A trusted partner shall establish physical safeguards to guard BAR information integrity, confidentiality, and availability, which include:

1. A. Physical protection of the personal computer system used for viewing BAR information and related buildings and equipment from:

   1. (1) Fire;
   2. (2) Natural and environmental hazards;
   3. (3) Disasters; and
   4. (4) Intrusion;

2. B. A secure work station location with physical safeguards to eliminate or minimize the possibility of unauthorized access to BAR information, including:

   1. (1) Locating a personal computer used to access and view BAR information in a locked room;

   2. (2) Restricting access to the locked room to authorized personnel by using:

      1. (a) Electronic keypads;
      2. (b) Electronic access badges; or
      3. (c) Door locks;
   3. (3) Placing the computer monitor in a way that screen contents are not viewable by an unauthorized person;

   4. (4) Locking file cabinets, desks, and desk drawers that contain BAR information:

      1. (a) During nonworking hours; and
      2. (b) When the BAR information custodian is not present in the immediate area; and
   5. (5) Making BAR information nonviewable or unobtainable before admitting an unauthorized person into the workspace;

3. C. BAR information media control procedures that govern the receipt, removal, and disposal of BAR information CD-R discs or thumb drives into or out of the facility, which include:

   1. (1) Access control so that only the BAR information custodian can receive the BAR information media;
   2. (2) Accountability procedures that trace the receipt, removal, and disposal of BAR information media;
   3. (3) BAR information storage; and

   4. (4) Tracking the disposal process and the final disposition of:

      1. (a) Electronic BAR information; and
      2. (b) BAR information hardware on which electronic BAR information is stored;

4. D. Emergency mode operation access controls that enable continuing protection to BAR information in the event of:

   1. (1) Fire;
   2. (2) Vandalism;
   3. (3) Natural disaster; or
   4. (4) BAR information computer information system failure;
5. E. A facility security plan to safeguard BAR information on the premises from unauthorized physical access, tampering, and theft;
6. F. Verifying access authorizations before granting physical access;

7. G. Maintaining documentation of repairs and modifications to the physical components of the facility including:

   1. (1) Hardware;
   2. (2) Walls;
   3. (3) Doors; and
   4. (4) Locks; and

8. H. Procedures governing the reception and hosting of visitors, including:

   1. (1) Sign-in logs for visitors; and
   2. (2) Providing escorts for visitors, if appropriate.

Authority: Health-General Article, §§17-601—17-605, Annotated Code of Maryland

Effective date: November 25, 2002 (29:23 Md. R. 1811)

Chapter revised effective July 31, 2006 (33:15 Md. R. 1280)

Chapter revised effective January 23, 2012 (39:1 Md. R. 17)

Regulation .03B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .04B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .07F amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .09B amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .10E amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .11A amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .12B, C amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .13 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .14 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .21 amended effective May 18, 2020 (47:10 Md. R. 517)

Regulation .22 amended effective May 18, 2020 (47:10 Md. R. 517)