Workstation Use

The next item under the Physical Rules section is Workstation Use. Agencies must implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access EPHI.

Basically, the requirement here is to protect the workstations that have access to EPHI. This can include many things. Passwords, anti-spyware, firewalls, etc all protect the workstation. You must specifically indicate to users the proper use of the workstation in order to maintain the security of the EPHI data. Indicate that NO software may be installed, no data may be removed, passwords must not be shared, etc. Also indicate that the user must log off his/her workstation when leaving their desk.