Clinical and Translational Science Institute Clean Desk Policy Checklist

What should a clean desk checklist include?

A clean desk checklist helps you keep sensitive information from being viewed, lost, or accessed by someone who is not authorized. In a clinical or research setting, desks and work areas may contain protected health information (PHI), personally identifiable information (PII), study documents, or other confidential materials. Follow your institution’s policies, which may set requirements beyond this general checklist.

• Put paper records, consent forms, notes, labels, and other sensitive materials away when you are not actively using them.
• Store records in approved locked cabinets or other authorized physical record storage.
• Use a workstation screen lock or log out when stepping away from a computer.
• Keep mobile devices and removable media under your control or in approved secure storage.
• Collect documents promptly from shared printers and scanners.
• Use approved secure disposal procedures for materials that are eligible for destruction; do not place sensitive records in ordinary recycling or trash.
• Report lost materials, misplaced devices, or suspected unauthorized access using your institution’s incident-reporting process.

For organizations and activities subject to HIPAA, the Security Rule addresses workstation use, workstation security, and device and media controls. A U.S. Department of Health and Human Services (HHS) summary of the HIPAA Security Rule explains these safeguards; your institution’s policies determine how they apply to your specific workspace.

How should staff secure paper records containing sensitive information?

Keep paper records containing PHI, PII, or confidential research information in an approved, access-controlled location when you are not using them. A locked cabinet or designated secure room may be appropriate under institutional policy. Limit access to staff who are authorized to handle the records, and do not leave files, forms, or handwritten notes unattended on desks, counters, or shared work surfaces.

When moving documents between work areas, use the handling and transport procedures established by your institution. Retrieve printouts promptly, check that you have collected all pages, and place them in a secure folder or other approved container if they must be carried. Do not discard sensitive material until it is eligible for disposal under applicable retention rules and institutional procedures. HHS advises covered entities to determine and implement reasonable safeguards for PHI disposal; see its guidance on disposing of protected health information.

When should staff lock computer screens and secure mobile devices?

As a practical workplace habit, lock your screen whenever you step away, even briefly, and log out when your session is finished or your institution’s procedures require it. A workstation screen lock helps prevent someone nearby from viewing or using an unattended computer. HIPAA’s Security Rule lists automatic logoff as an addressable implementation specification, rather than prescribing one fixed inactivity period for every organization. Covered entities and business associates should follow the applicable rule and their documented security policies. See the technical safeguards in 45 CFR § 164.312.

Secure mobile devices whenever they are not in use: keep them with you or place them in approved secure storage, use the access protections required by your institution, and avoid leaving a device visible or unattended in a shared area. Use only devices, applications, and storage methods approved for the information you handle. HHS explains that mobile devices may be used to access electronic PHI when appropriate safeguards are in place; review its guidance on mobile devices and electronic PHI.

How can confidential information be kept out of view in unattended workspaces?

Before leaving an unattended workspace, remove or cover papers that display names, study identifiers, health information, or other confidential details. Position documents face down or put them away, clear sensitive notes from shared surfaces, and ensure whiteboards or displays do not reveal information to people without authorization.

Lock the computer rather than relying only on closing a document or turning off the monitor. Arrange screens so visitors and passersby cannot easily see them, and use an institution-approved privacy screen when appropriate. Keep keys, access badges, and devices with you or secured according to local procedures. HHS identifies workstation surroundings and physical access as part of workstation security; consult the physical safeguards in 45 CFR § 164.310.

What should staff do before leaving a shared or clinical research workspace?

Use this end-of-work checklist before leaving a shared or clinical research area:

• Put away paper records and study materials, including consent forms and notes, in approved secure storage.
• Collect printouts and originals from printers, scanners, and other shared equipment.
• Lock the workstation screen or log out, following institutional procedure.
• Secure mobile devices, removable media, keys, and access badges.
• Remove sensitive information from shared surfaces and erase displays or whiteboards when required.
• Leave the workspace and any storage areas secured as required by local access procedures.
• Report suspected loss, exposure, or unauthorized access promptly through the designated institutional process.

These steps are general practices, not a substitute for your institute’s specific rules. HIPAA requires covered entities to use appropriate safeguards to protect PHI in any form, and institutional policy may also cover confidential research information that is not PHI. See HHS guidance on the HIPAA Privacy Rule and safeguards for PHI.

What are the limitations of a clean desk policy for protecting sensitive information?

A clean desk policy reduces exposure in physical workspaces, but it cannot protect information from every risk. It does not by itself secure email, networks, cloud services, remote access, user accounts, or data stored on devices. Nor does it replace access controls, staff training, incident response, secure data handling, or other safeguards required by applicable law and institutional policy. HHS describes the HIPAA Security Rule as requiring appropriate administrative, physical, and technical safeguards—not just workspace practices—in its overview of the Security Rule.

HIPAA requirements apply to covered entities and business associates as defined by the rules; institutional or research requirements may apply more broadly. In summary, use the checklist to protect information from casual viewing and physical loss, while relying on your organization’s full security program to address risks beyond the desk.

FAQs.

When should staff lock their computer screens?

Lock your screen whenever you step away from your workstation, even briefly, and follow your institution’s rules for automatic locking and logging out. HIPAA does not set one universal screen-lock timer for every organization; its automatic-logoff specification is addressable and should be handled under the applicable security policies.

How should sensitive paper documents be stored?

Keep them in approved, access-controlled storage, such as a locked cabinet or designated secure room, when they are not in active use. Follow institutional procedures for transport, retention, and secure disposal.

What should be secured before leaving an unattended workspace?

Put away sensitive papers and study materials, collect printouts, lock or log out of the workstation, and secure mobile devices, removable media, keys, and badges. Clear sensitive information from shared surfaces or displays when required.

Does a clean desk policy replace other information security safeguards?

No. It helps reduce physical exposure but does not replace technical and administrative safeguards such as access controls, secure systems, training, and incident reporting. Follow the full set of applicable institutional requirements and safeguards.