HIPAA Physical Safeguards: What's New and How to Prepare
Oct 16, 2026
The proposed HIPAA Security Rule requires written policies and 12-month reviews. Use our 2013-to-2027 crosswalk to find gaps in your physical safeguards.
Read More
10 min Read
The Department of Health and Human Services (the Department) published a notice of proposed rulemaking (NPRM) on January 6, 2025, to modify the HIPAA Security Rule. The Office of Management and Budget (OMB) currently lists a Final Action date of July, 2027. This would provide regulated entities 240 days to comply with the updated requirements. The Department proposes expanding 45 CFR 164.310 language to clarify physical safeguards apply throughout regulated entities' facilities. The Department also proposes to connect this section to the documentation requirements from CFR 164.306 and 45 CFR 164.316.
The purpose of this blog is to:
The table above highlights only a fraction of the proposed updates. To view the complete mapping of all Administrative, Technical, and Physical safeguards, download our full HIPAA Security Rule Crosswalk 2013 to 2027 Spreadsheet.
The Department proposes modifying the facility access controls standard to encompass physical access for all relevant systems and facilities which house those systems. Regulated entities must also implement written policies and procedures to satisfy the requirements.
The Department proposes five implementation specifications for the facility access controls standard. Regulated entities achieve the standard by satisfying the underlying implementation specifications.
The Department revised contingency operations implementation specification requiring that written procedures support the contingency plan. The previous requirement limited the scope to restoring lost data in the event of an emergency. The updated requirements expand the scope for written facility access procedures to support the broader contingency plan.
The updated facility security plan implementation specification requires written policies and procedures to safeguard all facilities and the equipment therein. This modification expands the scope to all facilities and equipment contained within those facilities.
The Department renamed the access control and validation procedures implementation specification access management and validation procedures. The proposed update requires implementing written procedures authorizing and managing role-based facility access.
The Department renamed the maintenance implementation specification physical maintenance records. The proposed update requires written procedures documenting repairs and modifications to physical protection components. The addition of security cameras as an example of a physical security component is illustrative, not restrictive.
A new maintenance implementation specification requires reviewing and testing written policies and procedures at least every 12 months for each facility. Regulated entities should modify policies and procedures as appropriate based on the reviews.
The standard for Workstation use was modified to clarify that policies and procedures established by a regulated entity to govern the use of workstations be in writing and address all workstations that access ePHI or the regulated entity's relevant electronic information systems.
A new implementation specification requires regulated entities to establish and implement written policies and procedures that specify the physical attributes of workstation surroundings, including the removal of workstations from a facility and the movement of workstations within and outside of a facility.
A new implementation specification for maintenance requires regulated entities to review and test written policies and procedures at least once every 12 months, and to modify those policies and procedures as reasonable and appropriate based on that review.
The standard for Workstation security was modified to require regulated entities to establish, implement and modify as needed, written policies and procedures for workstation use covering workstations that access ePHI and relevant electronic information systems. The Department encourages regulated entities to consider, among other things, whether there are workstations located in public areas or other areas that are more vulnerable to theft, unauthorized use, or unauthorized viewing; whether such devices should be relocated; the physical security controls for workstations that are in use (e.g. cable locks, privacy screens, secured rooms, cameras) and whether they are easy to use; and whether there are additional physical security controls that could reasonably be put into place.
The standard for Device and media controls was renamed Technology asset controls and modified to include technology assets to more accurately capture the various categories of components of a regulated entity's relevant electronic information systems that may be received in, removed from, or moved within a facility and that also affect the confidentiality, integrity, or availability of ePHI.
The implementation specifications for accountability and data backup and storage were removed and replaced by the proposed standard for technology asset inventory §164.308(a)(1)(i) and data backup §164.308(a)(13)(ii)(B).
The implementation specification for disposal was modified to require that written policies and procedures for disposal of ePHI be tied to current standards and applied more broadly to include the technology assets on which it is maintained.
The implementation specification for Media re-use was renamed media sanitization and modified to require that written policies and procedures for sanitization of electronic media ensure that ePHI cannot be recovered, based on current standards, before the media is made available for reuse.
A new implementation specification for maintenance would require a regulated entity to review and test the written policies and procedures related to the implementation specifications for technology assets at least once every 12 months or in response to environmental or operational changes, whichever is more frequent, and modify as reasonable and appropriate.
We created this crosswalk resource by reading through each proposed standard and implementation specification. The Department often identified corresponding safeguards from the current Security Rule. We prompted Gemini to evaluate the nature of the relationship between the related concepts using the Supportive Relationship mapping style. This process determined whether supporting concepts from 2013 requirements satisfied the updated 2027 requirements. The resource contains the results of this analysis within the column H.
Other supporting columns include:
The proposed HIPAA Security Rule update would change how regulated entities approach physical safeguards. Many 2013 requirements, including facility security plans, workstation use, and device and media controls, remain in some form. But the proposed rule requires written policies and procedures, applies them to all facilities and relevant workstations and technology assets, and adds a recurring maintenance requirement to review and test those policies at least every 12 months. As the crosswalk shows, most 2013 provisions only partially satisfy their 2027 counterparts. Organizations that rely on informal practices or “as needed” reviews will likely find gaps.
With OMB listing a final action date of July 2027 and a proposed 240-day compliance window, the time to start is now, not when the final rule publishes. A practical first step is a gap analysis that maps your existing policies, procedures, and documentation to the proposed requirements, identifies what is missing or undocumented, and prioritizes remediation.
K2 GRC can help you get there. Our HIPAA Security Rule Crosswalk 2013 to 2027 Spreadsheet gives you a starting point, covering the Administrative, Technical, and Physical safeguards.
Within the K2 GRC platform, you can go further:
To get started, download the full crosswalk or contact K2 GRC to see how the platform can support your preparation.
