← All documentation

Devices

Devices (under Systems) records the workstations, laptops, tablets, phones, servers, medical devices, removable media, printers and network equipment that store or reach electronic protected health information (ePHI), and the ones your systems run on. It keeps an inventory that supports the HIPAA Security Rule's workstation and device and media controls (45 CFR § 164.310(b)–(d)): where each device is, who has it, how it is protected, and how it was disposed of. The policies and procedures those standards require belong in Policies, and facility access controls (§ 164.310(a)) are not recorded here. The register is for organization administrators.

What each device records

  • Name and kind, with its make and model, serial number and operating system.
  • Location: the site and room, or "With the assignee" for a portable device. A location is an attribute of a device, not a separate register.
  • Assigned to: the member of your organization who has it, if anyone. A device keeps its assignee when that person leaves the organization, marked as no longer an active member, until you change it.
  • Handles ePHI: Yes, No or Not sure. A device whose answer is Not sure is counted as one that may handle ePHI until you say otherwise.
  • Encryption, and how the device is encrypted. Encryption is an addressable implementation specification of the Security Rule (45 CFR § 164.312(a)(2)(iv)): you assess whether it is reasonable and appropriate for the device and implement it if it is; if it is not, you document why and implement an equivalent alternative measure if that is reasonable and appropriate (§ 164.306(d)(3)). Addressable does not mean optional.
  • Screen lock: whether the screen locks when the device is idle, one physical safeguard for a workstation (§ 164.310(c)).
  • Automatic logoff: after how many minutes of inactivity a session ends (§ 164.312(a)(2)(iii), addressable).
  • ePHI last removed: when, and how, the ePHI on the device was removed before re-use, return to a lessor or repair (§ 164.310(d)(2)(ii)). It is kept on any status, so a device wiped and reassigned keeps the record.
  • Last and next review, for your own review cycle.
  • Systems that run on it: each system you link lists the device in the Safeguards section of its page.

Leaving service

A device's status is In use, Retired, Lost, Stolen or Disposed of.

  • A device marked Disposed of must record when, and how the data on it was removed or destroyed; a disposal is recorded only on that status. Backsplice asks for both. The record supports, but is not itself, the policies and procedures the Security Rule requires for the final disposition of ePHI and/or the hardware or electronic media it is stored on (§ 164.310(d)(2)(i), required).
  • A device marked Lost or Stolen shows a link to record an incident. If it held protected health information, its loss may be a breach of unsecured protected health information unless that information was secured as the HHS guidance specifies (encryption that meets it, with the key not also compromised); a device recorded here as Encrypted does not settle that. The incident's PHI questions take you through the assessment and any notifications.
  • If someone changes a device's status (marking it Lost or Stolen from an incident, say) while you have its page open, your save is refused rather than putting the old status back: the form shows the status as it now stands, so check it and save again.

Remove a device only when it was recorded in error. A device disposed of, lost or stolen cannot be removed: its record is the evidence of how it left your hands. A retired device is kept too, so its last recorded state stays on the record. A device with a movement recorded by hand cannot be removed either: that log is the record of where it has been. Neither can a device linked to an incident: it is kept as evidence of that incident. Removing a device recorded in error takes the entries its own edits logged (a typo fixed in its location, say) and unlinks its evidence.

Incidents involving a device

A lost or stolen device is usually also an incident. The two records are linked:

  • From the device: the banner on a lost or stolen device's page offers **record an incident**, which opens a new theft or loss incident with this device already listed as involved.
  • From the incident: its page has Devices involved, where an admin links any device on this register, or unlinks one linked by mistake. Linking a device that is still In use to a theft or loss incident offers to mark it Lost or Stolen; nothing changes its status unless you choose it and confirm.
  • From the device, for an incident already recorded: Link to an incident, under Incidents involving this device, opens the incident register; open the incident with View, and its Devices involved panel has the device selected (or, when the incident already lists it, says so). The register keeps the device you are linking while you sort or filter it.

The device's page lists Incidents involving this device. An incident that may involve protected health information is named there by its discovery date, never its title. Linking a device never decides whether the incident is a breach: the incident's breach risk assessment states what the device record says about encryption, and you decide. The HHS audit package's Devices section lists each device's incidents by discovery date.

Movements

Each device's page keeps a movement log: the record of the movements of hardware and electronic media and the person responsible for each, which the Security Rule's accountability specification describes (§ 164.310(d)(2)(iii), addressable).

  • Saving a new location or assignee on the device's form logs the change automatically, dated the day you saved it, with the new assignee as the person responsible when the assignee changed (otherwise, including when you clear the assignee, the log shows who saved it). If the device was moved or reassigned after you opened its form (a movement recorded, or another save), nothing is saved, so the form cannot put the device back where it was: reload the page and make the change again.
  • Record a movement logs one by hand: the date, what happened (moved, handed to another person, sent for or back from repair, taken offsite or brought back, sent for disposal, received, or other), where it went, and the one person responsible, either a member of your organization or someone outside it named in words, such as a courier or a repair or shredding vendor. A location filled in becomes the device's location.
  • Entries are never edited. An entry is removed only with its device, when a device recorded in error is removed (above). To fix one, choose Correct beside it and record a correction, which says what it changes and names the entry it corrects; the original stays as it was. A correction never moves the device: its location records where the corrected trip really went.

The HHS audit package's Devices section counts the movements and lists the most recent.

Evidence

Attach files already uploaded to Evidence to a device: a disposal or sanitization certificate, a repair receipt, a signed courier manifest. The same file can support several records.

The register

The register lists each device with its location, whether it handles ePHI, its encryption, how many systems run on it, its status and its last review, and counts the devices in use, those that may handle ePHI, those of them not known to be encrypted, and any lost or stolen. Filter by status, kind, ePHI or encryption, or search by name, location or serial number; the CSV export carries the same filters.

This register records what you tell it. It does not scan or inventory devices itself, and a device recorded as encrypted is your statement, not a test.