HIPAA Help Center’s Asset module provides a place to track and maintain all forms of media that house electronic protected health information. The Local Administrator or designated workforce members can enter information that pertains to operational business assets.
Key features of the Asset module
Under the HIPAA Security Rule, covered entities must categorize and identify information systems that transmit, receive, create and maintain ePHI. The Asset module allows users to fulfill this component of HIPAA compliance. Some of the key features include:
- Easy-to-follow steps: Dropdown menus guide health care professionals through the proper process for tracking ePHI.
- Inventory thoroughness: The module will prompt users to identify the location, category and type of asset, whether it is software, computer equipment or office/medical equipment. The module also provides a place to outline more specific details on the location of the media and the specific reason it is being used.
- Accountability: The application also allows covered entities to name the device and choose a workforce member with whom to associate it, encouraging accountability.
Auditors can view this asset inventory to determine whether covered entities have properly safeguarded information. HIPAA Help Center’s Asset Inventory module makes presenting this information an efficient process.
Frequently asked questions regarding asset inventory:
Why do covered entities need to keep an asset inventory?
Beyond the HIPAA Security Rule requiring an asset inventory for compliance, keeping track of all media that houses ePHI may help health care professionals avoid violations and fines. A comprehensive list of all assets allows covered entities to ensure only authorized individuals have access to ePHI and that proper safeguards are in place, such as passwords and antivirus protection.
Additionally, the Asset module helps verify which workforce members need certain types of training. For example, if the module lists that a laptop containing ePHI is located at the receptionist’s desk, the covered entity will be able to check that all employees who work at this station have received adequate HIPAA Security and Privacy training.
How does an asset inventory relate to risk assessment?
The presence of an asset inventory will lower a covered entity’s risk ratings. The risk analysis will also improve as the health care providers implement additional safeguards, such as dual passwords and security questions. The Asset Inventory module provides a place for users to keep track of that information. Covered entities should regularly review their risk assessment to know whether they need to make policy changes.