Medical Records and the Law

468 CHAPTER 13: ELECTRONIC HEALTH RECORDSat its workstations. 105 A “workstation” is both the computer and anyelectronic media stored in the immediate vicinity. 106 An appropriatesolution to a workstation security problem will depend upon a coveredentity’s risk assessment. Its policies and procedures should specifywhich functions should be performed and how they can be performedat workstations that contain ePHI. Security policies and proceduresmust also address the physical location and surroundings of workstationsto maximize the security of ePHI, determine the activities an employeemay conduct at such workstations without jeopardizing theconfidentiality of ePHI, and govern the design of workstations and thework areas in which they are used so that unauthorized persons cannotsee or use the workstations. These safeguards include locking portableworkstations to desks to prevent their theft and limiting access to workareas that include computers that contain or have access to ePHI.Device and Media ControlsThe rule also establishes a standard requiring covered entities to implementpolicies and procedures that control the acquisition, receipt,and movement within the facility of hardware and electronic mediathat may contain ePHI. 107 The standard includes two required implementationstandards.The policies and procedures must provide for thefinal disposition of hardware and electronic media and the removal ofePHI from media before the media are reused or recycled. Covered entitiesmust be certain they have stripped ePHI from all electronicmedia that will used for a new purpose or that remain in hardwarebeing discarded. Thus, a covered entity should develop procedures fordisposing of hardware and software containing ePHI and for maintaininga record that will show proper implementation of procedures.The standard also includes two addressable implementation standards.Covered entities must determine whether they need a record ofthe movements of hardware and electronic media that contain ePHI,as well as a record of the persons responsible for such movements.Movement records are useful for demonstrating compliance with thestandard and in defending against negligence actions alleging the10545 C.F.R. §§ 164.310(b) and (c).10645 C.F.R. § 164.304.10745 C.F.R. § 164.310(d).