor installs doors, hardware, devices and cabling to the plan. The IT or managed service provider configures networks, accounts, logging and backups. The practice performs the risk analysis, writes policies, trains staff and signs business associate agreements.",{"text":68},"Send your floor plan, the rooms you want restricted and your IT provider's network design or contact. We return, at no charge, an access-control and camera plan with readers, cameras and data drops marked on your floor plan, and a written estimate for [the low-voltage rough-in before drywall](\u002Fservices\u002Flow-voltage).","2026-10-25","healthcare",121,[73,77,81,84,88,92],{"title":74,"url":75,"publisher":76},"45 CFR § 164.310 - Physical safeguards","https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F45\u002F164.310","Cornell Law School, Legal Information Institute",{"title":78,"url":79,"publisher":80},"HIPAA Security Series: Security Standards: Physical Safeguards","https:\u002F\u002Fwww.hhs.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Focr\u002Fprivacy\u002Fhipaa\u002Fadministrative\u002Fsecurityrule\u002Fphyssafeguards.pdf","U.S. Department of Health and Human Services",{"title":82,"url":83,"publisher":80},"Are we required to certify our organization's compliance with the standards?","https:\u002F\u002Fwww.hhs.gov\u002Fguidance\u002Fdocument\u002Ffaq-2003-are-we-required-certify-our-organizations-compliance-standards",{"title":85,"url":86,"publisher":87},"Technical Volume 1: Cybersecurity Practices for Small Health Care Organizations","https:\u002F\u002Fhhscyber.hhs.gov\u002FDocuments\u002FHICP\u002Ftech-vol1-508.pdf","HHS 405(d) Program",{"title":89,"url":90,"publisher":91},"General Business Law 395-B","https:\u002F\u002Fwww.nysenate.gov\u002Flegislation\u002Flaws\u002FGBS\u002F395-B","New York State Senate",{"title":93,"url":94,"publisher":91},"Penal Law 250.00","https:\u002F\u002Fwww.nysenate.gov\u002Flegislation\u002Flaws\u002FPEN\u002F250.00","hipaa-physical-safeguards-clinic-design","en-US",[98,102,106,110],{"slug":99,"title":100,"description":101,"service":70,"date":69,"updated":69},"clinic-lease-checklist-nyc-long-island","Before you sign a clinic lease in NYC or Long Island","What to settle before leasing clinic space in NYC or Long Island: occupancy, Article 28, the certificate of occupancy and what the building can supply.",{"slug":103,"title":104,"description":105,"service":70,"date":69,"updated":69},"clinic-backup-power-vaccine-network","Keeping a clinic open through a power or network outage","Vaccine refrigerator outlets, UPS and generator options, a critical-load panel, internet failover and HVAC redundancy for NYC and Long Island clinics.",{"slug":107,"title":108,"description":109,"service":70,"date":69,"updated":69},"clinic-ventilation-filtration-nyc","Clinic ventilation and filtration in NYC and Long Island","What NYC and Long Island codes require for clinic ventilation, where ASHRAE 170 applies, MERV 13 vs HEPA, waiting-room pressure and filter access.",{"slug":111,"title":112,"description":113,"service":70,"date":69,"updated":69},"clinic-flooring-finishes-antimicrobial","Clinic flooring, wall protection and antimicrobial labels","Medical office flooring in NYC and Long Island: sheet vinyl with integral cove, DCOF slip ratings, wall protection, and what antimicrobial labels may claim.",1792938766784]