What the regulations actually create — an accountability, not a systems mandate
You don’t learn the regulations from us — you live in them, and you can tell in about fifteen seconds whether a firm understands your world or is just reciting brochureware. Four things matter here, and only four: the guardrail you’re held to, the one principle underneath it, the distinction a specialist would notice, and what’s law versus guidance. Need the specifics — the standard numbers, the required-versus-addressable map, the man-minute specifications? They’re a click away, dated, and kept current.
Five regulatory surfaces. One accountability. At least two named exceptions — and they are not alike.
At least two provisions specify hardware, and the two we will name are not alike. One narrow DEA provision requires a securely locked, substantially constructed cabinet for controlled substances at a practitioner — and even that permits institutional practitioners to disperse Schedule II–V substances through noncontrolled stock instead (21 CFR §1301.75(b)); a hospital is an institutional practitioner.
The second is the Life Safety Code — the only place in healthcare where a code tells you how the hardware must behave. CMS incorporates NFPA 101, 2012 edition, by reference at 42 CFR §482.41(b)(1)(i) — not the 2015, 2018, 2021, or 2024 editions, and not whichever edition your state fire marshal enforces. Delayed-egress and controlled-egress locks must release on sprinkler activation, smoke detection, and loss of power; clinical staff must carry the unlocking means at all times. The infant-abduction door on a maternity unit is governed by §18.2.2.2.5.2 — a code obligation, not a recommendation. (Where a state fire and safety code has been found by CMS to adequately protect patients, §482.41(b)(3) applies instead.)
Everything else — the Joint Commission’s physical environment and performance goals, CMS’s Conditions of Participation, HIPAA’s physical safeguards, ligature-risk guidance — creates an accountability: identify the risk, implement procedures, document them, and be able to show they functioned. The systems we design are how a facility meets that accountability operationally; they are our recommendation, not the regulation’s mandate.
Note what the two exceptions share: even where a code specifies the hardware, the surveyor asks for the record.
“HIPAA requires access control.” “The Joint Commission requires infant abduction alarms.” “CMS requires cameras.” “DEA requires a vault.” Each is false — and each is checkable in five minutes by anyone fluent in this world, so we don’t print them. And the one a facilities director checks first — “NFPA 101 doesn’t apply to security” — is false too: it governs every locked door on an egress path, and CMS enforces the 2012 edition by regulation.
The regulation requires you to identify the risk, act on it, and be able to prove you did → here is the infrastructure that lets you meet that, and the record it produces when a surveyor or an auditor asks.
In healthcare, a citation without a facility type is half a claim.
The correct citation depends on the facility type. A standard that governs an accredited hospital in 2026 may not govern a behavioral health organization, an ambulatory site, or a nursing care center. Any page that cites a standard without naming the setting is telling you half of something.
The Insights library is filtered by setting, so when you want depth you read only what governs your facility, and every article states its setting in its first paragraph — for anyone who arrives from search and never saw the filter.
“Addressable” does not mean optional. The documentation is the requirement.
HIPAA’s facility-access-controls standard (45 CFR §164.310(a)(1)) is a required standard. Its implementation specifications are addressable — and addressable is the word most vendor pages get wrong in both directions.
Under §164.306(d)(3), a covered entity implements the specification if it is reasonable and appropriate. If it is not, two obligations attach at once — and documentation is the first of them, not the fallback: document why the specification does not fit, and implement an equivalent alternative where reasonable and appropriate. Declining does not reduce the burden. It raises it.
A related obligation, correctly placed: HIPAA names an attribution obligation elsewhere in the same section — the Accountability specification at §164.310(d)(2)(iii), under Device and Media Controls, requiring a record of the movements of hardware and electronic media and the persons responsible. HHS’s preamble is explicit that it does not reach audit trails inside systems — it is a media-inventory rule, not an access-control rule. We name it because the attribution pattern repeats, not because it governs your card readers. The full detail is in the Insights, filtered to your question.
What is law, what is guidance, and when this page was last true
You can trust our characterizations in both directions: we never upgrade guidance into a mandate for rhetorical force, and never soften a mandate your board is on the hook for.
We design, integrate, and document the physical-security systems that help a healthcare organization operationally meet the accountability these regulations create, and produce the records that survive a Joint Commission survey or a DEA audit. The accreditation determination and the compliance determination belong to the organization and its regulators — not to us. The systems are our recommendation for meeting that accountability, not a regulatory mandate. Nothing here is a compliance guarantee or legal advice.
We stay on top of the regulations so you don’t have to — and when they move, we move first
See where the accountability meets the floor
The guardrail says what the regulations create. The failure-modes page shows where hospitals actually fall short — the clinical-workflow workarounds that destroy attributability — and the self-assessment surfaces whether you can prove your own program functions.