What kinds of safeguards are required?
You must establish appropriate administrative, technical and physical safeguards to protect the PHI in your practice from intentional or unintentional disclosure. For example, the regulation requires you to limit access to PHI but provides you with enough flexibility to determine for yourself who in your office needs access to PHI and how much information they need to do their jobs.
