01 / WHERE IT STANDSProposed, postponed, and still worth reading
On January 6, 2025, the HHS Office for Civil Rights published a notice of proposed rulemaking to update the HIPAA Security Rule for the first time in more than a decade. The comment period closed on March 7, 2025, and the proposal drew close to five thousand comments, a large share of them from providers and associations arguing that the cost and pace of the changes would be difficult to absorb. The final rule was expected in 2026. The federal regulatory agenda now lists July 2027 as the target for final action.
Nothing in the proposal is in force today, and the final rule may look different. That caveat matters, and every recommendation below is written to hold up either way. But the proposal is the clearest statement HHS has made about what it believes a reasonable Security Rule program looks like in the current threat environment, and several of its provisions describe work the existing rule already presumes.
Among the changes HHS proposed:
- A technology asset inventory and network map. Regulated entities would develop and revise an inventory of technology assets and a map illustrating the movement of ePHI through their systems, on an ongoing basis and at least once every 12 months, and whenever a change in the environment or operations may affect ePHI.
- No more “addressable.” The distinction between required and addressable implementation specifications would be removed, making specifications required with specific, limited exceptions.
- Named technical controls. Encryption of ePHI and multi-factor authentication, with limited exceptions; vulnerability scanning at least every six months and penetration testing at least every 12 months; and restoration of critical systems within 72 hours.
- Business associate verification. Business associates would verify to covered entities, at least once every 12 months, that they have deployed the required technical safeguards, through a written analysis by a subject-matter expert and a written certification.
The inventory sits at the front of the list for a reason. In the proposal it anchors the risk analysis, and the risk analysis anchors everything else.
02 / ALREADY REQUIREDWhat the current rule asks at end of life
It is easy to read coverage of the proposal and conclude that the current rule is permissive about hardware. At end of life it is not. Under the physical safeguards at 45 CFR 164.310(d), two implementation specifications are required today:
- Disposal. Policies and procedures addressing the final disposition of ePHI and of the hardware or electronic media on which it is stored.
- Media re-use. Procedures for removing ePHI from electronic media before the media is made available for re-use, which covers redeployment, donation, and resale.
A third specification, accountability, asks organizations to maintain a record of the movements of hardware and electronic media and of any person responsible for them. It has been addressable since the rule took effect, which in practice has let many organizations treat it as optional. Under the proposal’s general rule that addressable specifications become required, the record of where hardware goes would stop being a judgment call. The proposal also renames the device and media controls standard “technology asset controls,” which says something about where HHS thinks the inventory and the disposal process meet.
The Healthcare ITAD Field Guide covers these provisions in depth, along with the Privacy Rule’s safeguards requirement and HHS guidance pointing to NIST SP 800-88 for media sanitization.
03 / THE END-OF-LIFE LOOPWhy the inventory is where disposal begins and ends
An asset inventory is usually built to answer operational questions: what do we have, where is it, who uses it, is it patched. Disposal adds a question most inventories are not designed to answer: where did it go when it left service, and what happened to the data on it? An inventory that simply deletes a record at decommissioning loses track of a device at the moment its risk profile changes. The hardware is no longer monitored, it is often no longer in a controlled space, and it still holds whatever it held.
Closing that loop is straightforward in principle. Every device in the inventory carries a lifecycle state, and the states continue past the last day of service:
- In service — assigned, located, holding or transmitting ePHI as mapped.
- Retired, awaiting disposition — out of service but still data-bearing, with a storage location and a responsible person, which is the accountability specification in practice.
- In custody of the disposition vendor — picked up under a serialized manifest and chain of custody.
- Disposed — sanitized or destroyed, with the method under NIST SP 800-88, the date, and a certificate tied to the serial number attached to the record.
At that point the inventory does three jobs at once. It feeds the risk analysis the proposal describes, it demonstrates the disposal and media re-use procedures the current rule requires, and it produces the record of hardware movement the accountability specification asks for. The certificate of destruction stops being a file in someone’s inbox and becomes the closing entry for an asset. Follow the Drive shows what that reconciliation looks like on a single device.
04 / THE BLIND SPOTSThe devices that do not make the list
Inventories built from endpoint management tools capture laptops and workstations well and everything else unevenly. In healthcare the gaps tend to be the same:
- Multifunction printers and copiers that store scanned documents on internal drives, frequently leased and returned without a sanitization record (The Copier Went Home).
- Imaging and clinical equipment with local storage: modality consoles, imaging workstations, and some laboratory and bedside devices, often managed by biomedical engineering or the manufacturer rather than IT.
- Mobile and shared devices — workstations on wheels, bedside tablets, and phones used for clinical communication.
- Network and storage equipment whose configurations and caches map the environment the proposal asks you to document.
- The storeroom. Retired equipment waiting for a disposal decision is the single most common place for an inventory to lose its grip (The Storeroom Problem).
A practical test: pick a recent month, take every certificate of destruction your organization received, and confirm that each serial number appears in the inventory and that its record ends there. Then do the reverse with the devices marked retired. The mismatches in both directions are the inventory’s blind spots.
05 / STARTING NOWFive steps that hold up under either rule
- Extend the inventory past decommissioning. Add the retired, in-custody, and disposed states, with a location and responsible person for retired devices. This satisfies the current accountability specification in substance today.
- Map where ePHI comes to rest, not only where it flows. A network map shows movement; for disposal you also need to know which devices store ePHI locally, including the non-obvious ones above.
- Require a per-serial disposition record. Method, date, and certificate for every data-bearing device, reconciled against the inventory, with failed or unreadable drives destroyed and recorded rather than set aside.
- Review the business associate agreement and the evidence behind it. Your ITAD vendor handles ePHI and needs a BAA (The BAA Question). Ask now what an annual safeguards verification from that vendor would contain, and verify certifications such as NAID AAA and R2v3 in the issuers’ directories.
- Put the inventory on the risk-analysis calendar. Review it at least annually and whenever the environment changes: a new system, a merger, a refresh, an office move. That cadence is what the proposal would require, and it is what a reasonable program does anyway.
CyberCrunch works with hospitals, health systems, and practices on exactly this closing step: serialized pickup from storerooms and clinical areas, on-site or facility-based destruction under NIST SP 800-88, and certificates that map to inventory records, under a business associate agreement.
06 / FAQHIPAA asset inventory FAQ
Is the new HIPAA Security Rule in effect?
No. HHS published a notice of proposed rulemaking on January 6, 2025, and the comment period closed March 7, 2025. As of mid-2026 the final action date had moved from May 2026 to July 2027. Until a final rule is published and its compliance date arrives, the current Security Rule governs, and the final rule may differ from the proposal. The current rule is not a lighter version of the proposal in every respect: its disposal and media re-use specifications are already required, and its risk analysis requirement already presumes you know what systems hold ePHI.
What would the proposed technology asset inventory requirement involve?
As HHS described it, regulated entities would develop and revise a technology asset inventory and a network map that illustrates the movement of ePHI throughout their electronic information systems, on an ongoing basis but at least once every 12 months and whenever a change in the environment or operations may affect ePHI. In practice that means a maintained list of the hardware and software that create, receive, maintain, or transmit ePHI, and a picture of how the data flows between them. The proposal places the inventory at the front of the risk analysis, which is where most security programs already start in principle.
What does the current HIPAA Security Rule require when a device is retired?
Two required implementation specifications apply directly. The disposal specification requires policies and procedures for the final disposition of ePHI and the hardware or electronic media on which it is stored, and the media re-use specification requires procedures for removing ePHI before media is made available for re-use. A third specification, accountability, asks organizations to maintain a record of the movements of hardware and electronic media and any person responsible; it is currently addressable. The proposal would generally make addressable specifications required, with limited exceptions.
Which healthcare devices are most often missing from an asset inventory?
The usual gaps are devices that are not thought of as computers: multifunction printers and copiers with internal storage, imaging workstations and modality consoles, some laboratory and clinical devices with local storage, workstations on wheels, tablets used at the bedside, network equipment, and the retired equipment sitting in storage rooms awaiting disposal. The last group matters most for disposal, because a device that has left service but not the building is still holding whatever it held, and an inventory that drops it at decommissioning loses track of it exactly when the risk changes.
How should an ITAD vendor fit into a HIPAA asset inventory?
As the source of the closing record for each device. A business associate agreement covers the vendor's handling of ePHI; the disposition itself should come back as a per-serial record stating the sanitization or destruction method under NIST SP 800-88, the date, and the certificate, so the inventory entry can move from retired to disposed with evidence attached. The proposal would also require business associates to verify their technical safeguards annually through a written analysis and certification, so it is reasonable to ask an ITAD vendor now what that evidence would look like. This is not legal advice; confirm obligations with counsel.
CLOSE THE LOOP ON EVERY DEVICE
Disposition records that match your inventory, serial for serial
Serialized pickup, NIST SP 800-88 sanitization or destruction, and a certificate for every data-bearing device, under a business associate agreement — from a provider certified to NAID AAA, R2v3, RIOS, and PA DEP, serving healthcare organizations across all 50 states.
This brief reflects public sources as of October 5, 2026: the HHS notice of proposed rulemaking published in the Federal Register on January 6, 2025, HHS’s fact sheet on the proposal, the current HIPAA Security Rule at 45 CFR Part 164 Subpart C, and reporting on the federal regulatory agenda’s July 2027 target for final action. The proposed rule is not in effect and may change before it is finalized; descriptions of it are summaries, not the regulatory text. This is not legal advice and does not determine your organization’s obligations; confirm requirements with qualified counsel and your privacy and security officers. CyberCrunch credential statements reflect certificates held at the time of publication.