Why Device Inventory Matters

You cannot protect what you do not know you have. HIPAA's Security Rule requires covered entities and business associates to maintain an inventory of hardware and electronic media containing ePHI, and to have policies governing how those devices are used, moved, and disposed of. Device theft and loss is one of the leading causes of healthcare data breaches — and nearly all of those breaches involve devices that were not tracked or encrypted.

The Data Device Audit in the portal gives you a structured way to build and maintain your device inventory, record encryption and access control status for each device, and document the chain of custody when devices are transferred or disposed of.

Accessing the Data Device Audit

From the Privacy Officer dashboard, navigate to Audit and click Data Device Audit. Click Add Device to begin building your inventory. You can add devices one at a time or in bulk using the CSV import template.

What to Include in Your Inventory

Include every device that can access, store, or transmit ePHI. This typically includes:

Desktop computers and workstations
Laptops and notebooks
Tablets (clinical and administrative)
Smartphones with access to work email or EHR apps
Servers and NAS devices
Copiers and multifunction printers with hard drives
Portable storage (USB drives, external hard drives)
Medical devices with network connectivity or data storage

Important: Modern photocopiers have internal hard drives that store copies of everything that is scanned or copied through them. These drives can contain thousands of patient records. They must be included in your inventory and wiped before the device is returned, sold, or disposed of.

Device Classification

For each device in your inventory, the portal asks you to classify it by risk level:

High Risk — Stores ePHI locally (laptops, servers, portable drives)
Medium Risk — Can access ePHI but does not store it locally (workstations accessing cloud EHR)
Low Risk — Peripheral or support device with no direct PHI access

Key Fields for Each Device

Device type and make/model
Serial number or asset tag
Assigned user or location
Operating system and version
Encryption status — enabled, not enabled, N/A
Last known location
Disposal method (if decommissioned) — wiped, destroyed, returned to vendor

Tip: Use your IT provider's remote management dashboard to pull serial numbers, OS versions, and encryption status for all managed devices. This makes inventory entry much faster than looking up devices one at a time.

Documenting Device Disposal

When a device is retired, the portal lets you record how it was disposed of and by whom. HIPAA requires that ePHI be rendered unreadable before disposal. Acceptable methods include: certified data wiping (document the software and pass count), physical destruction of the drive, and returning the device to a vendor under a documented destruction certificate.

Never donate, resell, or discard a device without first ensuring it has been properly wiped or destroyed. Keep disposal certificates on file — the portal has a document upload field for each disposed device.