Laserfiche WebLink
Device and Media Controls <br />[Physical Safeguard] <br />Standard <br />The fourth standard under the Physical Safeguards section is Device and Media Controls. It requires the <br />Health Plan to "implement policies and procedures that govern the receipt and removal of hardware and <br />electronic media that contain electronic protected health information, into and out of a facility, and the <br />movement of these items within the facility." <br />Interpretation and Implementation Specifications <br />Disposal 1. The Health Plan shall "implement policies and <br />(required) procedures to address the final disposition of electronic <br />protected health information, and /or the hardware or <br />electronic media on which it is stored." <br />Media Re -use 2. The Health Plan shall "implement procedures for <br />(required) removal of electronic protected health information from <br />electronic media before the media are made available <br />for re- use." <br />Accountability <br />(addressable) <br />Data Backup and Storage <br />(addressable) <br />References: <br />45 C.F.R. § 164.310(d)(1). <br />3. The Health Plan shall "maintain a record of the <br />movements of hardware and electronic media and any <br />person responsible therefore." <br />4. The Health Plan shall "create a retrievable, exact copy of <br />electronic protected health information, when needed, <br />before movement of equipment." <br />City of Ramsey HIPAA Security Policy - 18 - <br />