Backup tape library access
Only backup operators on an access list can enter the tape room; checkout logs show who pulled disaster-recovery tapes — MP-2 restricts media access.
Media Access
High Risk
Moderate
Low Cost
MP-2 requires restricting access to digital and non-digital media to authorized individuals using organization-defined security measures. Media includes USB drives, external disks, backup tapes, CDs, printed medical records, films, and label printouts. Uncontrolled media access is a classic path for ePHI theft and accidental disclosure in clinics and hospitals.
Control Objective
Ensure only authorized personnel can obtain or use media that stores or may store ePHI, with accountability for custody.
Implementation Guidance
- Inventory media types in scope: removable digital media, backup media, paper charts, release-of-information outputs, and imaging media.
- Define who may access each type (roles) and under what approval (e.g., HIM for record releases, IT for backup tapes).
- Store media in controlled locations with access lists (pairs with MP-4).
- Use technical restrictions where possible (device control / USB allowlisting) aligned with MP-7.
- Log checkout/check-in for removable media and backup tapes; require dual control for high-sensitivity sets.
- Prohibit personal removable media for ePHI workflows unless explicitly approved and encrypted.
- Train workforce on media handling in AT-2/PL-4 acknowledgments.
- Include BA staff working onsite who handle media under escort or equivalent controls.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
USB drive at a nursing station
Device control blocks unauthorized USB storage; approved encrypted HIM export drives are the only removable media permitted for ROI jobs.
Paper chart pull for research
HIM authorizes temporary access to archived paper records; unauthorized clinical staff cannot browse the archive room freely.
Best Practices
- Role-based media access lists.
- Checkout logging for removable/backup media.
- Technical USB control where feasible.
- No personal media for ePHI.
- Cover paper and film, not only USB.
- Escort/control visiting BA media handlers.
Common Gaps & Violations
- Open drawers of unlabeled USB sticks.
- Anyone with badge access can take backup tapes.
- Personal thumb drives used for chart exports.
- Paper PHI left in unlocked bins.
- No record of who accessed release media.
Required Documentation
- Media access policy/procedure
- Authorized role lists by media type
- Checkout logs / access records
- Device control configuration summary
- Training acknowledgments on media handling
How to Test & Validate
- Attempt or review USB policy effectiveness on a sample workstation.
- Inspect tape/paper storage access lists vs badge rights.
- Sample media checkout logs for completeness.
- Interview HIM on ROI media issuance controls.
- Confirm personal media prohibition is enforced.
Audit Considerations
HIPAA device and media controls expect restricted access to media with ePHI. MP-2 evidence is authorization lists, technical restrictions, and custody logs.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.310(d) Device and Media Controls — policies governing receipt and removal of hardware/electronic media with ePHI.
- 164.310(d)(2)(iii) Accountability — maintain records of hardware/media movements where required.
- 164.312(a)(1) Access Control — limit access to ePHI including via media.
- 164.530(c) Safeguards — reasonable safeguards for PHI in any form, including media.
Compliance Tips
- One media custody log template for tapes, encrypted USBs, and overnight ROI packages.
- Pair MP-2 authorization with MP-7 use restrictions and MP-4 storage.
- Include printed wristband/label stock areas if they expose identifiers.
Frequently Asked Questions
Does MP-2 apply to paper records?
Yes — non-digital media is explicitly in scope; paper charts and printouts need authorized access controls.
How does MP-2 relate to MP-7?
MP-2 restricts who can access media; MP-7 restricts how/where media may be used on systems.
Are encrypted USBs still in scope?
Yes — encryption helps confidentiality, but access to the media itself must still be authorized and tracked.
References & Resources
- NIST SP 800-53 Rev. 5 — MP-2
- NIST SP 800-88 Media Sanitization (related lifecycle)
- HIPAA § 164.310(d)
- Related controls: MP-4, MP-5, MP-6, MP-7, AC-3
Related Guidelines
Related controls that commonly accompany MP-2.
Need Help Implementing MP-2?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.