- Citation
45 CFR 164.310(d)- Standard
- Device and media controls, 164.310(d)(1)
- Safeguard
- Physical safeguards
- Type
- Standard, with two required and two addressable specifications
What the rule says
Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility.45 CFR 164.310(d), as currently in force
In plain English: Know where every device and drive that holds patient information is, control what happens when it moves, and make sure the data is really gone before anything is thrown out, sold, returned or reused.
What it means in practice
- Disposal (R): wipe or destroy ePHI before a device or drive leaves your control, and keep the certificate or record.
- Media re-use (R): wipe before a device is reassigned to another person or purpose.
- Accountability (A): an inventory that says who has what, and a record of movements.
- Data backup and storage (A): back up ePHI before moving equipment.
- Covers more than laptops: phones, USB drives, backup drives, imaging workstations, servers, and the hard drives in copiers and fax machines.
Where the laptops go when they leave the pond. That's the short version of this requirement.Your engineer
What OCR looks for
If an investigation touches this requirement, the data request will ask for some or all of the following.
- The device and media inventory, current.
- Disposal and destruction certificates.
- Wipe records for reused devices.
- Encryption status per device, which makes loss far less costly.
Where entities get caught
Historically the largest category of breaches was lost or stolen unencrypted devices, and OCR's million-dollar settlements of the 2010s were mostly laptops. Copiers returned to a leasing company in 2010 with their hard drives intact cost a health plan $1.2 million in a 2013 settlement.
Shen Smiles, 2026: paper records stored in plastic bins on the floor and in a bathroom. The citation was the Privacy Rule's safeguards standard, 164.530(c), rather than this section, but the lesson is the same: a small dental practice paid $140,000.
How to meet it at a small organization
One spreadsheet or the platform's inventory: device, serial, user, location, encrypted yes or no, date disposed, how. Encrypt everything portable, because an encrypted lost device isn't a reportable breach. When the copier lease ends, get the drive wiped or removed, in writing.
Under the proposed Security Rule update
The proposal would require a written technology asset inventory and network map updated at least every 12 months, which absorbs the accountability specification and makes it mandatory. The update was proposed in January 2025 and remains a proposal as of October 2026; see what's changing.
This page explains a federal regulation in plain language. It isn't legal advice, and AccuSights doesn't certify compliance; no one can. For every standard and specification, see the Security Rule, clause by clause.
With AccuSights: The endpoint agent builds and maintains the device inventory with encryption and screen-lock status for each machine, and disposal records attach to the asset so the chain is complete.