Clean Desk Policy Checklist for a Cooperative Oncology Group Statistical Center

A clean desk policy helps protect participant data confidentiality by reducing the chance that study information is viewed, lost, or accessed by someone without authorization. Use this checklist alongside your organization’s approved security, privacy, records-retention, and study-specific procedures; it is a practical aid, not a stand-alone guarantee of HIPAA compliance.

What materials must be secured when a desk is unattended?

Before stepping away—even briefly—secure materials that identify participants, reveal study activity, or provide access to systems. Follow your organization’s rules for whether information may remain in a controlled workspace and how it must be protected.

• ☐ Put oncology study records, source documents, printed reports, and notes containing identifiable information in an approved locked drawer, cabinet, or records room.
• ☐ Turn face-down or secure documents that must remain in use at the workstation, and keep them out of sight of visitors and other unauthorized people.
• ☐ Secure paper containing participant identifiers, enrollment details, study results, or other confidential information, even if it is a draft or working copy.
• ☐ Remove access badges, keys, passwords, and other access credentials from the desk or any location where an unauthorized person could use them.
• ☐ Clear shared tables, printers, conference spaces, and reception areas of unattended study materials.

HHS describes physical safeguards as measures to protect electronic information systems, equipment, and facilities from unauthorized access. Apply your organization’s safeguards to both electronic and paper materials according to the information involved and the risks in your work area. See the HHS explanation of HIPAA physical safeguards.

How should study records and removable media be stored?

Keep records in approved locations and limit access to staff with a legitimate work need. Store physical files in locked cabinets or controlled-access rooms, and return them promptly after use. Do not leave participant-linked documents in open trays, unlocked drawers, or unattended meeting rooms.

For removable media, such as USB drives, memory cards, or portable drives, follow the center’s authorization, inventory, transport, and storage procedures. Do not use personal or unapproved media to copy, transfer, or store study data. Keep approved media physically secured when not in use, and use required encryption and access controls where your organization’s procedures call for them.

HIPAA’s Security Rule includes device and media controls for electronic protected health information, including policies for media movement, storage, reuse, and disposal. See the HHS guidance on HIPAA physical safeguards and device and media controls.

• ☐ Return paper files to their designated secure storage after use.
• ☐ Keep removable media in an approved locked location and maintain required tracking records.
• ☐ Obtain authorization before taking study records or media outside the center.
• ☐ Report lost, misplaced, or potentially exposed records or media promptly through the organization’s incident-reporting process.

What workstation security steps belong on the checklist?

Use organization-approved controls to reduce unauthorized access to computers that display or contain study information. An automatic screen lock is a useful safeguard, but the required settings and timeout should follow your organization’s security standards and risk assessment.

• ☐ Lock your workstation whenever you leave it, even if you expect to return shortly.
• ☐ Confirm the automatic screen lock activates according to your organization’s configuration.
• ☐ Sign out of applications and remote sessions when they are no longer needed.
• ☐ Keep laptops and other portable devices physically secured when unattended.
• ☐ Avoid saving study data to unapproved local folders, personal accounts, or unapproved cloud services.
• ☐ Report a missing device, unexpected access prompt, or suspected exposure using the approved reporting channel.

HIPAA requires appropriate physical safeguards for workstations that access electronic protected health information, but it does not prescribe one universal screen-lock setting for every organization. HHS provides examples of workstation safeguards, including password-protected screen savers and logging off; apply the controls selected by your organization.

How should confidential paper records be disposed of?

Do not place confidential study records in ordinary trash or recycling unless your organization’s approved process specifically provides for secure destruction. First check applicable retention schedules, study protocols, sponsor requirements, and records-management instructions. Destroy records only when they are eligible for disposal and the appropriate process has been authorized.

• ☐ Place eligible confidential papers in a designated secure destruction bin or use another approved destruction method.
• ☐ Do not leave documents beside a full bin, in an open wastebasket, or in a shared area awaiting destruction.
• ☐ Use the organization’s documented process for outsourced destruction and any required records of disposal.
• ☐ Report misdirected papers or an unsecured destruction container promptly.

HHS identifies shredding documents containing protected health information before discarding them as an example of a safeguard. Follow the center’s approved method and retention rules rather than assuming that a particular shredder type or disposal schedule is universally required. See the HHS summary of the HIPAA Privacy Rule and safeguards.

How can staff protect screens, whiteboards, and credentials?

Position screens and work areas to reduce viewing by visitors and passersby. Use organization-approved privacy screens where needed, and lock or turn off the display when it is not actively in use. Avoid displaying participant identifiers or confidential study details on whiteboards in areas accessible to unauthorized people.

• ☐ Clear or erase whiteboards, flip charts, and meeting-room displays when the work session ends.
• ☐ Use coded or limited information on shared displays when permitted by study procedures.
• ☐ Keep badges, keys, tokens, and written access information secured; never share passwords or leave them visible.
• ☐ Do not let another person use your signed-in workstation or credentials.
• ☐ Challenge or report unfamiliar visitors who appear to have access to restricted work areas, following local procedures.

These steps support participant data confidentiality and access credential protection. The precise physical safeguards should reflect the center’s environment, the information handled, and applicable organizational procedures.

How should the policy be communicated and reviewed?

Make the policy easy for staff, contractors, and other authorized workers to find, understand, and follow. Explain how it applies to shared spaces, remote work, temporary workstations, and study-specific materials. Provide employer-specific training and acknowledgement according to the organization’s procedures; do not treat a training completion certificate as proof that an organization is HIPAA compliant.

• ☐ Provide the current policy during onboarding and when relevant procedures change.
• ☐ Identify who staff should contact with questions or to report a lost record, unsecured media, or other incident.
• ☐ Set and document a policy review cadence—for example, an annual review if that matches organizational practice—and review sooner after relevant incidents, workflow changes, or changes to applicable requirements.
• ☐ Record the policy owner, approval date, version, and next planned review date.

HHS states that regulated entities should review and modify security measures as needed and update documentation in response to environmental or organizational changes. HHS does not set one universal clean desk policy review interval. See the HHS summary of the HIPAA Security Rule.

In practice, the checklist is most effective when staff consistently secure records and media, lock workstations, protect displays and credentials, dispose of eligible papers through approved channels, and follow a documented policy review cadence.

FAQs

When should staff lock away confidential study records?

Lock away confidential study records whenever they are not actively being used, including when you leave your desk or finish work in a shared area. Follow any stricter study, sponsor, or organizational rules for records that must remain accessible during active work.

Should computers be shut down at the end of each workday?

Not necessarily. Follow your organization’s instructions for shutdown, sleep, or leaving a workstation powered on for approved updates or other managed tasks. Regardless of the power state, secure the device, sign out where required, and ensure confidential information is not left accessible on screen.

How should staff dispose of unneeded confidential documents?

First confirm the documents are eligible for disposal under applicable retention and study requirements. Then use the organization’s approved secure destruction process, such as a designated confidential-document bin or an authorized destruction service; do not put them in ordinary trash or recycling unless the approved process specifically permits it.

How often should the clean desk policy be reviewed?

Set a documented review cadence that fits the organization’s governance process, and review the policy sooner when relevant workflows, risks, or requirements change or after a related incident. HIPAA does not establish one universal annual review interval for a clean desk policy; HHS advises periodic review and updates when environmental or organizational changes affect security.