Part 2 secure paper-record storage

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.16(a)(1)(i)(C) requires formal policies and procedures for maintaining paper records in a secure room, locked file cabinet, safe, similar container, or storage facility when the records are not in use. The broader paragraph requires reasonable protection against unauthorized uses, disclosures, and anticipated threats or hazards. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended framework.

Storage includes every resting place

The current paper-security rule names several examples without limiting the control to one container type. Inventory records rooms, desks, carts, clinician bags, reception, mail areas, printers, scanners, archives, vehicles, homes, vendors, and disaster sites.

Access and physical protection work together

Use keyed or electronic access, least-role authorization, key issuance and return, door and cabinet checks, visitor escort, sign-out, clean-desk practice, privacy screens where relevant, fire and water protection, pest control, and environmental monitoring.

Shared sites need explicit boundaries

Landlords, cleaners, maintenance, security, coworking spaces, schools, homes, hospitals, storage vendors, and affiliates may access the physical environment. Define contracts, supervision, restricted zones, emergency entry, logs, and post-service access removal.

Inventory each storage state and location

Map active files, archives, intake packets, printouts, notes, sign-in sheets, labels, faxes, scanning queues, mail, litigation holds, destruction bins, overflow boxes, mobile kits, and disaster-recovery copies. Record room or facility, container, owner, record class, volume, access group, key or code, retention, environmental risk, and review date.

Include temporary states such as a clinician's desk, locked cart, printer tray, records being indexed, vendor staging, remote-work space, and after-hours intake. “In use” should be defined narrowly and should not become permission to leave records unattended.

Match protection to the location and threat

Use secure rooms, locked cabinets, safes, locked carts, or comparable containers based on sensitivity, volume, access, occupancy, and hazards. Control doors, windows, walls, ceilings, keys, combinations, badges, alarms, cameras, visitor access, cleaning, maintenance, loading areas, and shared tenancy where appropriate.

Protect against fire, water, humidity, pests, sunlight, structural failure, theft, and improper disposal. Keep records away from public view, treatment waiting areas, shared workrooms, exposed shelving, and unmonitored corridors. Store keys and access lists separately from the records.

Govern keys, codes, and physical access

Approve access by role and business need. Issue individually attributable badges, keys, or codes when feasible; record assignment, duplication, return, loss, and replacement. Change codes and recover credentials after workforce transfer, leave, termination, vendor change, or suspected compromise.

Log high-risk room and archive access, after-hours entry, vendor visits, bulk retrieval, and emergency opening. Reconcile access records with workforce and visitor lists. Emergency access needs a defined reason, accountable person, time, and review.

Control retrieval, return, and exceptions

Use checkout or location tracking for files removed from storage. Record requester, purpose, patient or batch, destination, time out, expected return, actual return, and discrepancies. Keep sensitive indexes and box labels nonrevealing.

When capacity is exceeded, locks fail, a room floods, construction begins, or emergency relocation is required, use an approved temporary container and custody process. Document the exception, compensating controls, duration, owner, and permanent resolution.

Inspect and respond

Walk through facilities and sample cabinets, carts, keys, codes, visitor logs, retrieval records, destruction bins, and remote arrangements. Test whether doors latch, records fit, access lists are current, and staff know where to return files.

After unauthorized entry, missing records, broken locks, or environmental damage, preserve evidence, contain the area, inventory affected information, notify privacy and security, assess breach and continuity needs, correct controls, and verify remediation.

Plan storage moves before records are displaced

An office move, archive transfer, renovation, lease end, disaster, acquisition, or program closure can turn secure storage into a bulk transfer. Inventory boxes and containers, verify retention and holds, approve origin and destination, restrict staging, use neutral labels, assign custody, track transport, reconcile receipt, and document missing or damaged material.

Inspect the destination before arrival for locks, access lists, environmental controls, capacity, visitor routes, loading areas, fire and water risk, and destruction arrangements. Do not rely only on a storage vendor's general security description.

Decision owners can ask where every record is, who may enter, how access ends, which hazard could damage it, what happens during an outage, and how movement is reconciled. Keep those answers with the facility and records risk review.

Example

Fifteen storage locations are inspected. Twelve have approved container, access list, key control, environmental protection, inventory, monitoring, and remediation evidence; three are unlocked satellite cabinets. Readiness is 12 of 15 locations.

Secure-paper-storage checklist

• inventory active, archived, temporary, mobile, vendor, hold, and destruction states;
• use secure rooms, locked cabinets, safes, carts, or comparable containers;
• control and reconcile badges, keys, codes, visitors, vendors, and emergency access;
• track retrieval, destination, custody, return, and discrepancies;
• plan for fire, water, construction, capacity, remote work, and relocation; and
• inspect, investigate, remediate, and verify physical controls.

Secure storage is a lifecycle control. It applies during staging, retrieval, use, return, archive, hold, and disposal, not only inside the records room.