The Privacy Rule’s "reasonable safeguards" isn’t just about your servers
45 CFR §164.530(c) requires covered entities to implement administrative, technical, and physical safeguards to protect PHI. In practice, HHS/OCR audits routinely turn up violations tied to physical office layout: patient conversations overheard from waiting areas, exposed scheduling monitors, unlocked file storage, sign-in sheets visible to other patients, exam room whiteboards left up.
Most of these are policy problems, not lease problems. But four categories of physical compliance depend on what your lease allows you to do to the space:
1. Acoustic separation between exam rooms and waiting areas
Standard commercial office demising walls are STC 30–35, you can hold a conversation next door and be heard clearly. Medical office requires STC 45–50 minimum between exam rooms, and between exam rooms and public/waiting spaces, for HIPAA-appropriate conversation privacy.
Two things to confirm your lease permits:
- Sound-rated wall assemblies within your suite as part of TI, acoustic batting, resilient channel, double drywall. Almost always allowed, but should be in the approved plans, not something you add later.
- Sound-masking systems (white noise emitters at scheduling desks and near exam room doors). Some landlords consider these "equipment" requiring separate approval; get pre-approval in the lease so you’re not fighting for it after installation.
2. Records storage, both paper and cold storage
Even fully EHR practices retain paper: signed consents, ID copies, faxes, insurance cards. And practices doing lab draws or vaccines need secured cold storage. HIPAA and CLIA both apply. The lease-side questions:
- Locked storage room within the suite, confirm your alterations rights allow you to install a solid-core door with commercial-grade lock (not just a "no locks on interior doors" clause the landlord uses for fire access).
- Off-site storage in the building, some medical office buildings offer basement or mezzanine storage. Confirm it’s HIPAA-appropriate: not shared with other tenants, locked, alarmed if practical.
- Cold storage electrical, dedicated circuit for a medical refrigerator (vaccines, lab specimens). Landlord should provision as part of TI, not treat as tenant equipment upgrade.
- Emergency generator tie-in for cold storage during outages, if the building has one. In earthquake-country Southern California, this matters for vaccine and biologic inventory.
3. Access control and entry to your suite
Your suite entry, after-hours access, and any secondary door (delivery, staff-only) all fall under HIPAA physical safeguards. Lease clauses to check:
- Electronic access control on the suite entry, you install a card reader or keypad. Standard modern medical office allows this within TI. Older buildings sometimes still require landlord-issued brass keys; that’s a hard "no" for medical.
- After-hours building access, who can badge in at 9 PM when your on-call physician needs to grab a chart? Confirm the building’s access system extends to physicians and key staff, not just "primary tenant contact."
- Cleaning crew access, janitorial staff will be in your suite after hours. HIPAA doesn’t require a BAA with them, but you should have language in the lease requiring them to sign confidentiality acknowledgment and prohibiting them from photographing or removing anything.
- Video surveillance, if you plan to install cameras (waiting area, back office), confirm your alterations rights cover them and that the landlord doesn’t retain a right to review your footage.
4. Alterations rights that actually let you build a compliant clinic
Every medical office lease grants "alterations subject to landlord approval." What you’re looking for is a narrower version: pre-approved alterations for standard medical build-out categories, so you don’t have to submit a change order every time you add a wall or replace flooring.
Language to push for:
- Pre-approved list of alterations, minor partition changes, flooring replacement in wet areas, sound-rated wall additions, cabinetry, requiring only notice, not approval.
- Reasonable-consent standard, landlord approval for anything above the pre-approved list "not to be unreasonably withheld, conditioned, or delayed."
- Right to use your own contractor for anything under a stated dollar threshold (typically $50k or $100k). Landlord’s house contractor is 2–3x market on medical work.
- Restoration waiver for anything the landlord approved during your term, you shouldn’t pay to rip out plumbing you funded and got permission to install.
The subletting and assignment side of HIPAA
One overlooked lease clause matters for HIPAA more than most tenants realize: assignment and subletting restrictions. If you grow, sell your practice, or bring in a specialist to sublet part of your suite, HIPAA still applies, and your lease shouldn’t make compliance harder than the regulation itself does.
Standard commercial leases give the landlord broad approval rights over any assignment or sublease. For medical office, ask for:
- Pre-approved successor entities, sale to a specified list of buyer types (private equity, hospital system, physician group) permitted without additional consent.
- Space-sharing rights for referring physicians and subspecialists, a rheumatologist letting an infusion nurse practitioner see patients one day a week shouldn’t require lease amendment.
- PHI-appropriate assignment documentation, landlord doesn’t need patient records to approve an assignment. Language explicitly protects you from being asked for them.
The three-minute lease scan
Before signing anything, scan the lease for these specific clauses and confirm each one is medical-appropriate:
- Alterations, pre-approved list + reasonable-consent standard + own contractor.
- Access control, electronic entry allowed; after-hours building access confirmed for physicians and key staff.
- Locks, no blanket prohibition on interior locks; storage room lock permitted.
- Cleaning, confidentiality acknowledgment required; landlord’s scope excludes patient care areas or you pre-approve access.
- Assignment/sublet, space-sharing permitted for referring providers; sale to approved successor categories doesn’t require additional consent.
- Restoration, waived for any improvement the landlord approved and funded during your term.