Yes, 1) Physical atributes: According to HIPAA Security Rule you must have: "implemented policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft?" Thus making sure the network closet is closed and locked, restricting access to anyone that does not belong in there. 2) Network devices: You must have "Audit Controls, hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use EPHI?" So because your monitoring systems use the network to transfer medical data, you are required to keep track of the activity happening on your modems, routers, switches etc. 3) Transmission of the information: As far as the transmission of the data over your network, you need to monitor your EPHI to make sure no one improperly makes any changes or deletes anything without anyone else noticing. You also must encrypt the data that gets transmitted where "appropriate" The Transmission of the information is classified as "Addressable" in the Security Rule, but that basically means "Required if it applies to you"

Yes, 1) Physical atributes: According to HIPAA Security Rule you must have: "implemented policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft?" Thus making sure the network closet is closed and locked, restricting access to anyone that does not belong in there. 2) Network devices: You must have "Audit Controls, hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use EPHI?" So because your monitoring systems use the network to transfer medical data, you are required to keep track of the activity happening on your modems, routers, switches etc. 3) Transmission of the information: As far as the transmission of the data over your network, you need to monitor your EPHI to make sure no one improperly makes any changes or deletes anything without anyone else noticing. You also must encrypt the data that gets transmitted where "appropriate" The Transmission of the information is classified as "Addressable" in the Security Rule, but that basically means "Required if it applies to you"