164.310(d)(2)(ii) Media re-use: requirements and evidence

What 164.310(d)(2)(ii) requires before media are reused

When an auditor or customer asks how drives and devices are cleared before reuse, the answer is that 45 CFR 164.310(d)(2)(ii) is a required implementation specification: the organization must have documented procedures for removing ePHI from electronic media before that media is made available for re-use. The specification applies whether the media will be reissued to another employee, returned to a pool, redeployed to a different department, or handed to someone outside the organization. Because it is required, there is no addressable alternative to document. The organization must show the procedure exists, that staff follow it, and that records show it ran. The risk is residual ePHI on media that leaves one use and enters another. A laptop reassigned internally, a workstation sent to a vendor for warranty repair, or a storage array returned to a lessor can all carry patient data if the procedure only deletes file references. Several things make this hard in practice: asset records that do not match what is physically in service, server and laptop disks that were never logged, virtual disks and cloud volumes that get detached and reattached without anyone tracking the data they held, and leased equipment that returns to the lessor with its storage intact. Inventory tooling such as GLPI's Assets module or Wazuh's Syscollector inventory can help identify which devices exist and which were last assigned to which system, but it does not sanitize anything by itself.

Which media and reuse paths fall under this specification

The specification applies wherever electronic media have held ePHI, not only where the data sits today. The cards below cover the reuse paths that most often escape the procedure, so each one can be checked against the inventory before a device or volume changes hands.

Internal reassignment between staff

A laptop or workstation moved from one employee to another is still electronic media that held ePHI. Reassignment is the most common reuse path and the one most often handled without a documented step. Check that the procedure runs on every reassignment, including devices returned to a shared pool, and that the person doing the reassignment is named in the record. Ask who signs off when a device is reissued without a sanitization ticket.

Redeployment to another department

Moving a server, storage array or workstation to a different business unit changes who controls the hardware but not the ePHI it may still contain. Confirm that the receiving department is not handed media that still hold patient data unless the sanitization step has already run. Record the move in the asset register so the device can be traced from its original location to its new one.

Return to a vendor or lessor

Leased equipment, warranty replacements and devices returned for repair leave the organization's control. The procedure must make sure ePHI is removed before the media go back, or that the vendor is bound by contract to handle them. Ask the vendor for its sanitization method in writing, and keep a record of which drives were returned and when. Failed drives sent back under warranty are a frequent gap.

Cloud volumes and snapshots

Block volumes, object storage buckets and point-in-time snapshots can keep ePHI after the instance using them is deleted or resized. Reuse in the cloud happens when a volume is detached and attached to another workload or when a snapshot is shared or restored elsewhere. Confirm which provider-side deletion and overwrite behavior applies, and document the steps you rely on rather than assuming the platform handles it.

Backup media and removable media

Tapes, external drives, USB sticks and replicated backup sets are easy to lose track of because they rarely appear in daily inventories. A backup set reused for a different purpose or a removable drive passed between staff falls under this specification if it has ever held ePHI. Keep a register of removable and backup media, label them, and make sure rotation schedules include a sanitization step before reuse.

Multifunction devices with storage

Printers, copiers and scanners with internal hard drives or flash storage can retain scanned and printed ePHI long after the job completes. These devices are often leased and returned without anyone reviewing the storage. Include them in the asset inventory, confirm whether the device stores images or documents, and ask the vendor how the storage is cleared at end of lease or replacement.

How an assessor tests media re-use procedures

An assessor testing 164.310(d)(2)(ii) starts by asking whether a written media re-use procedure exists and whether it says who may authorize a device to leave storage for reuse, which sanitization method applies to each media type, and how the sanitization is verified and recorded. The assessor then asks for proof that the procedure is followed in practice. A policy that names no method, no owner and no record format will usually fail before any device is examined, because the procedure is the thing the regulation requires to exist. Reference points for what a reasonable procedure covers are HHS's Security Rule guidance materials, which list NIST SP 800-88 as an informational resource, and NIST SP 800-66 Rev. 2, which treats developing and implementing reuse procedures as a key activity under device and media controls (section 5.2.4). Read both for orientation, not as a checklist to copy word for word.

The evidence test is a trace. The assessor selects a sample of devices or media that were reused during the review period, often drawn from the IT disposal or redeployment queue, and follows each one backward. For every sample item they expect to see the asset record showing the device's identity and prior assignment, a sanitization record with the date, the method, the tool or procedure used, the operator, and a verification result, and then the redeployment or reissue record that links back to that sanitization. A gap at any link, such as a reissued laptop with no sanitization entry, is the finding an assessor is most likely to write up. Before the review, confirm with your own records team that every reuse event produces all three records, and that they can be retrieved for a sample within a short working period.

What assessors request and where findings usually appear

This table lists what an assessor or OCR investigator typically asks for to test media re-use under 164.310(d)(2)(ii), the evidence that answers each request, and the gaps that tend to produce findings. Read each row as a test: if the evidence cannot be produced on request, the control is harder to show as operating.

Assessment item	Evidence typically requested	Where findings usually appear
Written re-use procedure	Current policy or procedure covering every class of electronic media that holds ePHI, with an owner and revision date	Procedure states that media will be cleaned but names no method, tool or standard to follow
Sanitization method selection	Documented method for each media type (for example, overwrite, cryptographic erase or physical destruction) and the reason it was chosen	Method is described generically, or the same method is applied to SSDs, hard drives and mobile devices without justification
Sanitization records	Log or ticket for each device reused, showing asset identifier, date, method, operator and outcome	Devices are reused with no sanitization record, or records exist only for a sample the organization selected
Verification step	Evidence that sanitization was checked, such as a verification report, sample read-back or tool output	Procedure requires sanitization but no one verifies it, or verification output is not retained
Asset linkage	Inventory record that ties each reused device to its previous assignment and to the ePHI it may have held	Asset inventory cannot show which devices previously stored ePHI, so the scope of re-use cannot be confirmed
Reuse outside the organization	Procedure and records for media returned to a vendor, leased equipment or loaned devices, including vendor certificates of sanitization	No contract term or certificate covers media that leaves the organization, or certificates do not name the devices
Ownership and training	Named role responsible for re-use, and training records for staff who perform or approve sanitization	Responsibility is unassigned, or technicians cannot describe the procedure when asked
Exceptions and failed sanitization	Log of sanitization failures, the action taken and the record that the device was withheld from re-use	Failed devices are returned to stock, or failures are not recorded at all

How to implement media re-use controls in order

This sequence takes media re-use from an informal habit to a documented, tested control that shows ePHI is removed before any device or medium leaves the storage pool. Each step produces a record an assessor can check.

Define the reuse triggers
Start by listing every event that sends electronic media back into service: reassignment to another user, return from a lease or repair, redeployment to a different department, and transfer to a shared pool. Compliance, IT operations and the security official agree on the list and write it into the device and media controls policy. Done means the trigger list is approved, versioned and linked from the asset procedure, so no device can be reissued without passing through one of the named triggers.
Choose sanitization methods per media type
For each media type in your environment, such as spinning disks, solid-state drives, removable USB media, mobile devices, and network or printer storage with embedded memory, select a removal method and record why it fits. NIST SP 800-88, *Guidelines for Media Sanitization*, is an informational resource that HHS lists in its Security Rule guidance, so use it to frame the choices rather than treating it as a binding standard. Done means a table maps each media type to a method, a verification approach and the person authorized to apply it.
Assign ownership for each reuse step
Name an accountable owner for each stage: the person who removes the device from service, the technician who performs sanitization, the reviewer who checks the result, and the manager who authorizes return to inventory. Where a third party performs sanitization, the contract must state that party's duties. Done means a RACI-style assignment exists, and each named person has accepted the duty in writing.
Build the sanitization log
Create a record template that captures the asset identifier, media type, prior assignment, trigger, method used, tool or vendor, operator, date, and the result of verification. An asset inventory tool such as GLPI's Assets module can hold the device record and link it to each sanitization event, and a Wazuh Syscollector inventory can confirm which endpoints still report stored software and users. Done means every reuse event generates one log entry with no mandatory field left blank.
Verify each sanitization before release
Before a device returns to inventory, a second person checks the log entry against the device and confirms the method ran to completion. Verification can include reviewing tool output, confirming that no prior user data or accounts remain, and confirming that encryption keys were destroyed where applicable. Done means the reviewer has signed or approved the entry, and any failed or unclear result has been pulled from service and escalated.
Test the process with a sample reuse
Select a few representative devices, load known test data onto them, run them through the full reuse path, and then attempt to recover that data with appropriate tools. This shows whether the method, the log and the handoffs work in practice. Done means the test results, including any gaps and corrective actions, are recorded and the procedure is updated before the next full reuse cycle.
Confirm the control with your assessor
Gather the trigger list, method table, ownership assignments, sample log entries and test records into one evidence folder for the control owner. Ask your independent auditor or assessor what form of evidence they expect for this specification, since assessors, not implementation partners, decide sufficiency. Done means the evidence set is complete, indexed to 164.310(d)(2)(ii), and reviewed at least as part of the periodic evaluation of the program.

Evidence that proves media were cleared before reuse

Clearing media before reuse is only provable through records. The cards below cover the written procedure, the per-device sanitization log, verification, custody of returned media, exceptions and the periodic review that keeps all of it current between audits. Each item should be produced as a normal byproduct of work, not assembled the week before an assessment.

Written media reuse procedure

The procedure states which media types are covered, who authorizes reuse, which sanitization method applies to each media type and what must be recorded before a device goes back into service. It should cover internal reuse and reuse after a device leaves the organization, since 164.310(d)(2)(ii) applies to both. Check that the document names an owner, a version and a review date, and that staff who run the process can point to it. NIST SP 800-66 Rev. 2 treats developing this procedure as a key activity of device and media controls.

Per-device sanitization log

Each sanitization event needs its own entry with the device serial number, asset tag, media type, date, method used, the person who performed it and the person who approved reuse. A log that says only "laptops wiped this quarter" will not show that a specific device holding ePHI was cleared. An inventory tool such as GLPI can hold the asset record that the log entry links to, so the serial number in the log matches the asset the organization tracks.

Verification records after sanitization

Sanitization should be checked before the media returns to use. Record what the check was, such as a read-back or a scan confirming that no prior data remains, the result and the person who verified it. Keep the verification output as a file, not a checkbox. For devices that cannot be verified, the record should show that the device was destroyed or held out of service instead. Ask your technician how verification failures are escalated.

Chain of custody for vendor returns

When leased, warranty or failed drives leave the facility, the organization needs a record of who handed them over, the shipping or pickup reference, and the vendor's written statement of how it handles media. The custody record should show the device serial numbers at each handoff. Confirm the business associate agreement covers the vendor's handling of ePHI on returned media. Without this chain, a vendor that receives a drive has no documented link to the organization's sanitization step.

Exception and destruction records

Some media cannot be sanitized in place, such as a drive that fails during wiping or a device with a damaged controller. Record each exception with the reason, the interim control applied, the approval and the final disposition, whether that is physical destruction or retention under lock. Exceptions reveal where the procedure does not match reality, so reviewers should read them first when assessing the program. Keep the exception register separate from routine logs so it is easy to find.

Periodic review and update cycle

Set a recurring review of the reuse procedure, the sanitization method list and the sample of logs against the asset inventory. The review should check whether devices in the inventory without a matching sanitization record were actually reused, and whether the methods still match the guidance the organization relies on. Record the review date, the reviewer and any changes. Monitoring tools such as Wazuh can show installed software and hardware on endpoints, which helps confirm a device was reconciled. Confirm the review interval with your own compliance lead, since the rule sets none.

What meeting media re-use controls costs

This table breaks down the cost components of meeting 164.310(d)(2)(ii) for media re-use, showing who is paid, whether each cost is one-time or recurring, and what drives it. Use it to build a quote request, because no price or duration for these components is published in the Security Rule itself.

Cost component	Who is paid or who carries it	One-time or recurring	What drives the cost
Sanitization tooling or licenses	Software vendor, or open-source project with no license fee	Licenses recur if commercial; open-source tooling removes license spend	Number of media types, whether vendor-specific erase tools are required, and support terms
Engineering time to write re-use procedures	Internal staff or an implementation partner preparing the written procedure	One-time, with periodic revision	Number of asset classes, complexity of hosting models, and how many systems share media
Asset-record upkeep	Internal IT or asset management staff	Recurring	Volume of devices and media, rate of turnover, and whether records are pushed automatically by an inventory agent
Verification effort	Internal staff or a contracted technician who checks sanitization and records the result	Recurring per reuse event	Number of media released for reuse, and whether verification is sampled or done for every item
Vendor contract clauses	Legal and procurement teams, and the vendor that signs the terms	One-time at contract signing, with renewal reviews	Whether hosting or disposal vendors handle media, and whether they must return or destroy ePHI on termination
External review and auditor sampling	Independent assessor or auditor, paid by the organization	Recurring at each assessment cycle	Scope of media in the assessment, quality of records, and how many items the assessor samples
Staff training on re-use steps	Internal training owner or a training provider	Recurring when staff or procedures change	Staff turnover and the number of teams that release or reassign hardware

Open-source tools that support media re-use evidence

Re-use evidence starts with knowing which devices and media exist, where they sit and whether they hold ePHI. The two open-source tools below can supply part of that picture, but they record what happened to a device, not whether its data was destroyed.

GLPI Assets as the asset record

GLPI's Assets module tracks computers, software, network equipment, peripherals, printers and racks, and it is available under GPL-3.0-or-later. Entries can be typed in manually or pushed automatically by the GLPI Agent through native inventory, which has been built into GLPI since version 10. For re-use, the asset record is the anchor: each device or disk should show its owner, location, assigned user and status history. Confirm that your team records ePHI status on the record, since the tool does not determine that on its own.

Wazuh Syscollector for hardware inventory

The Wazuh Syscollector module collects hardware, operating system, installed software, users and services from each endpoint and stores the results in the Wazuh indexer, where dashboards and reports can show them. Wazuh is licensed under GPL-2.0-only. For re-use, Syscollector helps confirm that a machine returned to the pool is the same device recorded in the asset register and that it was last seen running the expected configuration. Check that agents are installed on every endpoint that can hold ePHI before you rely on the data.

Matching inventory to reuse triggers

A reuse trigger is any event that moves a device from one user or purpose to another, such as reassignment, lease return or redeployment to a different department. Build a rule that opens a reuse ticket whenever GLPI shows a status change, and require a matching Syscollector record showing the device was checked before it went back into service. Illustrative example: a laptop returned from a departing employee should show a closed reuse ticket and a fresh inventory snapshot before it appears as available. Document the exceptions.

Gaps the tools cannot close

Neither tool performs sanitization, verifies that overwrite or cryptographic erase completed, or proves that a drive was destroyed. Inventory data can also be stale when agents are offline or when removable media never appear in the record. Treat sanitization records, such as the method used, the operator, the date and the verification result, as a separate evidence set. Confirm with your sanitization vendor or internal team which method follows NIST SP 800-88, which HHS lists as an informational resource.

Reconciling records for assessors

An assessor testing this specification will ask for a sample of reused media and the trail behind each one. Export the GLPI asset history and the matching Wazuh inventory records for the same serial numbers, then link them to the sanitization log. Gaps between the three sources are findings you should resolve before the assessment. Ask your auditor which sample size and format they expect, since requirements for evidence vary by engagement.

Who owns media re-use, who helps, and what the auditor checks

The covered entity or business associate owns the media re-use requirement under 45 CFR 164.310(d)(2)(ii). Regulators hold the organization responsible for what happens to ePHI on a reused drive, whether the work is done by staff, a vendor or a hosting provider. Your security official and the owners of the systems that store ePHI decide what the procedure requires and approve it.

Written procedure: Define when media must be sanitized before reuse, who authorizes the reuse and which method applies to each media type.
Ownership decisions: Name the accountable role for each class of device, including laptops, servers, backup appliances and removable media.
Exception handling: Document what happens when sanitization fails or media cannot be wiped, such as a destruction path.
Vendor oversight: Keep contract terms and records for any third party that sanitizes or disposes of media on your behalf.
Retained evidence: Keep sanitization logs and approvals in a form you can produce to an assessor or OCR.

Confirm that a named person can explain the procedure end to end without consulting the vendor.

Where media re-use controls usually fail

Most media re-use failures are not about a missing policy. They happen where the procedure never reached a particular kind of storage, where a device left the inventory without a trace, or where someone else handled the hardware and nobody checked the result. Each card below names one gap and the check that closes it.

Cloud and virtual disks left out

Procedures written for laptops and servers often skip virtual machine disks, snapshots, object storage buckets and managed database backups. Those copies of ePHI are still electronic media, and they are reused or released when a volume is deleted or a tenant is downsized. Check that the procedure names each storage type your environment actually uses, and that someone confirms how each one is cleared or cryptographically erased before the resource is released.

Reused devices with no record

A drive pulled from one user's machine and issued to another often has no entry showing it held ePHI, when it was cleared, or who cleared it. Without that record, the organization cannot show that sanitization happened before reuse under 164.310(d)(2)(ii). Require that every device returned to the pool carries a ticket or asset record with its sanitization method, date and the technician's name.

Vendor returns outside the contract

Leased equipment, warranty replacements and devices sent to a repair depot often leave the organization before anyone wipes them, and the vendor's default terms may not promise sanitization. Review the contract for who erases the media, to what standard, and whether the vendor certifies it in writing. Where the vendor will not commit, plan to remove or destroy the media before it leaves the building.

Verification skipped after wiping

Many teams record that a wipe command ran but never confirm the result. A failed or interrupted erase on a drive with bad sectors can leave readable data behind, and the log will still say the step was done. Add a spot check after sanitization, such as attempting to read a sample of sectors or running a recovery scan on a subset of devices, and keep the result with the disposal record.

Inventory that misses removable media

Backup tapes, USB drives, external disks and removable flash media are easy to lose from view because they are not tied to a named machine. If the inventory lists only computers and servers, these items never reach the reuse checklist. Confirm that the asset register includes removable media, and that each item has an owner and a sanitization step before it returns to circulation.

Procedures with no named owner

A written re-use procedure is weak if no one is accountable for running it when a device comes back from a user, a lab or a project. Assign a named role for each step, including the person who signs off that verification is complete. Ask the security official to review the sign-off log during the annual risk analysis cycle.

How much work and cost does media re-use take?

Is there a HIPAA certificate for media re-use or the Security Rule?

No. HHS states that no Security Rule standard requires an entity to certify compliance, and that HHS does not endorse or recognize private organizations' certifications. A vendor offering a HIPAA certificate for sanitization or any other safeguard is selling a private attestation that HHS does not recognize, and it does not prevent OCR from later finding a violation. What satisfies the rule is your own documented procedure for removing ePHI before media are reused, plus records that the procedure was followed. Ask any provider which independent assessment they performed and what it covered, not which certificate they hold.

Is media re-use sanitization a one-time project or ongoing work?

Both. Writing the procedure, choosing sanitization methods for each media type and training the staff who run it is one-time work. Applying the procedure is recurring, because every drive, phone or server that leaves active use needs a sanitization step and a record. The volume of recurring work depends on how often equipment is retired or redeployed, which is why the asset inventory matters. Plan for the procedure to be reviewed whenever equipment types, storage technology or your reuse channels change.

What drives the cost of media re-use procedures up or down?

The main drivers are the number and variety of media types, whether sanitization happens in-house or through a vendor, whether devices are reused internally or sold, and how much of your fleet sits in cloud or hosted storage where you cannot physically control the media. Organizations with many device types and external reuse channels spend more on verification and documentation. Organizations with a short, standard fleet and a single internal reuse path spend less. Cost is not set by a single rate. It follows from the scope you define in writing.

What should a quote for media re-use procedures include?

Ask for the scope in writing, listed by asset class: workstations, laptops, mobile devices, servers, network equipment, removable media and backup media. Ask which sanitization method applies to each class, and whether the method comes from NIST SP 800-88, which HHS lists as an informational resource. Ask who performs the work, who keeps the records, how verification is done, what staff training is included and what recurring activities follow the initial build. Each line should show who is paid for which deliverable, so you can compare quotes on the same basis.

Can we do media re-use sanitization in-house?

Usually yes, if you have a documented procedure, trained staff and a way to prove each step. The Security Rule does not require outside help, and many organizations handle sanitization internally. The harder part is evidence: you need a record that ties each device to its sanitization method, the person who performed it and the date. If your staff already run an asset inventory, the work is mostly process design. If they do not, the first effort goes into building that inventory. An implementation partner can prepare the procedure, tooling and records, but the organization owns the decision and the outcome.

What do our staff need to do media re-use well?

Staff need a written procedure they can follow, clear ownership of each step and training on the methods approved for each media type. IT staff perform or supervise sanitization. A named owner, often in IT operations or the security function, approves exceptions, such as media that cannot be wiped because it has failed. Staff also need to know what to record and where. Time spent on training and checklists is a recurring cost, not a one-off, so build it into the operating schedule rather than treating it as finished after go-live.

How long does it take to put a media re-use procedure in place?

The honest answer depends on your inventory and the state of your records. No supplied timeline applies to every organization. The work usually runs in order: confirm which media hold ePHI, define a sanitization method for each class, write the procedure, pilot it on one device group and then extend it. Organizations with an accurate asset list move faster than those that must first find where their devices are. Ask any provider for a schedule tied to milestones in the written scope, and confirm it against your own environment before you commit.

Which tools help track the media that re-use procedures cover?

Asset and inventory tools make the procedure auditable. GLPI's Assets module records computers, monitors, software, network equipment, peripherals and other items, and can receive automatic inventory from the GLPI Agent. Wazuh's Syscollector collects hardware, operating system and installed software details from each endpoint for inventory views and reports. Neither tool performs sanitization. Confirm with each vendor which asset types and data fields you need, then check that the records support the device-level trail your procedure requires.

How DeployOpen scopes and evidences media re-use

DeployOpen plans, implements and documents the technical and procedural side of media re-use inside your own infrastructure, so the sanitization steps and their records exist before a device leaves service. The organization still owns the policy and the decision that a media item is clear for re-use, and an independent assessor decides whether the evidence meets the standard.

How we scope

Engagements are fixed-scope, with the in-scope device classes, storage types and reuse paths agreed in writing before work starts.
The written scope lists which systems feed asset records, such as GLPI or Wazuh inventory, and who approves each sanitization step.
Scope states which media leave the organization for reuse, such as leased or returned equipment, and which stay within the facility.

How we build

We configure asset inventory so each workstation, server and removable medium holding ePHI has a tracked record before reuse.
We define sanitization procedures aligned to the sanitization methods in NIST SP 800-88, adapted to each media type in your environment.
We build a re-use checklist and approval workflow that blocks redeployment until the sanitization record is complete.

How we hand over

Deliverables include the written re-use procedure, the sanitization log template and the asset inventory configuration with its export format.
We document test sanitization runs and their verification results so your team can repeat the process without us.
We hand over a short evidence guide listing what your assessor will ask for and where each record is stored.

How we support

Ongoing support, upgrades and periodic review of re-use records are available as a retainer after handover.
We can review new device classes or storage types before they enter the re-use process, with changes handled in a written scope.
Ask us to confirm in writing which records fall to your team after handover and which remain with an independent assessor.