HIPAA Network Closets: Physical Safeguards for ePHI

HIPAA does not use the phrase “network closet,” but the Security Rule covers the room anyway. If a closet holds switches, patch panels, firewalls or servers that transmit, process or cache electronic protected health information (ePHI), it is part of your physical safeguards. You need to control who enters it, document what happens inside it, and include it in your written risk analysis.

This guide is for IT directors, facilities managers and practice or building managers responsible for medical offices, clinics, billing departments and the buildings that house them. We are a low voltage contractor in Lower Manhattan, so we write from what we see inside these rooms. We are not your compliance counsel. Where a decision turns on your legal obligations, we point you to the rule text and to your compliance officer.

TL;DR

• The Security Rule’s facility access control standard applies to any space that houses systems holding or moving ePHI, and that includes the telecom room down the hall.
• Using a cloud provider does not remove the closet from scope. HHS cloud guidance is clear that local equipment still has to be secured.
• Auditors want evidence: access logs, maintenance records, a documented closet layout and a risk analysis that names the room.
• A tested, labeled and documented cabling plant is a compliance asset. Abandoned cable and unlabeled patching are not.
• A stricter Security Rule has been proposed, so build to the stricter standard now instead of relying on “addressable” flexibility.

Why the network closet is in scope

The Security Rule defines physical safeguards as measures, policies and procedures that protect a covered entity’s electronic information systems and related buildings and equipment. HHS’s physical safeguards summary states this plainly. Nothing in that definition limits it to the server room or the data center.

Think about what a typical clinic closet carries. Every workstation, EHR terminal, networked imaging device, VoIP phone and wireless access point lands on a patch panel in that room. Traffic carrying ePHI crosses the core switch there. Whoever can reach that rack can unplug a link, plug in a rogue device, copy configuration files from a switch or simply take hardware.

That is the exposure the rule is written for. It is also why the closet, which is often shared with janitorial supplies, building utilities or another tenant’s equipment, is where many practices fall short.

The conduit misunderstanding

Some organizations assume a closet is out of scope because it only “passes traffic.” HHS recognizes a narrow conduit exception for pure transmission services, such as an internet service provider that does not store or access the data. Your closet is different if it holds equipment that caches, stores or processes ePHI, for example a local file server, a backup appliance, a call recording unit or a firewall that inspects and logs traffic. In that case the exception does not apply, and the room has to be secured under the Security Rule. The HHS cloud computing guidance is the document to read on this point.

“We’re in the cloud” does not close the gap

Moving your EHR to a cloud provider, backed by a business associate agreement, is a legitimate strategy. HHS confirms a covered entity may use a cloud service to store or process ePHI when a compliant business associate agreement is in place. That arrangement covers the provider’s side. Your local network, the switches, the wireless controllers, the workstations and the closet that ties them together remain yours to protect and to include in your risk analysis.

What the rule actually asks for

The core text is 45 CFR § 164.310. For closets, four parts matter most.

The same section also covers workstation use, workstation security, and device and media controls. In a closet context, those cover things like a console terminal left logged in, a retired switch leaving the building with its configuration intact, or a backup drive sitting on a shelf.

Required versus addressable

Many of these specifications are labeled “addressable.” That does not mean optional. HHS explains in its Security Rule overview that you must assess whether an addressable specification is reasonable in your environment. If it is not, you must document the alternative safeguard you used or why the specification is not appropriate. The common pitfall is not skipping a control. It is skipping the written decision.

The risk analysis must name the closet

A recurring finding in HHS enforcement is the lack of a thorough, written risk analysis. You can see this in resolution agreements such as the Lafourche Medical Group settlement. Facilities and IT teams often treat risk analysis as a software exercise: patching, antivirus, encryption. The physical environment gets a single line, or none.

NIST SP 800-66 Rev. 2, the resource guide for implementing the Security Rule, says the scope of a risk assessment should include the physical boundaries of the regulated entity. For a closet, a useful written entry answers these questions:

1. What equipment is in the room, and what ePHI touches it?
2. Who can enter, and how is that access granted, logged and revoked?
3. What could go wrong: forced entry, tailgating by a contractor, water from an overhead pipe, heat from a failed cooling unit, power loss?
4. What controls exist today, and what is the gap?
5. Who owns each remediation, and by when?

If you cannot answer the first question from a current diagram, start there. CISA’s baseline controls list makes the same point from the security side: maintain an accurate inventory of network-connected assets so unknown or unmanaged equipment does not sit unnoticed.

A practical closet standard for a HIPAA environment

The rule does not prescribe door models or camera counts. It expects controls that are reasonable for your size, complexity and risk. The following is what we recommend, based on how these rooms are built and maintained. It is our practice standard, not a regulatory checklist.

1. Control the door

HHS’s August 2024 cybersecurity newsletter addresses physical access to areas housing ePHI. Our reading, from the field: treat the closet as a critical security zone with credentialed entry (card or biometric where reasonable), an entry log you can export, and a short authorized list reviewed on a schedule.

A keyed knob lock that six people have copies of fails the test in practice. Nobody can say who entered last Tuesday. In shared buildings, ask whether the landlord, the cleaning crew or another tenant holds a key. If they do, the building’s access list becomes part of your risk analysis.

The door itself matters too. A hollow door with a gap at the bottom and a lock that can be shimmed is the weak point, whatever reader you put on it. When a closet door needs to be replaced or upgraded, a rated steel unit with commercial hardware is the usual route, and in New York City the fire rating and code compliance of the door are part of the job. Suppliers of electrical room door units offer steel doors, frames and locks that fit this purpose. Whatever you install, log the work as a maintenance record, as the rule requires for changes to doors, locks and walls.

2. Keep the room a closet

Storage boxes, spare monitors and cleaning supplies make the room harder to audit and easier to hide tampering in. Move them out. The closet should hold network and related equipment, with clear floor space and a visible, labeled layout.

3. Lock the rack, not just the room

A locking cabinet adds a second layer, which matters when a vendor, electrician or building engineer legitimately needs the room. Keep rack keys separate from room credentials and track who holds them.

4. Watch the entrance

Camera coverage at the closet door, tied to the access log, lets you reconcile “who was in” with “what was touched.” Our guide to CCTV cabling for secure facilities covers the cable paths, and our access control cabling requirements page covers readers, controllers and door hardware wiring.

5. Protect the environment

Heat, water and power loss are availability risks, and availability of ePHI is part of the Security Rule’s goals. Check cooling, avoid placing racks under pipes, use a UPS where the risk analysis supports it, and keep cables off the floor.

6. Segment the network

CISA’s guidance on interconnected systems argues against layering security on top of legacy infrastructure and for building security in from the ground up, including micro-segmentation to restrict lateral movement if something is breached. See the agency’s zero trust guidance for interconnected systems. In a closet, this means separate VLANs and clearly labeled ports for clinical devices, guest WiFi, building systems and VoIP, so a compromised camera or printer cannot reach a records system.

Where cabling work becomes compliance evidence

Most HIPAA guidance stops at the door. Inside the room is where our work starts, and it has direct compliance value.

Labeling and as-builts. If you cannot trace a port to a wall jack or a device, you cannot prove what is connected to your network. A current cable schedule and rack elevation answer an auditor’s first question and speed up incident response. Our structured cabling as-built documentation guide describes what a useful set contains.

Abandoned cable removal. Dead runs from previous tenants or retired systems create ports and pathways nobody is tracking. Removing them shrinks the surface you have to defend and clears the room. See our notes on clean cable management.

Testing and certification. A certified link has a test report. A report with date, tester and results is a record you can file with the risk analysis, and it separates a real fault from a configuration problem when something fails.

Documented change. Every move, add or change in the closet should leave a trace: who did it, when, what was touched. That fits the maintenance record logic of § 164.310 and the broader documentation habit HHS expects.

Organization. A tidy rack is easier to inspect, and a stray cable or unfamiliar device stands out. Our guides to network closet organization best practices and what a network closet is cover the layout basics.

Shared buildings and multi-tenant medical offices

Many New York practices lease space in a building where the main telecom room belongs to the landlord. Three questions come up every time.

• Who controls the riser and the main room? If your demarc and the building’s equipment share a room, get written access procedures from building management.
• Where does your equipment live? Where possible, put practice-owned switches and firewalls in a room or locked cabinet that only you control.
• Who is on the log? Building engineers and carrier technicians need access, so agree on notice and escort procedures and keep records.

Our article on cabling in multi-tenant buildings explains how risers, pathways and shared rooms are typically organized.

What may change: the proposed Security Rule update

In December 2024, HHS issued a Notice of Proposed Rulemaking to strengthen the Security Rule. Among the proposals: removing the distinction between required and addressable implementation specifications, requiring written documentation of all policies, and adding items such as a network map and regular compliance audits. One industry summary notes the rule remained proposed as of mid-2026. Check HHS for the current status before you rely on either version.

Whatever happens, the direction is clear. Network maps, inventories and documented controls are where regulators are heading, and a labeled, documented closet gets you most of the way. Planning to the stricter standard also costs little when you are already opening the closet for other work.

Our perspective

We have worked in New York commercial buildings for more than 40 years, and the same pattern repeats in healthcare spaces. The practice invests in its EHR, its endpoint protection and its staff training. Then the closet sits behind a door with a key nobody tracks, on a rack where half the patch cables are unlabeled and nobody knows what three of the ports feed.

That is not a technology problem. It is a documentation and discipline problem, and it is fixable. The order we recommend is simple. Clean the closet and remove what is dead. Label and test what remains. Produce as-builts that match reality. Then lock the door properly and start logging. In that order, because you cannot secure or document what you cannot trace.

A few views we hold firmly:

• Treat the closet as part of your security architecture, not as building infrastructure someone else handles.
• Do not let a vendor or contractor work in the room without a record of what they changed.
• Hold your cabling contractor to the same documentation standard you hold your IT provider to. If they cannot hand you test results and updated drawings, the job is not finished.
• Keep the compliance decisions with your compliance officer or counsel. Our job is to make the physical plant clean, tested and provable.

— Ken

Where we fit

We design, install, test and document low voltage infrastructure for commercial and secure facilities across New York City. For a healthcare environment, the relevant work is network closet (MDF/IDF) cleanup, abandoned cable removal, structured CAT6 cabling with testing and certification, CCTV and access control cabling, and server rack installation. You can see the full range on our services page and examples of finished work on our projects page, including a data center retrofit and rack cleanup.

We are licensed and insured, and we start with a no-obligation site survey at your location. If you want a second set of eyes on a closet before an audit, schedule a site survey and we will walk the room with you.

A step-by-step plan for an existing closet

1. Inventory. List every device, panel and cable run. Note the ePHI it touches.
2. Photograph and record the current state. This is your baseline for the risk analysis.
3. Remove abandoned cable and unused equipment. Retire hardware following your device and media disposal procedure.
4. Label and test. Label both ends of every run, test and certify, and file the reports.
5. Update as-builts and the rack elevation.
6. Upgrade access. Credentialed entry with an exportable log, key control for the rack and an authorized list.
7. Write it down. Add the closet to the facility security plan and risk analysis, including the decisions on any addressable items.
8. Review on a schedule. Check the access list, the log and the room condition at set intervals, and after any construction, move or vendor change.

For a deeper design reference, see our guide to structured cabling system components.

FAQ

Does HIPAA require a locked network closet?

HIPAA does not name the closet or specify a lock type. It requires policies and procedures that limit physical access to systems holding ePHI, as set out in § 164.310. For a room housing network equipment that carries ePHI, a locked, access-controlled space is the usual way to meet that expectation. Document your reasoning in the risk analysis either way.

If our EHR is in the cloud, do we still need to secure the closet?

Yes. A business associate agreement covers the cloud provider’s handling of ePHI, but your local switches, firewalls and workstations still carry it. HHS’s cloud guidance says local equipment remains your responsibility. Include the closet in your risk analysis.

Does ePHI have to be stored in the United States?

HIPAA does not strictly require it. HHS says a covered entity may use a provider storing ePHI abroad if it has a business associate agreement and addresses the added risks in its risk analysis. This affects your cloud contracts more than your closet.

What records should we keep for the closet?

Keep the access list and entry logs, visitor and vendor escort records, maintenance records for doors and locks, a current cable schedule and rack layout, and test reports for the cabling. Tie them to the closet’s entry in your risk analysis so an auditor can follow the thread.

Is the proposed HIPAA Security Rule update in effect?

As of this writing, the Security Rule you must follow is the existing one, and the 2024 proposal has not been confirmed as final in the sources we reviewed. Check the HHS fact sheet and ask your compliance officer for the current status.

Sources

• 45 CFR § 164.310, Physical safeguards (Legal Information Institute)
• HHS: Security Rule physical safeguards
• HHS: Guidance on HIPAA and cloud computing
• HHS: May a covered entity use a cloud service to store or process ePHI?
• HHS: Cloud service providers outside the United States
• HHS: HIPAA Security Rule overview
• HHS: Lafourche Medical Group resolution agreement
• HHS OCR Cybersecurity Newsletter, August 2024
• HHS: Security Rule NPRM fact sheet
• NIST SP 800-66 Rev. 2
• CISA: Cross-Sector Cybersecurity Performance Goals, common baseline controls
• CISA: Zero trust to protect interconnected systems
• MetricStream: 2026 HIPAA updates