164.310(d)(2)(iii) Accountability: requirements and evidence

What 164.310(d)(2)(iii) accountability requires and why it is hard

When an audit or customer questionnaire asks where ePHI devices are and who owns them, the answer has to come from a record. The specification in 45 CFR 164.310(d)(2)(iii) calls for maintaining a record of the movements of hardware and electronic media and of the person responsible for them. It is an addressable implementation specification, so the covered entity or business associate must first assess whether it is reasonable and appropriate. Under 45 CFR 164.306(d)(3), if it is, the entity implements it; if it is not, the entity documents why and adopts an equivalent alternative measure where that is reasonable and appropriate. Either way, the decision itself must be written down and defensible, because an assessor will ask for the reasoning as well as the outcome.

The risk is practical. A laptop that leaves an office without a check-out, a server decommissioned without a record, or a USB drive moved between sites can carry ePHI that no one can account for. When the organization cannot say which device held a record, who was responsible for it, or where it went, the breach analysis and the risk analysis both become harder to complete. Assessors who test this specification usually look for a current inventory, a named owner for each asset, and a trail showing how items moved between locations, people and states such as in service, repair, storage or disposal. Asking for a sample of moved devices and tracing each one back to its record is a quick way to test the control yourself before an assessor does.

This work usually stalls on data, not policy. Most organizations already have a written device policy, but the asset register is incomplete, duplicated across spreadsheets, or missing devices bought outside procurement. Before drafting any new procedure, confirm which systems count as holding ePHI, which asset sources are authoritative (procurement, directory, endpoint management, cloud accounts), and who signs off on each owner assignment. Open-source asset tools such as GLPI can hold the register and receive automatic inventory from agents, while endpoint telemetry from Wazuh can help confirm what is actually on the network. Neither tool decides whether the specification is met; that remains the organization's decision and an assessor's judgment.

Which devices, media and teams fall under 164.310(d)(2)(iii) accountability

Accountability under 164.310(d)(2)(iii) applies wherever hardware or electronic media can hold or reach ePHI, so scope starts with an inventory of those assets rather than with a policy. The decisions below determine which assets enter the record, who keeps it current, and how movements by outside parties are captured.

Servers, storage arrays and backup media

Physical servers, storage arrays, backup appliances and tape or disk media that hold ePHI are the clearest candidates for the movement record. Decide whether a rack-mounted device counts as one asset or whether each drive, controller and tape cartridge is tracked separately. Record each move between racks, data halls, sites and off-site storage, along with the named person responsible at each step. Ask the assessor to confirm how your granularity matches your risk analysis.

Laptops, mobile devices and removable media

Laptops, phones, tablets and USB drives are the assets most often lost or reassigned without a record. Decide whether personal devices enrolled for email or EHR access fall inside scope, since they can reach ePHI even when the organization does not own the hardware. Track issuance, reassignment, repair and return, and make the person holding each device identifiable at any point in time. Confirm with your security official how removable media used for transfers are logged.

Cloud and hosted assets

Cloud instances, managed databases and hosted virtual machines have no physical movement, but the record still needs to show where the ePHI resides and who controls it. Decide which provider-side objects are covered by your own inventory and which are documented through the provider's shared responsibility terms. Confirm with each hosting provider how it records physical media changes in its facilities, and retain that documentation with your own asset records. A business associate agreement is not a substitute for your own tracking.

Medical and clinical devices

Imaging systems, infusion pumps, monitors and diagnostic equipment often store or transmit ePHI and are frequently managed by clinical engineering rather than IT. Decide who owns the movement record for each class of device, and whether vendor-serviced equipment that leaves the site for repair is logged. Confirm the device identifier used in the record matches the one in your maintenance and biomedical systems, so a single movement does not appear under two names.

Responsibility split across IT, facilities and procurement

Accountability requires a named person for each movement, which means deciding who records it. IT typically owns logical assets, facilities owns moves between rooms and sites, and procurement owns receipt and disposal triggers. Assign one accountable owner per asset class, document the handoffs, and confirm who signs off on the record when equipment changes hands. Gaps often appear at handoffs, so review these with each team before the first assessment.

Third parties that move media

Couriers, repair vendors, shredding companies and off-site storage providers take custody of ePHI-bearing media. Decide whether the movement is recorded by your staff at hand-off, by the vendor under a contract, or both. Ask vendors to return chain-of-custody records with serial numbers and named handlers, and confirm the business associate terms cover custody and transport. Your own record should reference the vendor receipt so the responsible person is identifiable at every stage.

How an assessor tests device and media accountability

This table compares what an assessor does, what evidence they ask for and where organizations usually fall short when testing the accountability specification in 164.310(d)(2)(iii). Read each row as a question the assessor will ask, then check whether your records answer it. HHS and NIST SP 800-66 Rev. 2 are informational guidance, so the assessor's judgment and your documented decision drive the outcome.

Test area	Evidence requested	Common findings
Sampling asset records against devices	Asset inventory export, plus a sample of laptops, drives and removable media physically or logically located by the assessor	Inventory does not match live systems; devices present on the network are missing from the register
Tracing a device from procurement to disposal	Purchase record, assignment history, repair tickets, movement log and disposal certificate for the same serial number	Records stop at assignment; repair loans and off-site moves have no entry
Verifying named responsible persons	Owner field for each asset, with a current role holder and a reassignment record when staff change	No named owner; owner is a shared team mailbox or a departed employee
Checking that movements are logged	Timestamped movement entries showing from-location, to-location, reason and person who authorized the move	Movements recorded informally in email or chat; no entry for remote work or courier transfers
Reviewing the addressable decision	Written risk-based decision on whether accountability tracking is reasonable and appropriate, and any documented equivalent alternative measure	Specification treated as implemented without a decision record; alternative measure described but not implemented or reviewed
Confirming the inventory is current	Evidence of the review cycle, such as dated reconciliation reports against endpoint management or agent data	Last reconciliation predates staff changes or hardware refreshes; no evidence of who reviewed it

How to build a movement record that survives an audit

This sequence turns the addressable movement-record expectation into a working custody trail, from defining which hardware and media hold ePHI through to a scheduled review that keeps the record accurate. Each step produces a document or record an assessor can test.

Define hardware and electronic media holding ePHI
Start by agreeing, in writing, what counts as hardware and electronic media that store, process or transmit ePHI in your environment. Cover laptops, workstations, servers, mobile devices, removable drives, backup tapes, storage arrays, printers with memory and any cloud-attached devices you control, and link each class to the systems and data flows identified in your risk analysis. The output is a scoped asset-class definition signed off by the security official. You know it is done when every class can be traced to a named ePHI system and an owner can answer whether a new device falls inside it.
Establish the authoritative asset record
Create one system of record for these assets, such as an open-source IT asset management tool like GLPI, and define its required fields: unique identifier, make and model, serial number, current location, custodian, status (in service, in repair, on loan, in storage, awaiting disposal, disposed) and ePHI classification. Where a discovery agent can feed the record, such as the GLPI Agent or the Wazuh Syscollector module for endpoints, confirm which fields it populates automatically and which still need manual entry. The output is a field specification and a populated baseline. You know it is done when a sample of physical devices matches the record one for one.
Assign a responsible person to each asset class
For each asset class, name an accountable custodian by role and a backup, and record the assignment in the asset record and in the written procedure. Custodians are responsible for keeping location and status accurate and for approving movements. Document the handoff rule for staff who leave or change roles so no device is left without a responsible person. The output is a custodian matrix approved by management. You know it is done when every record in the baseline shows a custodian who can be identified by name or role and who has acknowledged the responsibility.
Define the movement events that must be logged
Write a custody procedure that defines each movement event the record must capture: receipt into inventory, assignment to a user, relocation between sites or rooms, repair or warranty service, loan, return, and disposal. For each event, specify who initiates it, what evidence is captured (date, from and to locations, new custodian, reason), and which ticket or form records it. A helpdesk such as Zammad can hold the request and approval trail, linked to the asset identifier. The output is an event table and a sample completed entry for each event. You know it is done when staff can follow the procedure for a test device and the record reconstructs its full history without gaps.
Document the addressable assessment and any alternative
Because accountability is an addressable specification, record a written assessment of whether maintaining this movement record is reasonable and appropriate for your organization, considering size, complexity, capabilities and the cost of implementation, as the rule directs. If you decide that a full record is not reasonable in some respect, document the reason and implement an equivalent alternative measure that you can show is reasonable and appropriate. Have the security official and a senior leader sign the memo, and retain it with your other Security Rule documentation. The output is a signed assessment memo. You know it is done when the memo names each element of the movement record, states the decision for each, and points to the control that carries it out.
Set a review cadence and reconcile physical stock
Schedule periodic reconciliation of the record against physical devices, with the frequency set by your risk analysis and recorded in the procedure. During each reconciliation, sample or inventory items by location, investigate missing or unexplained devices, correct custodian and status fields, and confirm that closed tickets match the record. Track the outcome of each review and the actions taken. The proposed 2025 Security Rule revision would require a written technology asset inventory reviewed at least once every 12 months, but that change was not final as of October 2026, so confirm the current requirement with counsel and set your cadence on your own risk findings. The output is a reconciliation log with dated results. You know it is done when each review closes with recorded discrepancies resolved or escalated.

Evidence that satisfies device and media accountability

An assessor testing 164.310(d)(2)(iii) wants to see where each device and piece of media is, who answers for it, and how it moved. The six artifacts below link those answers together, and each one only holds up if it is refreshed between audits rather than rebuilt the week before one.

Asset register with custodian and location

The register is the baseline every other artifact is checked against. Each hardware item and electronic medium that can hold ePHI needs a unique identifier, a named custodian, a physical or logical location, and the ePHI systems it supports. Check that custodian fields name a person who still works for the organization, not a former employee or a shared mailbox. Review ownership when staff change roles. GLPI's Assets module can hold these fields and receive entries from its agent, but confirm the custodian and location fields are mandatory in your own configuration.

Dated movement log

The movement log is the record the rule names directly: each entry shows what moved, when, from where, to where, and who was responsible. Entries should be made at the time of the move, with the approver recorded. Assessors often sample a few devices and trace them from purchase through every relocation, so gaps in the log are easy to find. Keep the log in a system with access controls and an audit trail of its own, so edits to past entries are visible.

Signed addressable-specification assessment

Accountability is an addressable specification, so the file must show the organization assessed whether it was reasonable and appropriate and recorded the outcome. If it was adopted, the assessment should name the tools and procedures in use. If it was not, the document must explain why and describe any equivalent alternative measure. Have the security official and an accountable executive sign it, and revisit it when the asset population or tooling changes. Do not treat a template as evidence until it reflects your environment.

Chain-of-custody forms for media in transit

When removable media or loose drives leave a facility, a custody form should record the item identifier, the sender, the carrier, the receiving party, and the handover times. Each signature closes one segment of custody. Forms that stop at the building door leave the most common gap, so include courier and vendor handovers. Pair the forms with the movement log so one item can be followed from either document. Confirm with your vendors whether they accept custody forms or need their own.

Reconciliation reports against discovered devices

A reconciliation report compares the register with what is actually on the network or in the facility. Unregistered devices, missing devices and mismatched custodians each need a documented resolution. Schedule the comparison on a fixed cadence and keep the output. Wazuh's Syscollector inventory can feed hardware and endpoint data into a dashboard for this comparison, but it covers only endpoints where the agent is installed, so physical media and unmanaged equipment still need manual checks. Record who reviewed each exception and when it closed.

Disposal records linked to the disposal specification

Disposal records show that a device or medium left the register for a documented reason, and that its ePHI was handled under the disposal specification. Each record should carry the asset identifier, the disposal method, the sanitization or destruction evidence, the vendor certificate where one was used, and the approving person. Link the record back to the register so the item cannot silently disappear. Ask disposal vendors which sanitization method they use and whether they issue certificates of destruction.

What meeting device and media accountability costs

This table breaks down the cost components of keeping a record of hardware and electronic media movements under 164.310(d)(2)(iii), who is paid for each, and whether it recurs. Use it to frame a fixed-scope quote, since no dollar figures or durations are supplied for this requirement. The main takeaway is that open-source inventory tools remove license spend but leave the labor of custody, reconciliation and evidence largely in place.

Cost component	One-time or recurring	What drives it	How to keep it down
Tooling or licenses	Recurring for commercial tools; none for GPL or AGPL open-source tools	Number of endpoints, servers, network devices and media tracked; hosting of the inventory database	Choose self-hosted open-source inventory such as GLPI, confirm license terms, and size the database to the asset count
Engineering time to integrate discovery and inventory data	One-time, with periodic updates	Number of asset sources (agents, CMDB, procurement, cloud accounts); custom fields for ePHI location and owner	Limit the first phase to in-scope systems that store or transmit ePHI, and reuse agent deployments already in place
Staff time for custody procedures and movement logging	Recurring	Frequency of hardware moves, repairs, loans and returns; number of sites and departments that handle devices	Tie movements to existing ticketing workflows, use barcodes or asset tags, and set a single owner per location
Reconciliation effort	Recurring, usually on a set schedule	Gaps between discovered devices and recorded custody; shadow IT and remote workstations	Automate discovery comparisons and assign exception handling to a named owner with a closure deadline
Documentation of the addressable decision	One-time, with review when systems change	Whether the entity implements the specification or documents why not and selects an equivalent measure	Record the assessment and the chosen measure once, and cross-reference it to the device and media policy
External review or assessment support	Recurring if engaged annually or per assessment	Scope size, number of locations, readiness of evidence, and whether the reviewer tests records independently	Request a fixed-scope quote based on asset count and locations, and ask for deliverables in writing before work starts
Auditor sampling effort	Recurring with each assessment	Number of samples the assessor selects, and how quickly the organization can produce custody records for them	Keep movement records complete and retrievable so sample requests do not trigger manual reconstruction

What the proposed Security Rule would add to asset inventories

The accountability specification in 45 CFR 164.310(d)(2)(iii) is addressable today, and the HHS proposal of January 6, 2025 (90 FR 898) would add a separate requirement that matters for the same records: a written inventory of technology assets, reviewed at least once every 12 months. That proposal was not final as of October 2026, so it does not yet bind anyone. Its direction is still useful for planning, because an accountability record built now can serve as the foundation for an inventory later. Read the proposed text yourself through the Federal Register proposed rule before you plan around its specific wording.

The overlap is practical. The current accountability record needs, for each device or medium holding ePHI, its location history, the person responsible for it at each point, and the dates of movement. A written inventory would more likely need the asset list itself: what technology exists, where it sits, who owns it and when the list was last reviewed. Teams that already keep a hardware register with owner, location and change fields can extend it with a review date and a named reviewer, rather than starting a second list. Tools such as GLPI or Wazuh Syscollector can populate the base data, but confirm with your own counsel and security official what the final rule would require each field to contain before you design the schema.

Ask counsel three questions now: whether your organization would be an entity the final rule applies to in the same way it applies today, which assets the word technology would cover in your environment, and whether a review cadence documented under your current policies would satisfy a 12-month review if one is adopted. Do not assume the final text will match the proposal. Keep the current addressable specification as the operative requirement, document your assessment of whether each accountability step is reasonable and appropriate, and treat any inventory work as preparation rather than compliance until a final rule is published. The NIST SP 800-66 Rev. 2 guide remains the informational reference for accountability activities in the meantime.

Open-source tools that produce accountability evidence

Accountability under 164.310(d)(2)(iii) is a record of where hardware and media went and who had them. Inventory, endpoint telemetry and ticketing each hold part of that record, and none of them replaces the people and decisions behind it. The cards below show what each tool contributes and what the organization still has to decide and document.

GLPI Assets as the movement register

GLPI (GPL-3.0-or-later) has an Assets module for computers, monitors, software, network equipment, peripherals, printers, phones and racks. Records can be entered manually or pushed by the GLPI Agent through the native inventory built into GLPI since version 10. For this specification, the asset record should hold a named responsible user and location history, so each move can be traced to a person. Check that your team will update records at each handover, since an inventory that lags behind physical moves will not show movements accurately.

Wazuh Syscollector for endpoint evidence

Wazuh (GPL-2.0-only) Syscollector collects hardware, operating system, installed software, network interfaces, users, groups and services from each endpoint. It stores this data in the Wazuh indexer, where the dashboard can show inventory views and reports. This gives you a system-observed record that can confirm whether a device still reports in, and what it runs, after a move. Confirm that every device type in scope is covered, because Syscollector sees only what the endpoint agent can reach, and it does not record physical custody.

Zammad for custody requests and approvals

Zammad (AGPL-3.0-only) is a web-based helpdesk that gathers requests from email, chat, telephone and social media into one ticket system. Teams can use tickets to log custody requests, the approver, the reason for a move and the closing confirmation. The ticket history then becomes the approval trail that links a movement to an authorized person. Check that the ticket workflow is set up to require an approver and a closing step, because a helpdesk does not enforce either without configuration.

Decisions no tool makes

None of these tools decides who is responsible for a device, whether the addressable accountability specification is reasonable and appropriate for your organization, or what happens at final disposal. Those are management decisions that must be written down, and a documented alternative measure is required if you decide the specification does not fit. Reconcile the GLPI and Wazuh records by hand on a set schedule, since the two sources can disagree. Confirm with your own assessor or compliance lead how the record should link to your disposal documentation under 164.310(d)(2)(i).

Who owns the movement record, who helps, and what the auditor tests

Your organization owns the accountability requirement in 45 CFR 164.310(d)(2)(iii). Someone on your side must be named as the person responsible for each device and piece of electronic media that holds or may hold ePHI, and that ownership cannot be delegated to a vendor. In practice, the work is shared among facilities, IT operations, procurement and the security official, each with a defined role in recording where hardware and media go.

Named custodians: Assign a responsible person for each asset class, such as laptops, servers, backup media and removable storage, and record that assignment in the inventory.
Asset owners and facilities: Facilities staff usually know when equipment enters, leaves or moves between rooms, so they should be part of the movement workflow.
Procurement and receiving: Purchasing decisions create the first entry in the record, so receiving staff must tag and log equipment before it reaches a workstation or server room.
Sign-off on the addressable decision: Your security official or compliance lead decides whether maintaining this record is reasonable and appropriate, and documents the reasoning if an alternative measure is chosen.
Ongoing reconciliation: Confirm with your team how often the record is reviewed and who signs off discrepancies.

Before you start, confirm who in your organization holds each of these roles and where the decision on the addressable specification is documented.

Where device and media accountability usually fails

Most accountability failures are not missing policies. They are gaps between what the asset register says, where equipment and media actually are, and who answers for them. The cards below cover six gaps that assessors commonly probe, each paired with the control fix and the artifact that closes it.

Inventories that only list purchased assets

A register built from purchase orders misses equipment that is loaned, reassigned between sites, or brought in by staff. Under 164.310(d)(2)(iii), the record must follow the hardware as it moves, so the inventory must start from what is on the network, not only from procurement. Check whether discovery runs against live endpoints and whether moves between sites update the same record. The closing artifact is an inventory export reconciled against a network discovery scan, with the differences explained. Native GLPI inventory or Wazuh Syscollector data can feed that reconciliation.

No named custodian for each asset class

When every laptop, server and backup tape belongs to 'IT,' nobody answers for a specific movement. Assign a named owner for each asset class, such as endpoints, data center hardware, removable media and medical devices, and record that person in the register. The custodian must be able to say where each item is and who last signed it out. Check that the owner names are current, because staff turnover often leaves records assigned to people who have left. The closing artifact is a custodian matrix approved by the security official, with a review date.

Movements with no log entry

Equipment is often moved for a repair, a office refit or a temporary loan and never recorded. The gap is not the move itself but the absence of a timestamped entry showing origin, destination and the person responsible. Require a check-out and check-in step in the ticketing workflow for any hardware leaving a secured location. A helpdesk such as Zammad can hold the movement request as a ticket so the approval, the handoff and the return are kept together. The closing artifact is the closed movement ticket set, sampled against physical counts.

Addressable decisions made verbally

Accountability specifications are addressable, so the entity must document its assessment of whether each one is reasonable and appropriate, and document an equivalent alternative if it is not. Decisions made in a hallway or a meeting leave no trace, and assessors treat undocumented decisions as no decision. Record the rationale for each choice on 164.310(d)(2)(iii), who approved it, and when it will be reviewed. The closing artifact is a signed decision record that names the alternative measure, such as periodic physical spot checks where per-movement logging is judged impractical.

Media in transit without custody records

Backup tapes, encrypted drives and replacement disks often travel between a facility, a courier and an off-site store with no chain of custody. The record should show who handed off the media, who received it, the sealed container identifier and the time of each transfer. Confirm that the courier and any off-site vendor are covered by a business associate agreement where they handle ePHI. The closing artifact is a custody log for each media item, with signatures or electronic acknowledgments at every handoff.

Disposal records that do not match the register

A device can leave the register by one path while the disposal certificate records a different serial number, or a drive is destroyed without ever being removed from the inventory. The 164.310(d)(2)(i) disposal process and the accountability record must agree item by item. Reconcile every disposal against the register before the register entry is closed, and confirm the destruction method was applied to the exact device. The closing artifact is a disposal reconciliation showing each serial number in the register, the disposal record and the vendor certificate, with no unmatched items.

Questions buyers ask about 164.310(d)(2)(iii) accountability

How much effort does it take to build the movement record in-house?

The effort depends mainly on how many devices and media holding ePHI you have, how many places they move between, and whether anyone already tracks them. The specification asks for a record of the movements of hardware and electronic media and the person responsible for each, so the first job is an inventory of what holds ePHI, followed by a process that logs every receipt, transfer, repair, loan, return and disposal. Most of the work is recurring discipline rather than a one-time build: someone must update the record each time equipment moves. Ask any consultant to break its quote into inventory setup, process design, staff training and ongoing record upkeep so you can see which parts stay with your team.

Do we need a consultant or implementation partner for this specification?

No regulation requires an outside firm, but many organizations bring one in to set up the asset records, connect them to existing tools and document the procedure. An implementation partner can prepare systems and evidence, while your organization keeps ownership of the control and the person responsible for it. Engage an outside party when your internal team lacks time or experience with asset tooling, or when multiple sites and cloud accounts make the inventory hard to scope. Keep the roles clear in the contract: the partner configures and documents, and your staff accept responsibility for the record.

What does the work need from our staff?

The work needs named owners in IT operations, facilities and the security function, plus a clear rule for who signs off on each movement. Facilities staff must report equipment that enters, leaves or moves between rooms, IT must register the asset and its custodian, and the security official or a delegate must review exceptions. Staff also need to know that lost or unaccounted-for devices must be recorded and escalated. Confirm with your internal team how often the record will be reviewed and who keeps it current when people change roles, because a record that nobody maintains will not show movements accurately.

How long does the first cycle usually take?

The duration depends on the size of your environment and how much of the inventory already exists, so no fixed timeline applies to every organization. The main drivers are the number of locations and device types, whether assets are already recorded in a central system, the state of your existing media disposal and re-use procedures, and how quickly departments can answer questions about their equipment. Ask any firm to state its assumptions in the written scope, including the number of sites, devices and people involved, so you can compare timelines on the same basis.

Can open-source tools maintain the device tracking record?

Yes, open-source asset and inventory tools can hold much of the evidence, but they do not decide your policy for movements or replace the people who sign off on them. GLPI's Assets module manages computers, monitors, software, network equipment, peripherals, printers, phones and racks, and it can be populated manually or through the GLPI Agent, which uses native inventory built into GLPI since version 10. Wazuh's Syscollector module collects hardware, operating system and software details from endpoints, which helps confirm what is actually on a device. Zammad can route requests for equipment moves through a ticket trail. Confirm in your own environment which fields, custodian history and movement logs each tool records before relying on it for evidence.

Can we decline this addressable specification?

You cannot simply skip it. Under 45 CFR 164.306(d)(3), an addressable specification requires you to assess whether it is reasonable and appropriate for your environment. If it is, you implement it. If it is not, you must document why and implement an equivalent alternative measure, if that is reasonable and appropriate. Documenting a decision without any alternative measure does not meet the standard. A small organization with few devices may still find a simple spreadsheet and sign-off process reasonable, while a large hospital will usually find a formal system necessary. Keep the assessment and its reasoning in writing, and review it when your environment changes.

Does a third-party review prove we comply with this specification?

No. There is no HIPAA certification, and HHS states that no Security Rule standard requires an entity to certify compliance and that it does not endorse or recognize private certifications. A third-party review can test your records, identify gaps and give you an independent view, but it cannot make you compliant or bind OCR's later findings. Only the organization is responsible for its controls. Ask any reviewer to state in writing what it tested, which records it sampled and what it did not examine, so the report is read for what it actually covers.

How DeployOpen works on this

DeployOpen plans and implements self-hosted open-source platforms inside your own infrastructure so that hardware and electronic media holding ePHI can be tracked from receipt to disposal. We prepare the systems and records; your organization owns the accountability decisions, and only an independent assessor can issue an assessment result.

How we scope

The written scope lists every asset class in use, such as laptops, servers, removable media and network equipment, that could hold ePHI.
It names the systems that will hold the movement records and the owner who signs off on each hardware or media transfer.
Engagements are fixed-scope, so deliverables and timelines for the accountability record are agreed in writing before work starts.

How we build

We deploy an asset inventory such as GLPI, with its Assets module, and configure fields that capture location, custodian and status changes.
We connect endpoint inventory collection, such as the Wazuh Syscollector module, so hardware and software records update without manual entry.
We configure ticketing in Zammad so every movement request, approval and return is recorded with the responsible person named.

How we hand over

You receive configuration documentation, a movement-record procedure, and a sample record set showing how an asset moves from issue to disposal.
Handover covers the addressable decision for 164.310(d)(2)(iii), including the documented reason and any equivalent alternative measure, if one is chosen.
We walk your staff through routine checks, so your own team can keep records current and produce them for an assessor on request.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, so the records stay accurate after handover.
Retainer work can include periodic reconciliation of the inventory against physical hardware and media logs.
Confirm with your assessor which evidence format they accept before we finalize the record structure.