You can't protect what you don't know you have. An asset inventory is a current list of every computer, server, network device and system that stores or touches patient data. Safeguard keeps that list up to date and flags anything risky.
Asset inventory is part of the Safeguard™ platform.
01
02
An old imaging PC, a forgotten server in the closet, a personal laptop on the office Wi-Fi: these are the gaps attackers look for, and the ones risk assessments miss when the inventory is out of date. HHS expects your risk analysis to cover all ePHI wherever it lives, and that starts with knowing where it lives.
HIPAA
HHS's proposed Security Rule update would require a written technology asset inventory and network map, reviewed at least every 12 months and after changes. See does HIPAA require an asset inventory?
FAQ
Anything that creates, stores, sends or accesses ePHI: computers, servers, network equipment, imaging devices, and cloud systems like your practice management software and email.
Safeguard combines automated discovery with details we confirm with your team, such as cloud apps and devices that cannot be scanned automatically.
It lives in Safeguard and is updated as things change, instead of being rebuilt once a year in a spreadsheet.
Not as a separate standard, but you cannot do the required risk analysis properly without one, and HHS has proposed making it an explicit requirement.
Sources: 45 CFR 164.308, administrative safeguards · 45 CFR 164.310, physical safeguards · HHS fact sheet on the proposed Security Rule update. This page is general information, not legal advice.
Talk to an analyst about asset inventory, or start with the free risk assessment.
