HIPAA Device and Media Controls (45 CFR 164.310(d))
Required specifications for disposal of hardware and electronic media containing ePHI, and media re-use procedures.
Primary source
45 CFR 164.310(d) — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.310#p-164.310(d)
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 164.310(d)) governs receipt and removal of hardware and electronic media containing ePHI into and out of a facility, plus the movement of these items within a facility.
Required specifications:
- Disposal: implement policies and procedures to address the final disposition of ePHI and the hardware or electronic media on which it is stored.
- Media re-use: implement procedures for removal of ePHI from electronic media before the media are made available for re-use.
Addressable specifications: accountability (record of movements); data backup and storage (create a retrievable, exact copy before equipment movement).
The 2014 OCR settlement with Affinity Health Plan ($1.2M) over photocopier hard drives sold without sanitization is a frequently cited example. NIST SP 800-88 r1 is the procedural reference: clear, purge, or destroy depending on media type and confidentiality of the data. Documented sanitization certificates from disposal vendors are evidence; oral assurance is not.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Physical Safeguards (45 CFR 164.310)Four standards covering facility access controls, workstation use and security, and device and media controls including disposal and re-use.
- RegulationHIPAA Administrative Safeguards (45 CFR 164.308)Nine standards covering security management, workforce security, training, contingency planning, incident procedures, evaluation, and business associate contracts.
- RegulationHIPAA Security Rule: General Rules (45 CFR 164.306)Required objectives — confidentiality, integrity, and availability of ePHI — plus the flexibility provisions that govern how covered entities select and implement specific safeguards.
- ComplianceHIPAA Mobile Device & BYOD Policy Template (45 CFR § 164.310(d) + 164.308(a)(1)(ii)(B))2026 HIPAA mobile and BYOD policy template — 45 CFR § 164.310(d), § 164.308(a)(1)(ii)(B), NIST SP 800-124r2, enrollment and offboarding workflow.
- GlossaryEncryption at RestCryptographic protection of stored ePHI such that the data is unreadable without the decryption key.
- GlossaryMedia SanitizationProcess to render ePHI on storage media unreadable, indecipherable, or otherwise inaccessible before disposal or reuse.
- SRAThe HHS SRA Tool vs Paid HIPAA Risk Analysis OptionsWhat the free HHS/ONC Security Risk Assessment Tool actually does, where it stops, and how to evaluate paid alternatives without overpaying for what the free tool already covers.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.