Device and Media Controls
Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, and the movement of these items within the facility.
Implementation Guidance
• Media receipt and removal procedures
• Media movement and tracking procedures
• Media sanitization and disposal procedures
• Media inventory and management procedures
• Media security and protection procedures
• Media access control procedures
Key components:
- Media receipt and removal
- Media movement tracking
- Media sanitization
- Media inventory management
- Media security controls
- Media access controls
Required Documentation
• Media receipt and removal procedures
• Media movement and tracking procedures
• Media sanitization and disposal procedures
• Media inventory and management procedures
• Media security and protection procedures
• Media access control procedures
Best Practices
• Implement effective media tracking
• Use proper media sanitization methods
• Maintain accurate media inventory
• Implement strong media security controls
• Control access to media
• Regular review and update of procedures
Common Violations
• Inadequate media tracking procedures
• Insufficient media sanitization
• Poor media inventory management
• Inadequate media security controls
• Insufficient media access controls
Testing Procedures
• Test media tracking procedures
• Verify media sanitization methods
• Review media inventory management
• Test media security controls
• Verify media access controls
• Review policy compliance
Implementation Resources
Download expert-developed templates and checklists to implement this control:
Quick Facts
Related Controls
Explore other controls in the Physical Safeguards category.
Workstation Security
Implement physical safeguards for all workstations that access ePHI, to restrict access to authorized users.
Workstation Use
Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the…
Disposal of ePHI and Media
Implement policies and procedures to address the final disposition of ePHI, and/or the hardware or electronic media on which it is stored.
Need Help Implementing This Control?
Our certified HIPAA experts can help you implement this control correctly and efficiently.