HIPAA requires safeguards that are physical and also:

1. Locking a door is not enough on its own. 2. Access to the records themselves must be controlled. 3. HIPAA requires both technical and physical safeguards for controlling access to protected health information. 4. So the answer is technical. _Source: NIST SP 800-144, 'Guidelines on Security and Privacy in Public Cloud Computing'_