In addition to protecting electronic protected health information in information systems, covered entities have to have Physical Safeguards standards, which means they have to physically protect information assets. The safeguard that requires covered entities to control and validate access to facilities based on users' roles or functions is called Access control and validation Facility security plan Audit controls Person or entity authentication