← All documentation

Devices

Devices (under Systems) records the workstations, laptops, tablets, phones, servers, medical devices, removable media, printers and network equipment that store or reach electronic protected health information (ePHI), and the ones your systems run on. It keeps an inventory that supports the HIPAA Security Rule's workstation and device and media controls (45 CFR § 164.310(b)–(d)): where each device is, who has it, how it is protected, and how it was disposed of. The policies and procedures those standards require belong in Policies, and facility access controls (§ 164.310(a)) are not recorded here. The register is for organization administrators.

What each device records

  • Name and kind, with its make and model, serial number and operating system.
  • Location: the site and room, or "With the assignee" for a portable device. A location is an attribute of a device, not a separate register.
  • Assigned to: the member of your organization who has it, if anyone. A device keeps its assignee when that person leaves the organization, marked as no longer an active member, until you change it.
  • Handles ePHI: Yes, No or Not known. A device whose answer is Not known is counted as one that may handle ePHI until you say otherwise.
  • Encryption, and how the device is encrypted. Encryption is an addressable implementation specification of the Security Rule (45 CFR § 164.312(a)(2)(iv)): you assess whether it is reasonable and appropriate for the device and implement it if it is; if it is not, you document why and implement an equivalent alternative measure if that is reasonable and appropriate (§ 164.306(d)(3)). Addressable does not mean optional.
  • Screen lock: whether the screen locks when the device is idle, one physical safeguard for a workstation (§ 164.310(c)).
  • Automatic logoff: after how many minutes of inactivity a session ends (§ 164.312(a)(2)(iii), addressable).
  • ePHI last removed: when, and how, the ePHI on the device was removed before re-use, return to a lessor or repair (§ 164.310(d)(2)(ii)). It is kept on any status, so a device wiped and reassigned keeps the record.
  • Last and next review, for your own review cycle.
  • Systems that run on it: each system you link lists the device in the Safeguards section of its page.

Leaving service

A device's status is In use, Retired, Lost, Stolen or Disposed of.

  • A device marked Disposed of must record when, and how the data on it was removed or destroyed; a disposal is recorded only on that status. Backsplice asks for both. The record supports, but is not itself, the policies and procedures the Security Rule requires for the final disposition of ePHI and/or the hardware or electronic media it is stored on (§ 164.310(d)(2)(i), required).
  • A device marked Lost or Stolen shows a link to record an incident. If it held protected health information, its loss may be a breach of unsecured protected health information unless that information was secured as the HHS guidance specifies (encryption that meets it, with the key not also compromised); a device recorded here as Encrypted does not settle that. The incident's PHI questions take you through the assessment and any notifications.

Remove a device only when it was recorded in error. A device disposed of, lost or stolen cannot be removed: its record is the evidence of how it left your hands. A retired device is kept too, so its last recorded state stays on the record. The register keeps each device's current location and assignee, not a history of its movements: a record of the movements of hardware and electronic media and the person responsible (§ 164.310(d)(2)(iii), addressable) is not kept here.

The register

The register lists each device with its location, whether it handles ePHI, its encryption, how many systems run on it, its status and its last review, and counts the devices in use, those that may handle ePHI, those of them not known to be encrypted, and any lost or stolen. Filter by status, kind, ePHI or encryption, or search by name, location or serial number; the CSV export carries the same filters.

This register records what you tell it. It does not scan or inventory devices itself, and a device recorded as encrypted is your statement, not a test.