Device & Media Controls Procedures

2. Receiving, moving, and removing hardware & media (164.310(d)(1))

1. Approval. Any hardware or removable media that will hold ePHI is approved by [Security Official] (or IT) before it is received or connected. Removable media additionally requires a documented business case; personally owned media and media of unknown origin are not permitted.
2. Receipt. On receipt, IT records the item in the asset register (§4) (make/model, unique identifier, responsible party, criticality, business purpose, receipt date) and applies the baseline (encryption, enrollment) before it enters service.
3. Internal transfer. When a device or medium changes responsible person or location, the transferring party logs the movement (§4) before/at handover; if the new holder was not the prior assigned recipient, the device is sanitized and reset first (§3).
4. Removal from a facility / off-site use. Off-site movement is recorded in the movement log; ePHI on the device/medium must be encrypted, and the item must be physically secured in transit and storage.
5. Return / end of use. On role change or separation, the manager ensures the device/media is returned to IT; IT logs the return and routes the item to sanitization for re-use (§3) or to the Physical & Facility Security Policy disposal process for destruction.

3. Media-sanitization SOP (re-use) (164.310(d)(2)(ii))

Applies to media being re-used, re-issued, or repurposed. For permanent destruction of media, follow the disposal procedure in the Physical & Facility Security Policy.

1. Confirm no legal hold. Verify the device/media is not subject to an open investigation, audit, or litigation hold. If it is, stop. Do not sanitize until the hold is released.
2. Back up / transfer any data that must be retained to its approved system of record before sanitizing.
3. Select the method by media type and sensitivity:
   • Self-encrypting drive / encrypted volume → cryptographic erase (destroy the key), then factory reset.
   • Magnetic or solid-state fixed disk → secure wipe / overwrite with a reputable tool, or the vendor secure-erase, followed by factory reset.
   • Mobile device → encrypted factory reset (remote wipe via [MDM solution] where available).
   • Optical/write-once or media that cannot be reliably sanitized → do not re-use; route to destruction.
4. Execute the sanitization and verify it succeeded (e.g., confirm the wipe report, or re-image and confirm no prior data is recoverable).
5. Record the sanitization in the movement log (§4): item identifier, method used, date, verifier, and responsible person. Retain any tool-generated wipe report as evidence.
6. Return to inventory the sanitized item as available for re-issue, or hand off per §2.5.

4. Asset & movement log (164.310(d)(1), 164.310(d)(2)(iii))

1. Maintain the asset register. Keep a current inventory of all devices and media that store, process, or transmit ePHI. Each entry records: make/model, unique identifier, assigned responsible party, criticality, business purpose, and acquisition/renewal date. Where the [MDM solution] provides a dynamic device inventory, use its report as a source and reconcile to the register.
2. Log every movement. For each receipt, internal transfer, off-site removal, return, sanitization, and disposition, append a movement record capturing: what (item + unique ID), when (date/time), from → to (person and/or location), reason, responsible person, and outcome (e.g., "sanitized, verified", "wiped & destroyed (see disposal record)").
3. Reconcile [quarterly]. IT (with responsible parties) compares the [MDM solution] inventory to the asset register, reviews the movement log for anomalies, confirms completeness with asset owners, and updates records as needed.
4. Retain the asset register and movement log for six years per the Documentation & Records Retention Policy.

Movement-log columns (representative): Date · Item & unique ID · Movement type (receipt / transfer / off-site / return / sanitization / disposition) · From → To (person/location) · Reason · Responsible person · Verification / outcome.

5. Endpoint-protection standard (malware: guard / detect / report) (164.308(a)(5)(ii)(B))

1. Deploy & enforce (guard). [endpoint protection] is installed and active on every workstation and mobile device that accesses ePHI, enforced through the [MDM solution]. It is kept at the current vendor version, configured for automatic signature updates, and protected against being disabled by standard users. Built-in OS firewalls are enabled.
2. Configure scanning (detect). Enable real-time scanning of files from external sources and downloads, plus periodic full-system scans on a defined (e.g., daily) schedule. Detected malicious code is blocked from executing or quarantined automatically.
3. Alert & log (report). Configure the tool to send alerts to [Security Official] (or the response team) on severe detections, and to log periodic scans, detections, and configuration changes. Logs are reviewed per the Audit Controls & Activity Review Policy.
4. User reporting. Workforce members report suspected infections, unexpected software, or suspicious behavior immediately to [Security Official] or their manager. Confirmed infections are escalated to the Security Incident Response Policy.
5. Monitor coverage. On the [quarterly] reconciliation (§4), confirm every in-scope device shows active, up-to-date [endpoint protection]; remediate any gaps.

Records produced (evidence)

Asset register · device receipt/issuance records · asset & movement log entries · media-sanitization records and tool-generated wipe reports · device loss/theft & remote-wipe records · [endpoint protection] deployment/coverage reports, scan logs, and malware-detection alerts · [quarterly] inventory-reconciliation sign-offs. These are the artifacts an auditor will request to confirm the controls operate.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Security Official]. v1.0.