HIPAA COMPLIANCE FRAMEWORK
Physical Safeguards
Documents workstation, device, facility, media, disposal, and physical-access expectations for True Care System users and Providers.
These pages describe True Care System functionality and operating expectations. They do not replace Provider policies, legal advice, risk analysis, workforce training, contracts, or regulatory obligations. Use minimum-necessary access and protect PHI in screenshots, exports, tickets, messages, and reports.
Purpose
Documents workstation, device, facility, media, disposal, and physical-access expectations for True Care System users and Providers.
Core Requirements
Facility Access
Restrict physical access to systems and devices containing sensitive information.
Workstation Use
Use approved locations, screen privacy, automatic locking, and secure working practices.
Device Controls
Protect laptops, phones, tablets, storage devices, and printed materials.
Media Reuse and Disposal
Sanitize or destroy media before reuse or disposal.
Remote Work
Apply secure network, private workspace, device, and reporting expectations.
Operational Review Checklist
| Review Area | Expectation |
|---|---|
| Provider Scope | Confirm the correct Provider before viewing, changing, exporting, or investigating records. |
| Authorized Purpose | Confirm the user’s role, approved purpose, and minimum-necessary scope. |
| Evidence | Retain relevant timestamps, actors, targets, identifiers, IP addresses, devices, reasons, and results. |
| Escalation | Escalate unexpected, denied, suspicious, cross-Provider, bulk, or high-risk activity. |
| Documentation | Record decisions, corrective action, validation, and required follow-up. |