Nightly backup cartridges
Tapes move from the library to a locked, fire-rated cabinet with badge-limited access until offsite courier pickup — MP-4 secure storage.
Media Storage
High Risk
Moderate
Low Cost
MP-4 requires physically controlling and securely storing digital and non-digital media within controlled areas, and protecting system media until destruction or sanitization per organizational policy. Controlled storage protects backup tapes, spare drives, archived charts, and export media from theft, environmental damage, and casual browsing — a core HIPAA physical safeguard for devices and media.
Control Objective
Store media containing or capable of containing ePHI in controlled, secured locations until it is sanitized, destroyed, or legitimately issued.
Implementation Guidance
- Designate controlled storage areas for backup media, spare disks, encrypted portable media, and paper PHI archives.
- Apply physical locks, limited badge access, and visitor restrictions to those areas (PE-3/PE-2).
- Protect against environmental threats appropriate to media type (fire, water, temperature/humidity for tape/archives).
- Separate media awaiting destruction in labeled, secured bins with chain of custody to MP-6.
- Encrypt digital media at rest when stored, especially portable and offsite sets (aligns with CP-6).
- Inventory high-value media in storage; reconcile periodically.
- Prohibit desk-drawer storage of ePHI USB drives and unsecured chart stacks in public clinical areas overnight.
- Document storage standards for BA-hosted or offsite vault media.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
HIM archive room
Paper records older than the EHR go-live sit in a badge-controlled room with environmental monitoring; former open hallway shelves are eliminated.
Spare clinic SSDs on a shelf
Used drives awaiting wipe were openly stored. MP-4 remediation places them in a sealed, logged destruction staging cage.
Best Practices
- Named controlled storage locations.
- Badge/lock access limited to need.
- Environmental protections for archives/tapes.
- Encrypted digital media at rest.
- Inventory and reconcile stored media.
- Secure staging for media pending sanitization.
Common Gaps & Violations
- Backup tapes on an open rack in a shared IT closet.
- Boxes of charts in an unlocked basement.
- Used hard drives piled for 'someday wipe'.
- Unencrypted USB stock in reception drawers.
- No inventory of what is in the vault.
Required Documentation
- Media storage procedure
- List of controlled storage locations
- Access control lists for storage areas
- Environmental/protection standards
- Inventory / reconciliation records
How to Test & Validate
- Tour storage locations for lock/access effectiveness.
- Compare badge access lists to authorized media handlers.
- Sample inventory accuracy for tapes/drives.
- Verify destruction-staging media is secured.
- Check encryption status of stored portable media.
Audit Considerations
Physical walkthroughs often find media left insecure. MP-4 is evidenced by controlled areas, access limits, and orderly custody through destruction.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.310(d) Device and Media Controls — control media with ePHI throughout its lifecycle including storage.
- 164.310(d)(2)(iv) Data Backup and Storage — physical/technical safeguards for backup media storage.
- 164.310(a) Facility Access Controls — storage rooms are facilities/areas requiring access control.
- 164.530(c) Safeguards — protect PHI in storage from unauthorized access.
Compliance Tips
- Label every media cabinet with owner and access approver.
- Put 'pending wipe' drives on the same audit trail as production backups.
- Photograph storage controls for evidence packs after remediation.
Frequently Asked Questions
Does cloud object storage count as MP-4?
MP-4 emphasizes physical control of media; cloud backups are primarily addressed via logical controls and CP-6/CP-9, but any physical media you still hold remains in MP-4 scope.
How does MP-4 relate to MP-6?
MP-4 secures media while retained; MP-6 sanitizes or destroys it at end of life.
Are empty spare drives in scope?
If they may have held ePHI or will enter ePHI systems, treat them as in-scope media under secure storage until verified clean.
References & Resources
- NIST SP 800-53 Rev. 5 — MP-4
- HIPAA § 164.310(d)
- Related controls: MP-2, MP-6, CP-6, PE-3
Related Guidelines
Related controls that commonly accompany MP-4.
Need Help Implementing MP-4?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.