Free HIPAA Asset Management Templates

Every device, drive, and door that touches ePHI: endpoint protection, facility access, tracking, and disposal. These templates keep the physical layer accountable.

Read the Asset Management guide →

Asset & ePHI Inventoryreference
A ready-to-fill spreadsheet for the accountable inventory of every asset that stores or accesses ePHI: the record HIPAA's Device & Media Controls assume you keep, and the starting point for your Risk Analysis.
Data Flow Mapreference
A fill-in map of where ePHI is created or received, where it's processed and stored, and where it goes: the artifact an auditor asks for (and most organizations skip because "diagram" sounds like work).
Device & Media Controls Policypolicy
This Policy establishes how [Organization] governs the use of workstations and the movement, re-use, and protection of the hardware and electronic media that create, receive, maintain, or transmit electronic protected…
Device & Media Controls Proceduresprocedures
To provide repeatable, auditable steps for issuing and physically protecting workstations, controlling the receipt/removal/movement of hardware and media containing ePHI, sanitizing media before re-use, keeping an acc…
Physical & Facility Security Policypolicy
This Policy establishes how [Organization] limits physical access to the facilities, workspaces, and systems that house or are used to access electronic protected health information (ePHI), so that only authorized per…
Physical & Facility Security Proceduresprocedures
To provide repeatable, auditable steps for controlling physical access to [Organization] facilities and workspaces, validating visitors, accessing facilities during an emergency, logging maintenance to security compon…

6 templates in Asset Management. Browse all 51 →

Every device, drive, and door that touches ePHI: endpoint protection, facility access, tracking, and disposal. These templates keep the physical layer accountable.

Asset & ePHI Inventoryreference

A ready-to-fill spreadsheet for the accountable inventory of every asset that stores or accesses ePHI: the record HIPAA's Device & Media Controls assume you keep, and the starting point for your Risk Analysis.

Data Flow Mapreference

A fill-in map of where ePHI is created or received, where it's processed and stored, and where it goes: the artifact an auditor asks for (and most organizations skip because "diagram" sounds like work).

Device & Media Controls Policypolicy

This Policy establishes how [Organization] governs the use of workstations and the movement, re-use, and protection of the hardware and electronic media that create, receive, maintain, or transmit electronic protected…

Device & Media Controls Proceduresprocedures

To provide repeatable, auditable steps for issuing and physically protecting workstations, controlling the receipt/removal/movement of hardware and media containing ePHI, sanitizing media before re-use, keeping an acc…

Physical & Facility Security Policypolicy

This Policy establishes how [Organization] limits physical access to the facilities, workspaces, and systems that house or are used to access electronic protected health information (ePHI), so that only authorized per…

Physical & Facility Security Proceduresprocedures

To provide repeatable, auditable steps for controlling physical access to [Organization] facilities and workspaces, validating visitors, accessing facilities during an emergency, logging maintenance to security compon…

6 templates in Asset Management. Browse all 51 →