An entire master patient index can be stored on a flash drive no bigger than a pack of gum. HIPAA privacy and security rules do not prohibit remote access, but they do require that organizations implement appropriate safeguards to ensure the privacy and security of protected health information (PHI). Reasons for Remote Access.