HIPAA PP-4.2: Device and Media Controls — Media Re-Use
Media re-use is a critical compliance gap for healthcare organizations. HIPAA's PP-4.2 control requires you to implement documented procedures for removing all ePHI from electronic media before that media can be reused or retired. Without proper media sanitization procedures, you risk exposing patient data during device lifecycle management.
What this means
This control mandates that your organization establish and enforce procedures to completely remove electronic protected health information (ePHI) from any electronic media (hard drives, USB devices, backup tapes, etc.) before the media is reused or made available to others. The goal is to prevent unauthorized access to sensitive patient data that may remain on repurposed devices. Your procedures must address identification, tracking, sanitization methods, and verification that ePHI has been irretrievably removed.
How to comply
- 1.Document a media re-use and disposal policy that specifies acceptable sanitization methods (e.g., NIST SP 800-88 guidelines, degaussing, physical destruction)
- 2.Implement a media tracking system to log all devices containing ePHI and their sanitization status
- 3.Define clear ownership and accountability for media re-use decisions before devices leave your environment
- 4.Perform sanitization procedures according to your policy and document each step with timestamps and responsible parties
- 5.Verify that sanitization was successful through testing or certification from qualified vendors
- 6.Maintain audit logs proving ePHI removal compliance for all reused media
- 7.Conduct periodic audits to ensure media re-use procedures are being followed consistently
Evidence auditors look for
- Media re-use and sanitization policy document with approved methods and responsible roles
- Device inventory log showing media lifecycle status and sanitization completion dates
- Sanitization certificates from vendors confirming ePHI removal via degaussing or secure wiping
- Testing reports validating that no ePHI remains on media after sanitization
- Audit trail logs documenting when and how each media item was sanitized before re-use
- Training records showing staff completion of media handling and re-use procedures
- Incident reports showing how organization handles potential failures in media sanitization
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates media re-use tracking and sanitization verification, mapping each device lifecycle event to PP-4.2 requirements and generating audit evidence—eliminating manual spreadsheets and reducing the risk of incomplete sanitization records.
See how GRCWatch handles this control automatically
Start free trial