HIPAA §164.310(b) - Workstation Use

🔑 AUDIT-GRADE EVIDENCE • Follows AICPA SOC 2 / HHS HIPAA / PCI QSA ROC / NIST 800-53A • Report tamper-evident via SHA-256 chain

1. CONTROL IDENTIFICATION

FrameworkHIPAA Security Rule
Control ID§164.310(b)
Control FamilyPhysical Safeguards > Workstation Controls
Control NameWorkstation Use
StatusIMPLEMENTED
Assessment Date2026-04-19T02:25:35.202960+00:00
AssessorTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Environment ScopeAzure: Pay-As-You-Go (prod) (4f29d094-1079-44c9-acb0-4d73a7a2dd34)
Report ID6b244cfa5d37a190ca4970bfe28fcd708812a39ae2d11f39b51d3c65f5139385

2. REGULATORY TEXT

Standard: Workstation use. Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information.

Source: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.310

3. IMPLEMENTATION SPECIFICATIONS

Each implementation specification addressed separately per HIPAA §164.306(d) / NIST 800-53A assessment methodology.

164.310(b) REQUIRED Workstation Use Policy IMPLEMENTED

Document acceptable workstation use and environmental controls.

Evidence: #A1

4. EVIDENCE ARTIFACTS

Summarized with counts + exceptions + drill-down. Raw data available on request per retention policy.

#A1 Workstation Use Policy Attestation 2026-04-19T02:25:35.202960+00:00
All 142 endpoints enrolled in Intune with workstation use policy acknowledgement logged.
Records: 142 Exceptions surfaced: 0 Sampling: full

5. TESTING PROCEDURES & RESULTS

Test of Design (does the control exist?) + Test of Operating Effectiveness (does it work consistently?). Sampling per AICPA AU-C 530.

Test of Design - Workstation use policy exists DESIGN PASS
Sample size: n/a

Policy v1.3 in effect.

6. FINDINGS / EXCEPTIONS

Active findings: 0 · Accepted risks (exceptions): 0 · Total: 0

Click any finding to view detail, remediation, and record an exception (risk acceptance). Exceptions are retained in the report as part of the audit trail.

No findings for this control.

7. MANAGEMENT RESPONSE

SOC 2 Type 2 and HITRUST assessors require management's written response to findings.

Management has reviewed 0 findings. No open findings for this control period. Next review cycle: quarterly.

8. AUDIT TRAIL

ScannerTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Scanner versionv2.0.1
Collection timestamp2026-04-19T02:25:35.202960+00:00
Retention2555 days (HIPAA 164.316(b)(2))
Report hash (SHA-256)6b244cfa5d37a190ca4970bfe28fcd708812a39ae2d11f39b51d3c65f5139385

9. CROSS-FRAMEWORK MAPPING

This same evidence is admissible for the following related controls. Scan once, satisfy multiple frameworks.