Device and media controls: the standard your clinic lives in daily

This is the standard your clinic lives in daily, whether anyone realizes it or not. Every tablet issued, every phone that leaves with a departing employee, every laptop reassigned to a new hire, this is the standard governing all of it.

What the rule actually requires

Device and media controls is a Required standard: implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, and the movement of these items within the facility (45 CFR 164.310(d)(1)).

Four implementation specifications, and here the Required/Addressable labels matter more than usual:

• Disposal (Required, 164.310(d)(2)(i)). Implement policies and procedures to address the final disposition of ePHI and the hardware or electronic media on which it is stored.
• Media re-use (Required, 164.310(d)(2)(ii)). Implement procedures for removal of ePHI from electronic media before the media are made available for re-use.
• Accountability (Addressable, 164.310(d)(2)(iii)). Maintain a record of the movements of hardware and electronic media and any person responsible for them.
• Data backup and storage (Addressable, 164.310(d)(2)(iv)). Create a retrievable, exact copy of ePHI, when needed, before movement of equipment.

Disposal is not deletion

A device that leaves your clinic still holding client data is a disclosure to whoever holds it next, whether that’s a resale buyer, a recycler, or a landfill. Deleting files and emptying the trash does not remove data from storage. The data is usually still recoverable until it is actually overwritten or the media is physically destroyed. Disposal, under this Required specification, means destruction or proper sanitization, a specific technical outcome, not a folder cleanup.

Media re-use is the everyday version of the same problem

The tablet reassigned from a departing RBT to the new hire is where this specification actually lives day to day. It requires a full factory reset in the reassignment checklist, every single time, with the date recorded. Skipping this step because “it’s just going to the next employee anyway” misunderstands what the specification protects: the prior client data on that device, which the new employee has no right to see.

“A device that leaves your clinic still holding client data is a disclosure to whoever holds it next.”

Why the two Addressable specifications still matter

Accountability sounds bureaucratic until the day a device goes missing and someone needs to answer, in minutes, which device it was, who had it, and since when. A simple register, one row per device, assigned to whom, since when, is what makes that answer available instead of reconstructed from memory under pressure.

Data backup and storage matters most at the moment of physical movement, an office relocation, hardware being sent for repair, equipment being retired. In a cloud-synced clinic, this specification is often already satisfied by the architecture itself, but “probably fine because it’s cloud-synced” is not the same as having assessed it and written down why.

What real device and media controls look like, next to what most clinics have

	What the rule requires	What most clinics actually have
Disposal	Destruction or sanitization, verified	Files deleted, trash emptied, assumed sufficient
Re-use	Factory reset on every reassignment, dated	Handed to the next hire as-is
Accountability	A register: device, holder, since when	Tracked informally, if at all
Backup before movement	A retrievable copy exists before equipment moves	Assumed to exist because of cloud sync, never confirmed

The gap in the first two rows is where real exposure lives. A clinic can have excellent risk analysis and strong access control, and still hand a departing employee’s old tablet to a new hire with the last three families’ session data still on it.