Any vendor that maintains physical office locations or health centers should have a detailed physical access management process. The most robust process will adhere to the principles of zero trust that incorporate principles of least privilege and least functionality. All visitors should be required to sign in and be monitored while on site, and sensitive areas should be restricted, with access monitored and logged.