Requirement
164.310(d)(1) - Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information, into and out of a facility, and the movement of these items within the facility
Implementation Specifications
Disposal (Required) - 164.310(d)(2)(i)
Requirement: Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.
Media Re-Use (Required) - 164.310(d)(2)(ii)
Requirement: Implement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use.
Accountability (Addressable) - 164.310(d)(2)(iii)
Requirement: Maintain a record of the movements of hardware and electronic media and any person responsible therefore.
Data Backup and Storage (Addressable) - 164.310(d)(2)(iv)
Requirement: Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment.
Explanation
As referenced, the term “electronic media” means, “electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card…” This standard covers the proper handling of electronic media including receipt, removal, backup, storage, reuse, disposal and accountability.
