Device & Media Controls Policy

Policy

1. Acceptable workstation use (164.310(b))

Workstations and the information resources they reach are provided for authorized business purposes. Each workforce member is responsible for using them in a manner that protects the confidentiality, integrity, and availability of ePHI:

• Workstations are used only for assigned, authorized work; access is limited to the ePHI needed for the user's role (least privilege, per the Access Control Policy).
• Users access only data and systems for which they are authorized and must not attempt to circumvent security controls or run tools that probe or exploit system weaknesses (e.g., password crackers, packet sniffers, port scanners).
• Only software approved by [Security Official] (or IT) may be installed; users must not download or install unauthorized programs. Suspected unauthorized software or suspicious activity is reported immediately to [Security Official] or the user's manager.
• ePHI is stored only in approved systems, not on local workstation storage or personal accounts, and any sensitive information held locally to complete a task is removed once it has served its purpose.
• Users must not disable, bypass, or tamper with required safeguards (firewall, [endpoint protection], screen lock, [MDM solution] enrollment, or encryption).

This section governs how a workstation may be used; physical protection of the workstation itself is addressed in §2, and the operational rules are detailed in the companion Device & Media Controls Procedures.

2. Physical workstation safeguards (164.310(c))

[Organization] implements physical safeguards for all workstations that access ePHI so that access is restricted to authorized users and the risk of loss, theft, or unauthorized viewing is minimized:

• Positioning & privacy. Screens are positioned away from public view; privacy filters or physical barriers are used where a workstation cannot be shielded.
• Clear desk / clear screen. Workstations lock automatically after [15 minutes] of inactivity, and users lock or log off before leaving a workstation unattended; a credential is required to re-establish access. Confidential material, keys, and access tokens are secured (locked drawer or cabinet) when the workspace is unattended.
• Physical access. Physical access to workstations is limited to authorized personnel; devices are not left unattended in public places on or off [Organization] premises.
• Portable devices. Laptops and other portable devices are secured when unattended (cable lock or locked storage) and transported as carry-on, never checked baggage. Untrusted public networks are avoided; remote connections use a VPN or other secured channel.
• Environment. Food and drink are kept away from workstations to avoid damage.
• Loss or theft of any workstation or device used to create, store, or access ePHI is reported to [Security Official] as soon as possible so remote lock/wipe and incident handling can begin (see the Security Incident Response Policy).

Facility-level physical controls (building access, visitor management, secure areas) are governed by the Physical & Facility Security Policy.

3. Device and media controls: receipt, removal, and movement (164.310(d)(1))

[Organization] controls the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, and their movement within the organization:

• All hardware and media must be approved by [Security Official] (or IT) before being received, connected to [Organization] networks, or placed into service. Equipment issued to workforce members is enrolled in the [MDM solution] such that it cannot be un-enrolled without authorization.
• Removable media is restricted by default: its use must be supported by a documented business case and approved before use. Personally owned removable media must not be used to store [Organization] information, and media of unknown origin must not be connected without approval.
• ePHI on portable devices and removable media must be protected by encryption (see the Data Security & Encryption Policy for the encryption-at-rest standard); mobile devices require a PIN/passcode and must not be shared.
• Every receipt, removal, internal transfer, and disposition of hardware or media containing ePHI is recorded in the asset and movement log (§5) before or at the time of the movement.
• Media and devices in storage or transit are kept in a safe, secure environment.

Final disposal/destruction of ePHI and the media that held it is governed by the Physical & Facility Security Policy; this Policy covers controlled movement and re-use sanitization (§4).

4. Media re-use and sanitization (164.310(d)(2)(ii))

Before any electronic media is re-used, re-issued, or repurposed, all ePHI previously stored on it is rendered inaccessible so it cannot be retrieved or reconstructed:

• Media is sanitized using a method appropriate to the media type and the sensitivity of the data (cryptographic erase, secure wipe/overwrite, or factory reset with verification: see the Device & Media Controls Procedures for the sanitization SOP).
• A device must be reset to factory settings and sanitized before it is issued to any workforce member who was not its prior assigned recipient.
• Sanitization is verified and recorded in the asset and movement log (§5), including the method used and the responsible person.
• Sanitization methods are reassessed periodically against current technology and accepted practice.
• Records or media that are subject to a legal hold (open investigation, audit, or litigation) must not be sanitized, re-used, or disposed of until the hold is released.

5. Accountability for movements (164.310(d)(2)(iii))

[Organization] maintains a record of the movements of hardware and electronic media containing ePHI and the person responsible for each:

• A current inventory ("asset register") of devices and media that store, process, or transmit ePHI is maintained, each entry identifying make/model, unique identifier, assigned responsible party, criticality, and business purpose.
• The asset and movement log captures every receipt, internal transfer, removal from a facility, return, sanitization, and disposition, recording what moved, when, from/to whom or where, the reason, and the responsible person.
• The inventory and log are reviewed at least [quarterly] (and reconciled against [MDM solution] reporting where available) to detect anomalies, and are retained for six years per the Documentation & Records Retention Policy.

6. Protection from malicious software (164.308(a)(5)(ii)(B))

[Organization] guards against, detects, and reports malicious software on all components that access ePHI:

• Guard. [endpoint protection] is deployed on all applicable workstations and mobile devices, kept at the current vendor version, configured to update detection signatures automatically, and protected against being disabled by users. Built-in operating-system firewalls are enabled, and operating-system and application security updates are enforced (patching cadence is governed by the System Integrity & Patch Management Policy).
• Detect. Real-time scanning is enabled for files from external sources, with periodic full scans on a defined (e.g., daily) schedule; detected malware is blocked or quarantined.
• Report. Alerts are sent to the staff responsible for response on severe detections, scans and detections are logged, and workforce members report suspected infections or suspicious activity immediately to [Security Official] or their manager. Confirmed incidents are handled under the Security Incident Response Policy.
• Workforce members complete security-awareness training (including malware/phishing recognition) per the Workforce Security, Training & Sanctions Policy.

Roles & Responsibilities

• [Security Official]: owns this Policy; approves hardware/media and removable-media use; oversees the asset inventory, movement log, sanitization, and [endpoint protection]; reviews malware alerts and device-loss reports.
• IT / system administrators: enroll devices in the [MDM solution], configure safeguards, perform sanitization, and maintain inventory and log records.
• Managers: request and justify hardware/media for their team and ensure returns on role change or separation.
• Workforce members: use workstations and media only as authorized, apply physical safeguards, protect assigned devices, and report loss, theft, or suspected malware immediately.

Related documents

Device & Media Controls Procedures · Access Control Policy · Physical & Facility Security Policy (facility safeguards and final media/hardware disposal) · Data Security & Encryption Policy (encryption at rest) · System Integrity & Patch Management Policy · Security Incident Response Policy · Workforce Security, Training & Sanctions Policy · Documentation & Records Retention Policy.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Security Official] and after any significant change to the ePHI environment, the device fleet, or the malware threat landscape. v1.0.