Does HIPAA require an asset inventory?

Home/Does HIPAA require an asset inventory?

Short answer: today's HIPAA Security Rule does not have a standalone asset inventory requirement, but you cannot do the required risk analysis without knowing where your ePHI lives. HHS has proposed making a written technology asset inventory and network map an explicit requirement.

Take the free risk assessment →Talk to an analyst

01

What the current rule says

  • Risk analysis (45 CFR 164.308(a)(1)(ii)(A)) must cover the risks to all of the ePHI you create, receive, maintain or transmit. That means knowing every system that touches it.
  • Accountability (164.310(d)(2)(iii)): maintain a record of the movements of hardware and electronic media and the person responsible.

When OCR investigates a breach, an incomplete risk analysis is one of the most common findings, and a missing inventory is often why.

02

What the proposed update would add

In January 2025, HHS proposed the biggest update to the Security Rule in two decades. As of November 2026 it has not been finalized, and HHS's target date has slipped more than once. Even so, it is a clear signal of what OCR expects a reasonable security program to look like.

  • A written inventory of technology assets that touch ePHI.
  • A network map showing how ePHI moves through your systems.
  • Review at least every 12 months and whenever your environment changes.

03

What to include

  • Workstations, laptops and servers, with operating system and owner.
  • Network equipment: firewalls, switches, Wi-Fi.
  • Imaging and other connected clinical devices.
  • Cloud systems: practice management, EHR, email, file sharing.
  • Unsupported systems, like PCs still on Windows 10.

Cytek's asset inventory keeps this list current inside Safeguard™.

FAQ

Frequently asked questions

Does a spreadsheet count as an asset inventory?

It can, if it is complete and kept up to date. The problem is that spreadsheets go stale quickly.

What is a network map?

A diagram showing your systems and how patient data moves between them. The proposed rule would require one.

How often should the inventory be updated?

The proposed rule says at least every 12 months and after any significant change. In practice, keeping it current all the time is easier.

Sources: 45 CFR 164.308, administrative safeguards · 45 CFR 164.310, physical safeguards · HHS fact sheet on the proposed Security Rule update. This page is general information, not legal advice.

Know every device that touches patient data

Safeguard keeps your asset inventory current and flags risky systems.

Take the free risk assessment →Talk to an analyst