Most practices plan a move around square footage, exam rooms and parking.

The RealityThe cheapest time to fix this is before the drywall

⚠️

The Problem

IT arrives after the layout is fixed.

Cabinet in a cupboard off the waiting room, one outlet per exam room, and a decision about visitor access that nobody made deliberately.

🔧

The Solution

Plan against the safeguards, before the drywall.

Treat facility access, workstation placement and media handling as building decisions, and write the risk assessment while changes are still cheap.

✅

The Resolution

A space that supports the controls.

Restricted areas that are genuinely restricted, cabling that outlives the first refresh, and a contingency plan that matches the building.

Facility access controls are a floor plan question

The regulation is explicit. 45 CFR 164.310 requires policies and procedures to limit physical access to electronic information systems and the facilities housing them, while ensuring properly authorised access is allowed.

Underneath that standard sit four implementation specifications, and all four are addressable rather than required: contingency operations, a facility security plan, access control and validation procedures, and maintenance records. Addressable does not mean optional. It means you implement it, or you document why an equivalent alternative achieves the same purpose.

Translated into a floor plan: where is the comms room, who can reach it, does it lock, is it visible from a public area, and can a visitor walking to a restroom pass it unaccompanied. Those questions cost nothing to answer on a drawing and a great deal to answer after a fit-out.

Device and media controls, and the only two Required specs

The same section covers hardware and media moving into, out of and around a facility — and this is where the regulation stops being addressable.

Under device and media controls, disposal and media re-use are both Required. Accountability and data backup and storage are addressable. That distinction is worth knowing precisely, because two of the eight specifications in the whole physical safeguards section are Required and both of them are about what happens to storage media.

For a new build this means deciding, before anyone moves in, where retired equipment goes, who certifies its disposal, and what the record of that looks like. Practices that leave it until the first workstation refresh usually discover a cupboard of old machines nobody will take responsibility for.

Workstation security and where screens face

Two standards in the section have no implementation specifications at all, which sometimes gets read as meaning they are less important. They are not; they simply have no sub-parts.

Workstation use asks for policies specifying the proper functions, the manner of performing them, and the physical attributes of the surroundings of a workstation. Workstation security asks for physical safeguards restricting access to authorised users. Both are about placement as much as about software.

In a fit-out that means: which way does the front desk monitor face, can a patient standing at the counter read it, does the exam room screen sit where a waiting patient sees the previous one’s chart, and is there a line of sight from a corridor into a clinician workroom. Privacy filters help and they are a retrofit for a problem that placement could have avoided.

Risk assessment before the lease, not after

The risk assessment is the document that makes every other decision defensible, and it is far more useful written during planning than after occupancy.

NIST’s cybersecurity resource guide for implementing the HIPAA Security Rule, revision 2 published February 2024, sets out a seven-step process: prepare for the assessment; identify reasonably anticipated threats; identify potential vulnerabilities and predisposing conditions; determine the likelihood a threat will exploit a vulnerability; determine the impact; determine the level of risk; and document the results. It notes that risk assessment and risk management are foundational to compliance, and points small organisations to the resources in its Appendix F.

Run those seven steps against the drawing rather than against the finished building. A vulnerability identified on a plan is a change order; the same vulnerability identified after occupancy is a project. This is exactly the kind of work that belongs inside a cybersecurity compliance review at the planning stage.

Network segmentation and the equipment that cannot be patched

Here we have to be careful about what is actually required versus what is good practice, because the two get conflated in vendor material.

FDA’s medical device cybersecurity page notes that health care delivery organisations should evaluate their network security and protect their hospital systems, and that devices increasingly connected to networks carry increased cybersecurity risk. It also records that section 524B of the Food, Drug, and Cosmetic Act, added by the Consolidated Appropriations Act 2023 and effective March 2023, addresses cybersecurity of devices.

What no federal source we could verify does is prescribe network segmentation in operational terms — no VLAN scheme, no firewall rule set. So we will not pretend one does. Segmentation is a sound engineering response to equipment that cannot be patched on a normal cycle, and it is a judgement your risk assessment should record rather than a rule you are complying with. The practical build decision is simply to run enough cabling and configure enough switch capacity that segmenting later is a configuration change rather than a re-cable.

Contingency operations and the building

The contingency operations specification asks for procedures allowing facility access to support data restoration under a disaster recovery plan. In a new build this is a question about the building rather than the backup software.

Who can get into the space after hours if systems have to be restored. Is there a key, a code, a fob, and does the list of people holding one match the list of people who would actually be called. If the building has a property manager controlling after-hours access, is that arrangement documented anywhere.

For a New Jersey practice this is worth thinking about alongside the ordinary regional risks — storm-related power loss, flooding in parts of Bergen and Passaic, and the reality that a practice with one site has no alternate. Where the practice runs more than one location, the second site is the natural continuity plan and is worth designing as one, which is part of why we scope this alongside ongoing managed IT support rather than as a one-off project.

• Put the comms room on the drawing early. Lockable, not off a public corridor.
• Decide disposal before occupancy. It is one of only two Required specs here.
• Check sight lines to every screen. Placement beats privacy filters.
• Run the seven-step assessment against the plan. While changes are still cheap.

Qventive provides medical office network build New Jersey services in Hackensack NJ and across service areas across New Jersey, working from the drawings rather than after the fit-out.

Because the physical decisions and the record decisions are the same decisions, this work sits alongside your HIPAA risk analysis and, where a move coincides with a system change, EHR implementation planning. Practices building in Bergen County in particular should factor the flood and power picture into the contingency conversation early.

Office builds: common questions