164.310(b) - Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information.

A workstation is defined in the rule as “an electronic computing device, for example, a laptop or desktop computer, or any other device that performs similar functions, and electronic media stored in its immediate environment.” The Workstation Use standard requires covered entities to specify the proper functions to be performed by electronic computing devices. Inappropriate use of computer workstations can expose a covered entity to risks, such as virus attacks, compromise of information systems, and breaches of confidentiality. The Workstation Use standard also applies to cove with workforce members that work off site using workstations that can access EPHI. This includes employees who work from home, in satellite offices, or in another facility.