Device and Media Controls
Implement policies and procedures to address the final disposition of ePHI, and/or the hardware or electronic media on which it is stored.
Implementation Guidance
• Device and media disposal procedures
• Data sanitization and destruction procedures
• Hardware disposal and recycling procedures
• Media destruction and disposal procedures
• Documentation and certification of disposal
• Regular review and update of disposal procedures
Key components:
- Device disposal procedures
- Media destruction procedures
- Data sanitization methods
- Disposal documentation
- Disposal certification
- Regular procedure review
Required Documentation
• Data sanitization and destruction procedures
• Hardware disposal and recycling procedures
• Media destruction and disposal procedures
• Disposal documentation and certification
• Disposal vendor agreements
• Regular review and update procedures
Best Practices
• Use proper data sanitization methods
• Implement secure hardware disposal
• Use certified media destruction
• Document all disposal activities
• Obtain disposal certifications
• Regular review and update of procedures
Common Violations
• Inadequate data sanitization procedures
• Insufficient hardware disposal procedures
• Poor media destruction procedures
• Inadequate disposal documentation
• Insufficient disposal certification
Testing Procedures
• Test data sanitization methods
• Verify hardware disposal procedures
• Test media destruction procedures
• Review disposal documentation
• Verify disposal certifications
• Review policy compliance
Implementation Resources
Download expert-developed templates and checklists to implement this control:
Quick Facts
Related Controls
Explore other controls in the Physical Safeguards category.
Workstation Use
Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the ...
Media Controls
Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, a...
Workstation Controls
Implement physical safeguards for all workstations that access ePHI, to restrict access to authorized users....
Need Help Implementing This Control?
Our certified HIPAA experts can help you implement this control correctly and efficiently.