What Is the Physical Site Audit?

The Physical Site Audit is a structured walkthrough of your facility to evaluate your compliance with HIPAA's Physical Safeguards requirements (45 CFR § 164.310). Unlike the SRA which covers policies and technical controls, the physical audit focuses on what you can see and touch — the physical environment where PHI is created, accessed, or stored.

Physical safeguards are one of the most commonly overlooked areas of HIPAA compliance. Breaches caused by stolen laptops, unsecured workstations, unauthorized visitors viewing screens, and improper device disposal are all preventable with proper physical controls.

Completing the Audit in the Portal

Navigate to Physical Site Audit from your Privacy Officer dashboard (under the Audit section). The audit is organized into sections that mirror your facility's physical areas. For each item, you will select: Compliant, Partially Compliant, Non-Compliant, or N/A. Use the notes field to document specifics.

Tip: Walk your facility while completing the audit — do not try to answer from memory. Physically visit each area described in the questionnaire and assess what you see in real time.

Key Areas the Audit Covers

Facility Access Controls

Who can enter your facility and under what circumstances? Look for: locked entry doors with key or badge access, visitor sign-in procedures, after-hours access controls, alarm systems, and security camera coverage. Note any areas where unauthorized access would be easy.

Workstation Controls

Every workstation that can access ePHI is a potential vulnerability. Check: screen position relative to windows and waiting areas (shoulder surfing risk), screen lock settings (should auto-lock within 15 minutes of inactivity), privacy screens on monitors visible to patients, and whether logged-in sessions are left unattended.

Server Room / Network Equipment

If you have on-premise servers, network equipment, or storage arrays: is the room locked? Who has the key? Is access logged? Is the room climate controlled and protected from flooding or fire? Are there cameras?

Device and Media Controls

How do you manage portable devices and storage media? Check: are laptops tracked by serial number? Are USB drives prohibited or encrypted? Is there a documented process for device disposal (wiping before disposal)? Are backup media stored securely?

Visitor Management

When vendors, repair technicians, or guests visit your facility: are they escorted? Do they sign in and out? Are they given visitor badges? Can they access areas containing PHI without oversight?

Important: If your staff work from home or at satellite locations, those locations also require physical safeguard assessment. You may need to have employees self-assess their home office environments using the remote worker checklist in the portal.

Acting on Audit Findings

For each non-compliant or partially compliant finding, create a Remediation Plan (Step 4) to address it. Physical security improvements often require small purchases — privacy screens, cable locks, badge readers, a file cabinet with a lock — but can dramatically reduce breach risk. Document all findings and remediation actions. OCR wants to see that you conducted the assessment and are addressing what you found.