The documentation is the requirement
HIPAA’s Facility Access Controls standard, 45 CFR §164.310(a)(1), is a required standard. Its four implementation specifications — contingency operations, facility security plan, access control and validation procedures (which expressly includes visitor control), and maintenance records — are all addressable. Addressable does not mean optional. Under §164.306(d)(3), a covered entity implements the specification if it is reasonable and appropriate; if it is not, it must document why not, and implement an equivalent alternative where reasonable and appropriate. Documentation is not a third option alongside “implement” and “alternative” — it is the first of two conjoined obligations that attach the moment the specification does not fit: document why, and implement an equivalent alternative where reasonable and appropriate. Declining raises the burden; it does not reduce it.
There is a second attribution hook most programs miss entirely. Under Device and Media Controls, §164.310(d)(2)(iii), the Accountability specification — a record of the movements of hardware and electronic media and the person responsible — is also addressable, which means almost nobody has documented a rationale for declining it. HHS’s preamble is explicit that it does not reach audit trails inside systems or software; it is a media-inventory rule, not an access-control one. We name it because the attribution pattern repeats, not because it governs your card readers. One currency note rides on every use of this section: a pending HHS proposal (90 FR 898, January 6, 2025) would eliminate the addressable framework and make nearly all of these specifications required. As of the verification date it is proposed, not final, and the current Security Rule remains in effect — but a page that builds “the addressable trap” without acknowledging the proposal looks six months behind.
“Half the risk analyses I review treat addressable as a synonym for skip. The other half treat it as a synonym for buy everything. Both are wrong, and both are audit findings waiting to happen.”
Sources: 45 CFR §164.310(a)(1) and (d)(2)(iii); 45 CFR §164.306(d)(3); HHS NPRM 90 FR 898 (Jan. 6, 2025). HHS Security Rule preamble quotes (68 FR 8334) are paraphrased pending a Federal Register spot-check.
What would change this: HHS final Security Rule publishes (90 FR 898 docket); Federal Register spot-check of 68 FR 8334.
Reviewed July 2026 by the Eagle Systems healthcare practice. The systems referenced are how a facility meets the accountability the regulation creates, not a mandate; the accreditation and compliance determinations belong to the organization and its regulators. Current as of Accreditation 360 (eff. Jan 1 2026).