Bottom line: a lock repair can be both a facilities event and a security-control change. For organizations in scope, the record should establish what security component changed, why, who authorized it, and whether the protected boundary still works as intended.
\n45 CFR 164.310(a)(2)(iv) — Maintenance records is part of the facility-access-controls standard for covered entities and business associates. The maintenance-records implementation specification calls for documenting repairs and modifications to the physical components of a facility that are related to security, with examples including hardware, walls, doors, and locks. The regulation identifies that specification as addressable.
\nAddressable does not mean irrelevant or automatically optional. The HIPAA Security Rule’s implementation framework requires the regulated organization to make and document the appropriate determination based on its circumstances.
\nThe eCFR is an authoritative, continuously updated online version of the CFR, but it is not an official legal edition. This article is not legal advice or a finding that HIPAA applies to a facility, system, or work order. Scope, implementation decisions, documentation period, and safeguards depend on the entity’s risk analysis, policies, electronic protected health information, facility-access plan, and counsel or compliance interpretation.
\nThe following steps are DSE recommendations based on the cited source.
\nHave the HIPAA security or compliance owner define which facilities and components are in scope. For each relevant repair or modification, record asset and location, protected boundary, condition, requested change, requester, authorizer, technicians, dates, parts, key or credential impact, temporary safeguard, final configuration, and post-work test. Avoid including protected health information in the ticket unless necessary and permitted.
\nReconcile facilities work orders with PACS configuration, key-control records, drawings, and incident logs. Review repeat repairs and emergency bypasses for a larger control weakness. Document the organization’s treatment of the addressable specification through the established HIPAA process.
\nRetain the applicability decision, policy, work order, before-and-after photos where authorized, parts and configuration record, temporary-control log, door and alarm tests, access review, exception approval, and closeout. Audit a sample from facilities dispatch through the compliance repository to confirm the record is complete and retrievable.
\n