Device and Media Controls

The Device and Media Controls portion of the Physical Rules requires that agencies implement procedures that govern the receipt and removal of hardware and electronic media that contain EPHI into and out of a facility and the movement of these items within the facility.

This rule has 4 tasks, 2 are required and 2 are addressable. In general, they cover the handling of servers and/or workstations and any type of backup media such as tapes, disks, hard disk drives, electronic storage, etc. that contain EPHI.