How to HIPAA: Asset Management
Free HIPAA guide · 12 controls · 6 templates
The devices, media, and premises that hold ePHI: endpoint protection, facility access, tracking, and disposal. The sections below are assembled from the same control catalog, threat library, and enforcement mapping our free assessment runs on.
Why this matters
- Physical safeguards
- Protects the facilities, devices, and media that hold ePHI. Lost and stolen laptops, drives, and paper remain a leading cause of reportable breaches; these controls stop a misplaced device from becoming a notice to thousands of patients.
The controls in this area
The 45 CFR §164 requirements HIPAA places here: 12 of the 103 controls in our catalog. Our free templates and assessment track each one:
164.308(a)(5)(ii)(B) · 164.310(b) · 164.310(c) · 164.310(d)(1) · 164.310(d)(2)(ii) · 164.310(d)(2)(iii) · 164.310(a)(1) · 164.310(a)(2)(i) · 164.310(a)(2)(ii) · 164.310(a)(2)(iii) · 164.310(a)(2)(iv) · 164.310(d)(2)(i)
What enforcement looks like here
Breach causes reported to HHS that implicate these controls: Improper Disposal · Theft · Loss
Related threat scenarios
Common threats (NIST SP 800-30 classes) that this area's controls defend against:
- AdversarialStolen / lost device
Exploits: Endpoint not encrypted · 164.312(a)(2)(iv) Encryption; 164.310(d) Device Controls
- AdversarialPhishing / credential theft
Exploits: No or weak MFA; reused passwords · 164.312(d) Authentication; 164.308(a)(5) Training
- AdversarialRansomware
Exploits: Unpatched systems; no tested backups · 164.308(a)(7) Contingency; 164.308(a)(5)(ii)(B) Malware
- AccidentalImproper disposal of media/records
Exploits: No disposal/sanitization procedure · 164.310(d)(2)(i) Disposal
Free templates for this area
De-branded policy and procedures templates mapped to this area's controls. Read the full text free, then adapt them to your organization:
See where your organization stands on the 12 controls in this area.
Join Us