164.310(d)(1) device and media controls: what to prove

What 164.310(d)(1) device and media controls require in practice

The standard requires policies and procedures governing the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and their movement within it. If an auditor or customer questionnaire asks how devices and media holding ePHI are tracked and retired, the answer must show written procedures that cover each of those three movements, plus evidence that people follow them. The risk is concrete: a lost laptop, a backup drive left in a shared office, or a server pulled from a rack and sent to resale without its storage being wiped can each expose ePHI with no breach of any system. The difficulty is that the records needed to answer these questions rarely sit in one place. Hardware lists may live with IT, lab and imaging equipment with clinical engineering, leased devices with a vendor, and virtual disks in cloud accounts that no one on the facilities team can see.

The standard has four implementation specifications. Disposal and media re-use are required, so every covered entity and business associate must have them. Accountability (a record of hardware and media movements and the person responsible for each) and data backup and storage (making a retrievable exact copy of ePHI before equipment is moved) are addressable, which means you must assess whether each is reasonable and appropriate, document the outcome, and adopt an equivalent measure where one is not. Confirm with your own risk analysis which assets carry ePHI before deciding how far each addressable specification needs to go. The January 2025 proposed rule would rename this standard technology asset controls, but that change was proposed, not finalized, as of October 2026, so current audits still test the 164.310(d)(1) wording.

A practical first step is to build one inventory that links every device and medium that stores or touches ePHI to an owner, a location and a lifecycle status, then check that the inventory covers vendor-managed and cloud-hosted items. Ask each vendor for its sanitization and destruction certificates before equipment leaves your control, and confirm the method against the HHS guidance on media sanitization your organization relies on. Fixed-scope help from an implementation partner can set up the asset records and the disposal and re-use workflow, but the organization still owns the policy, its approval and the evidence that it operates. An independent assessor decides whether the controls pass.

Which devices, media and third parties fall under device and media controls

Device and media controls reach every place ePHI can sit outside an application: endpoints, storage, backups, print paths, cloud volumes and the vendors who touch them. Each category below changes who owns disposal, re-use and movement records, and which ones need written terms before any data moves.

Laptops and servers

Laptops, desktops and servers that hold or cache ePHI are the core inventory. Record each device against its owner, location and the ePHI it stores, because accountability under 164.310(d)(2)(iii) depends on knowing where every unit went. Check whether local disks are encrypted, whether developers copy patient extracts to laptops, and how decommissioned machines are sanitized before they leave your control. Inventory is the starting point for every other card.

Removable media and portable drives

USB drives, external disks, optical discs and memory cards are easy to lose and hard to track. Decide whether ePHI may be written to them at all, and if so, which approved devices are issued, how they are labeled, and who signs them out. Media re-use procedures and disposal both depend on this list being complete, so include removable media in the same asset records as fixed storage.

Backup tapes and disks

Backup copies are the most common place ePHI survives after production systems are cleaned. Identify every backup set, its retention period, its off-site location and the media it lives on. Addressable data backup and storage under 164.310(d)(2)(iv) asks you to make a retrievable exact copy before equipment moves, so confirm that backup catalogs can be reconciled to physical media and that retired tapes follow the disposal process.

Copiers and multifunction printers

Many multifunction printers and copiers contain hard drives that store scanned and printed images, and they are often leased and returned to the vendor. Ask whether these devices hold storage, whether it is encrypted or overwritten, and what happens at lease end. Treat them as devices in scope, not office equipment, and document them in the same inventory as computers.

Mobile devices and remote endpoints

Phones, tablets and personal devices used for email, messaging or EHR access can hold ePHI in caches and attachments. Decide which devices are managed, whether remote wipe is available, and how lost or replaced devices are recorded. Remote workstations sit at the boundary between this standard and workstation use, so check that home-based equipment is included in your movement and disposal records.

Cloud volumes and snapshots

Cloud block storage, object buckets, managed databases and snapshots are electronic media in practice, even though no physical device is handled. Confirm which volumes and snapshots contain ePHI, who can create copies, how long snapshots persist and how deletion is verified. Your business associate terms should state how the provider disposes of data and what it returns when the contract ends.

Hosting providers, shredding vendors and lessors

Third parties that take custody of ePHI-bearing equipment or media need written terms before handover. Hosting providers, certified destruction firms and equipment lessors may all be business associates or subcontractors, depending on whether they can access the data. Ask each vendor for its sanitization method, chain-of-custody steps and certificate of destruction, and confirm the contract requires notice of incidents. Verify what each agreement actually covers before you rely on it.

How an assessor tests device and media controls and what they ask for

This table compares what an assessor does, asks for and typically finds across the five areas of 164.310(d)(1): policy, inventory and movement, disposal, re-use and backup before movement. Read each row as a sample-based test, where a finding usually means the paper record and the actual device history do not match.

Area	What the assessor does	Evidence requested	Common findings when records do not match
Policy and procedures	Reads the written rules for receipt, removal and movement of hardware and media holding ePHI, then asks staff to walk through a real case.	Approved policy with version and approval date, owner named, and procedures that match what staff describe.	Procedures exist but cover only laptops, or staff describe a practice the written policy never mentions.
Inventory and movement records	Picks a sample of devices and media from the inventory, then traces each one through receipt, transfers and removal from the facility.	Asset register with unique identifiers, custodian, location history and sign-off on each movement.	Devices in the field with no inventory entry, or inventory entries with no custodian or stale locations.
Disposal and sanitization	Selects devices retired in a recent period and checks that each one reached a documented sanitization or destruction step.	Disposal log, sanitization method used for each item, and vendor certificates of destruction where a third party handled the media.	Retired drives missing from the log, certificates that do not name the serial numbers sampled, or sanitization described only as deletion.
Media re-use	Checks that media returned to service were cleared of ePHI before reuse, inside or outside the organization.	Re-use procedure, sanitization records tied to the device, and sign-off before the item was reissued.	Devices reissued to another department or returned to a lessor with no clearing record, or clearing verified only by assumption.
Accountability and tracking	Compares physical checks, such as spot counts or walk-throughs, against the asset register to see whether the register is accurate.	Records of periodic reconciliation, movement logs and the named person responsible for each device class.	Discrepancies between counted devices and the register that were never investigated or closed.
Data backup before movement	Asks whether a retrievable exact copy of ePHI was made before equipment was moved, and checks a sample of moves against that step.	Backup records or a documented decision that no ePHI was present, dated before the move.	Equipment moved for repair or relocation with no backup record and no documented reason the step was not needed.

How to implement device and media controls in six steps

This sequence moves hardware and electronic media from an unmanaged state to one where every device holding ePHI has a named owner, a recorded location, a documented route in and out of the facility, and a tested path to disposal or re-use.

Name a single accountable owner
Assign one named person, usually the security official or a delegated asset owner in IT, to hold responsibility for device and media controls. Record the appointment in writing with the scope it covers, including on-premises servers, workstations, laptops, removable media, backup tapes and any cloud-hosted storage that the organization controls. The output is a signed role description or policy assignment that names the owner, the systems in scope and the people who must report to them. You know this step is done when an auditor could ask who handles a missing drive and get one answer.
Build or reconcile the hardware and media inventory
Collect every device and medium that can store or transmit ePHI, then match the list against what is actually on the network and in storage rooms. Discovery tools help here. GLPI's Assets module can hold computers, network equipment, peripherals and racks, populated manually or by the GLPI Agent, and Wazuh's Syscollector can report hardware and installed software from each endpoint it monitors. Confirm each tool's coverage in your own environment before relying on it. The output is one inventory with an asset identifier, device type, ePHI status, physical location and assigned custodian for each item. Done means spot checks of the storage room and a sample of desks find no unlisted ePHI-bearing equipment.
Write the receipt, movement and removal procedure
Document how hardware and electronic media arrive at the facility, how they move between rooms or sites, and how they leave, including repairs, lease returns and transfers to another party. Describe who signs for each movement, which form or ticket records it, and what happens when equipment is taken off site for remote work. Tie each route to the inventory identifier so a movement updates the record. The output is a written procedure with a movement log template. Done means a staff member can follow it for a laptop, a server drive and a box of removable media without asking for help.
Define sanitization and re-use methods
Set the methods your organization uses to remove ePHI before media are reused inside or outside the organization, and the methods used for final disposal. NIST SP 800-66 Rev. 2, section 5.2.4, lists four activities for this standard: implement methods for final disposal of ePHI, develop procedures for re-use of electronic media, maintain accountability for hardware and electronic media, and develop data backup and storage procedures. Use that list as a checklist and confirm each item has a written method. Ask the vendor of each storage type which sanitization approach it supports, and record the verification step. The output is a sanitization standard with a method per media type and a sign-off checklist. Done means every item in the NIST checklist points to a document.
Set the backup-before-move step
Before any device that holds ePHI is moved, repaired or retired, require a retrievable, exact copy of the data to be made and verified, unless the move makes that impossible and the reason is documented. This addressable specification is narrower than the contingency backup plan, so keep the two linked but separate. The custodian confirms the copy in the movement log, and the storage location of the copy is recorded with the same inventory identifier. The output is a backup-before-move checklist attached to the movement procedure. Done means a test move of a sample device produces a log entry showing the copy was made and where it sits.
Run a first record walkthrough
Pick several items from the inventory, trace each through its movement log, backup record and disposal or re-use entry, and check that the records agree with what is physically present. Include at least one device that was moved, one that was repaired and one that was retired, if your environment has them. Record each gap, assign a fix and date it. Assessors test this kind of traceability, so the walkthrough is also a rehearsal for evidence requests. The output is a dated walkthrough report with exceptions and corrective actions. Done means the exceptions are closed or accepted in writing by the owner from step one.

Which evidence satisfies device and media controls and how to keep it current

Assessors testing 164.310(d)(1) look for written rules, a working inventory, and records that show those rules were followed for real devices. The cards below cover the artifacts that carry that proof, how often each should be refreshed between audits, and the gaps that cause a sampled item to fail.

Written device and media policy

The policy and procedures govern how hardware and electronic media containing ePHI are received, removed from a facility and moved within it. Assessors check that the document names owners, covers every media type in use (laptops, drives, backup tapes, phones), and matches what staff actually do. Review it at least once a year and after any change in facilities, cloud providers or disposal vendors. A sample fails when the policy describes a process the team no longer follows.

Asset register with movement history

An inventory that records each device or medium holding ePHI, its location, the person responsible, and every movement between sites or users supports the accountability specification. Open-source asset tools such as GLPI can hold this register, and inventory agents such as Wazuh Syscollector can confirm what is actually on the network. Reconcile the register against discovery data monthly and after each quarter's hardware changes. A sample fails when a device in the logs has no owner or a movement has no dated entry.

Disposal and sanitization records

For each retired drive, server or backup medium, keep a record of the sanitization method used, the date, the operator, and the serial number that links the record to the asset register. Where a vendor destroys media, retain the certificate of destruction that names the items destroyed. Confirm the method against current HHS guidance for sanitization before you write it into procedure. A sample fails when a certificate lists no serial numbers or the register still shows the device as active.

Media re-use sign-off records

Before a device returns to service or passes to another user, a signed record should confirm that ePHI was removed and the removal was verified. The sign-off should name the technician, the tool or procedure, and the verification step. Refresh these records each time a device is re-issued, and sample them against the asset register at audit time. A sample fails when a re-issued laptop has no sign-off or the record names a procedure the team does not use.

Backup-before-move logs

When equipment that holds ePHI must be moved, the addressable backup and storage specification expects a retrievable exact copy to exist first. A log entry should record the device, the backup job or copy location, the completion check, and the person who approved the move. Review the logs against scheduled moves and confirm restores have been tested. A sample fails when the move happened without a log entry or the backup was never verified as restorable.

Exception records for addressable specifications

For each addressable specification the entity decides not to implement as written, it must document why it is not reasonable and appropriate and what equivalent measure it uses instead. Keep a dated decision record for every such choice, signed by the security official, and review it at least once a year. Confirm the rationale still holds when the environment changes. A sample fails when a skipped specification has no decision record or the equivalent measure is not actually running.

What meeting device and media controls costs in money and effort

This table lists the cost components of meeting 164.310(d)(1) device and media controls, who is paid for each, whether it is one-time or recurring, and what drives it up or down. Use it to build a quote request, since no price or duration is supplied for this standard and the real figures depend on your fleet, sites and vendors. The main takeaway is that most of the cost is internal labor and recurring evidence upkeep, and open-source inventory tools mainly remove license spend rather than the work of keeping records current.

Cost component	Who is paid or who does the work	One-time or recurring	What drives it up or down
Tooling or licenses for inventory and tracking	Software vendor or open-source project; self-hosting shifts cost to infrastructure and staff time	Recurring for commercial licenses; one-time setup for self-hosted tools	Number of devices and sites; self-hosted platforms such as GLPI remove per-seat license spend but not hosting or upkeep
Engineering time to build the device inventory	Internal IT staff or an implementation partner under a fixed-scope agreement	One-time	Fleet size, number of locations, how many asset sources exist (MDM, HR, procurement, spreadsheets) and how much reconciliation is needed
Procedure writing for receipt, removal and movement	Internal privacy or security staff, or an outside consultant	One-time, then periodic review	Number of facilities, shipping and loan processes, and whether procedures already exist in the policy set
Sanitization, destruction or shredding services	Certified disposal vendor, or internal staff with tools and logs	Recurring, tied to each retired device or media batch	Volume of retired drives, media types (SSDs, tapes, mobile devices), and whether destruction is done on site or by a vendor
Evidence upkeep (disposal logs, movement records, backup checks)	Internal operations staff, with tool outputs feeding the records	Recurring	Device churn, cloud footprint that changes often, and how much of the record is automated versus typed in by hand
Data backup and storage before equipment moves	Internal infrastructure team or hosting provider	Recurring storage cost plus one-time procedure design	Amount of ePHI on each device, retention periods, and the backup platform already in use
External review or assessment of the control	Independent third-party assessor; an implementation partner can prepare evidence but does not issue reports	Usually one-time per review cycle, with recurring re-review	Scope of ePHI systems, number of covered and business associate relationships, and whether evidence is organized before the review starts
Auditor sampling and document requests during an assessment	Internal staff time to pull records; auditor fees under their own engagement terms	Recurring with each assessment or OCR inquiry	How quickly records can be produced, how many devices are sampled, and whether one central asset register exists

How GLPI and Wazuh produce the asset and movement evidence

Device and media controls depend on knowing what hardware and media exist, where they are, and what they hold. The two open-source tools below cover different parts of that record: GLPI holds the asset and custody register, while Wazuh collects what is actually running on endpoints. Neither one replaces the disposal and re-use procedures the standard requires.

GLPI asset register for accountability

The Assets module tracks computers, monitors, software, network equipment, peripherals, printers, phones and racks. Records can be entered by hand or populated automatically by the GLPI Agent through native inventory, which is built into GLPI since version 10. For the accountability specification, the useful part is the history attached to each item: who holds it, where it sits, and when it moved. Confirm that your GLPI release, plug-ins and licensing fit your environment, since GLPI is licensed under GPL-3.0-or-later and your legal team should review obligations that come with that license before you modify or redistribute it.

Wazuh Syscollector endpoint inventory

The Syscollector module collects hardware, operating system, installed software, network interfaces, open ports, services, users and Windows updates from each endpoint. It stores the results in the Wazuh indexer and displays them in dashboard inventory views and reports. This shows what a device held and how it was configured at a given time, which helps when you confirm that a device slated for disposal or re-use is the one you expect. Wazuh is licensed under GPL-2.0-only, so confirm the license terms against your deployment and any modifications you plan to make.

Where the records stop

Neither tool records the sanitization method used on a drive, the witness to destruction, or the certificate from a disposal vendor. Those artifacts belong to the disposal and re-use procedures under 164.310(d)(2)(i) and (ii), and they need their own written forms and retention. Treat GLPI and Wazuh as sources of supporting data, and ask your assessor which records they expect to see in the final evidence package.

Who owns device and media controls, what partners prepare and what auditors test

Your organization owns the device and media controls. Under 45 CFR 164.310(d)(1), the policies and procedures governing how hardware and electronic media containing ePHI enter, leave and move within a facility are your obligation, and no partner or auditor can take that accountability away. Your security official, privacy staff and facilities or IT leads decide what the rules are and who answers for them.

Policy ownership: Approve the written policies for receipt, removal and movement of ePHI-bearing hardware and media, and keep them current as systems change.
Asset register accountability: Name a person responsible for each device class and confirm that moves are recorded against that owner.
Disposal approval: Authorize the final disposition of any device or medium holding ePHI before it leaves your control, and confirm the sanitization method chosen.
Sign-off on re-use: Approve each reuse of electronic media only after ePHI has been removed under your documented procedure.
Vendor oversight: Review certificates of destruction and contract terms with any outside destruction or hosting provider.

Before relying on any of these controls, confirm internally that each role has a named owner and that the approvals leave a record you can produce on request.

Common questions about device and media controls and outside help

How much effort does it take to meet 164.310(d)(1) device and media controls?

The effort depends mainly on how many devices and media hold ePHI, how many places they move between, and how much of the process already exists in writing. No supplied figure gives a standard duration, so treat any estimate as something to test against your own inventory. The main workload falls into four pieces: writing policies and procedures for receipt, removal and movement of hardware and media, building an asset register that records who holds each device, sanitizing or destroying media at end of life, and running backup and storage steps before equipment moves. Each piece recurs as devices are added, retired or reassigned, so the effort does not end at go-live. Ask any provider to break its estimate into these pieces and to state which ones it assumes your staff will perform.

How long does a device and media controls project usually take?

Timing depends on the size of the estate, the state of existing asset records and how quickly approvals move through your organization. No researched duration applies to every organization, so do not accept a generic timeline without a written scope. Ask the provider to list the milestones, such as inventory reconciliation, procedure drafting, tooling deployment, staff training and evidence collection, and to name the dependencies on your side, including access to asset data and sign-off from the security official. Also confirm whether the timeline covers a first assessment or only readiness work, because the two can be scheduled very differently.

What does the work need from our own staff?

Your staff must own the decisions that a provider cannot make for you. Those include naming the person responsible for each device and medium, approving disposal and re-use methods, confirming which locations are in scope, and accepting residual risk. Technical staff must also provide access to endpoint management, asset databases, backup systems and facility records, and they must be available to review configurations. Compliance or privacy staff should confirm which records count as ePHI in your environment. Ask the provider to list these responsibilities by role in the written scope so that gaps show up before work starts, not during an assessment.

Can we meet the device and media controls standard in-house?

Many organizations can, particularly when they already maintain an asset inventory and a documented disposal process. The question is whether your team has the time, the tooling and the independence to produce consistent evidence over time. The standard is not a one-time project: records of hardware movements, sanitization certificates and backup verifications must be kept current. If your team lacks experience with media sanitization methods, asset tooling or evidence collection, an outside partner can help configure systems and documents. Make the decision on capacity and skill, and remember that the organization always owns the control and the risk it accepts.

Is there a HIPAA certificate for device and media controls?

No. HHS states that no Security Rule standard requires an entity to certify compliance, and that HHS does not endorse or recognize private organizations' certifications. Such certifications also do not prevent HHS from later finding a violation. Any vendor that offers a HIPAA certificate should be asked to explain what it actually tests, who issued it and whether it covers the 164.310(d)(1) standard specifically. Your own evidence, such as written procedures, asset records and disposal logs, is what you present to the HHS Office for Civil Rights if it reviews your compliance. An independent assessor can test that evidence and report on it, but the assessor's report is not a HHS certificate.

Which parts of device and media controls can we outsource?

Several parts can be outsourced, while others should stay with your organization. Commonly outsourced work includes building the asset inventory, configuring discovery and inventory agents, drafting procedures for review, preparing backup and storage workflows, and collecting evidence for an assessor. Work that generally stays internal includes approving disposal methods, deciding who is accountable for each device, signing off on re-use decisions and owning the risk. For physical destruction or certified sanitization, confirm whether a specialist vendor will perform the work and provide certificates to you, because that vendor may need its own agreements under the Security Rule. Record the split in the scope document.

What should we confirm in a written scope before signing?

Confirm the following items in writing before work starts:

The exact systems, sites, device classes and media types in scope, including laptops, removable drives, backup tapes and cloud-hosted storage.
Which deliverables you receive, such as written procedures, configurations, inventory exports and evidence packs.
The roles each party performs, and which decisions remain with your security official.
Dependencies on your staff, access requirements and review cycles.
How changes to scope are priced and approved.
The handover of documentation and tooling after the engagement ends.

Also confirm that the provider prepares evidence and does not issue audit reports or certifications. An independent auditor or assessor performs that role.

Which open-source tools can produce evidence for device and media controls?

GLPI can hold an asset register covering computers, monitors, software, network equipment, peripherals, printers, phones and racks, entered manually or pushed automatically through the GLPI Agent, which has been built into GLPI since version 10. Wazuh's Syscollector module collects hardware, operating system and installed software details from each endpoint and stores them for inventory views and reports. Together they can support accountability records and show what was present on a given date. Neither tool performs media sanitization or validates that ePHI was removed, so you still need procedures and sanitization records. Confirm each tool's capabilities against the version you deploy before relying on it in an evidence package.

How DeployOpen scopes, implements and prepares evidence for device and media controls

DeployOpen helps organizations build and document the device and media controls behind 164.310(d)(1), using self-hosted open-source platforms inside the client's own infrastructure. The organization keeps ownership of its policies and decisions, while DeployOpen prepares the systems, records and evidence an independent assessor would review.

How we scope

Engagements start with a written scope that names the sites, device classes and media types holding ePHI.
The scope lists which disposal, re-use, accountability and backup steps DeployOpen will implement and which stay with the client.
Fixed-scope deliverables and timelines are agreed in writing before any work begins, so the quote follows directly from that scope.

How we build

Asset inventory is set up in GLPI, with assets entered manually or pushed by the GLPI Agent to track hardware holding ePHI.
Wazuh Syscollector inventory is configured on endpoints to record hardware, software and users for comparison against the asset register.
Disposal and re-use procedures are built as tested runbooks, with sanitization steps and sign-off points the client's staff can repeat.

How we hand over

Deliverables include configured systems, written procedures, and sample records showing how media movements are logged.
Evidence packs map each procedure to the matching implementation specification so the client's assessor can trace it quickly.
Handover covers the open items the client must confirm itself, such as addressable decisions and any alternative measures chosen.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can cover reviews of asset records, updates to disposal procedures and checks that inventory data stays current.
DeployOpen does not issue audit reports, attestations or certifications; the client engages an independent assessor for those decisions.

164.310(d)(1) Device and media controls