HIPAA-compliant layout build-outs
A HIPAA-compliant build-out is a practice interior where the physical safeguards — sightlines, sound-rated walls, locked records rooms, controlled doors — are drawn into the floor plan and built to spec, not patched on after an audit finding. Grandview Contractors builds them for medical, dental, and counseling practices across Utah County and Salt Lake County under a Utah DOPL B100 general contractor license.
When privacy is the problem the layout has to solve
HIPAA does not come with a building inspection. The Security Rule’s physical safeguards — facility access controls, workstation security, device and media controls — are obligations the practice carries as a covered entity, published by HHS, and no city plans examiner checks a suite against them. What a build-out can do is make compliance the room’s default condition: the waiting area cannot read the check-in monitor, and a conversation in exam room three stays there.
This page fits when privacy is the organizing constraint: a practice answering a risk-assessment finding, a counseling office where speech privacy is the service itself, or a practice inheriting a second-generation suite with an open reception desk and walls that stop at the ceiling grid.
If you are building a whole clinic from shell, start with our medical office build-out or dental office build-out pages — everything below layers on top of them. An urgent care build-out is a throughput layout where privacy competes with speed, and a physical therapy clinic handles privacy through treatment-room zoning instead. All sit under our medical and dental build-out practice in the broader renovation and build-out family.
What the physical safeguards look like on a drawing
Reception and sightlines
Most privacy failures happen at the front desk. We build transaction counters with a staff-side monitor well so screens face away from the lobby, set check-out apart from check-in so billing conversations do not happen beside the sign-in line, and put printers behind a wall rather than on the counter. Frosted film or switchable glazing keeps the desk visible without making the desktop readable.
Speech privacy between rooms
A standard office partition stops at the ceiling grid, so sound simply crosses over the top through the plenum. For exam, consult, and counseling rooms we run partitions to the structural deck, pack them with sound-attenuation batts, seal top and bottom tracks with acoustic sealant, and offset back-to-back electrical boxes by a stud bay with putty pads so the wall has no straight-through holes. Doors are solid core with perimeter gaskets and automatic door bottoms; return air moves through lined transfer boots instead of open grilles. Where an open billing area cannot be walled, a plenum sound-masking system raises the background level until overheard speech stops being intelligible — low-voltage work Grandview holds the contract for and manages through licensed electricians.
Full-height partitions carry a Utah detail of their own: along the Wasatch Front, walls run to the deck need lateral bracing designed and inspected against current Utah-adopted code, because the valley sits on the Wasatch fault. That gets settled on the drawings.
Records, server, and medication rooms
Paper records, the server rack, and controlled medications each get a room with walls to deck, no exterior glazing, and a lockable door on the access-control system. The IT closet gets dedicated cooling and conduit sized for growth, coordinated through licensed mechanical and electrical contractors under our contract.
Doors and access
Electrified hardware, card readers, and closers separate the staff corridor from the patient corridor — an on-stage, off-stage plan that keeps charts, carts, and conversations out of public circulation. Our access control coordination page explains how that work is managed inside the build-out.
How a privacy-driven build-out is sequenced
- Start from your risk assessment. Your compliance lead names the physical gaps; we translate each one into a wall type, a door-schedule line, or a sightline fix. We build the safeguards — we are not your HIPAA consultant, and we say so.
- Drawings and plans review. Wall-type schedules, STC targets, deck-bracing details, and hardware sets go into the permit set. Provo, Orem, and Salt Lake City run predictable review queues; Lehi and Saratoga Springs can move fast on some reviews and stack up on others.
- Rough-in walk. Before drywall, we check box offsets, sealed deck penetrations, and transfer-boot routing room by room.
- Close-up and verification. Gaskets, door bottoms, and sealant joints are checked before paint, and each private room gets a speech-privacy walk test with the door closed. The plans may change. The standard does not.
- Commissioning and turnover. Access-control programming, key schedules, and the as-built wall-type map go to your office manager so the next risk assessment starts with documentation, not guesswork.
What does a HIPAA-compliant layout add to a build-out budget in Utah?
As a ballpark planning figure, privacy safeguards add a modest premium to the partition, door, and low-voltage lines of a clinic build-out rather than reshaping the whole budget. The premium is driven by how many rooms need deck-height sound-rated walls, how many doors go on access control, and whether open areas need sound masking. We confirm it with a budget range before design is final.
Price moves up with every partition that climbs from ceiling grid to deck, with the hardware-set count on access control, with switchable glazing over film, and with server-room cooling. It moves down when a second-generation suite already has solid-core doors and full-height walls in the right places.
Questions we actually get
Does the city inspect a build-out for HIPAA compliance?
No. Building, fire, and accessibility inspectors check the suite against current Utah-adopted code, not the HIPAA Security Rule. Compliance stays with the practice under federal law; building the safeguards in means your own risk assessment finds them already doing the work.
Can you fix privacy problems in an existing suite without a full demolition?
Usually. The common fixes — extending partitions to the deck, swapping hollow doors for gasketed solid-core doors, adding sound masking over open areas, and reworking the reception counter — can be done room by room, often after hours, while the practice stays open.
What sound rating should an exam or counseling room have?
HIPAA names no number. In practice, exam and consult rooms are specified around STC 45–50 and counseling rooms higher, with the door and its seals treated as part of the assembly. A high-rated wall with a hollow, ungasketed door performs like the door.
Do we still need a HIPAA consultant if Grandview builds the space?
Yes, if you don’t already have one. We build the physical safeguards your risk assessment calls for and document what was installed; policies, training, and electronic safeguards are outside a contractor’s scope. A compliance lead names the gaps; we close them.
Tell us what you’re working on
We reply within a couple of hours during business hours — a day at most. You’ll get a straight read on scope, sequence, and budget before anyone commits to anything.