§164.310(d)(2)(ii): Implement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use.
Audit Inquiry
Does the entity have policies and procedures established to remove ePHI before reusing electronic media and who is responsible for the overseeing those processes?
Does the entity remove ePHI before reusing electronic media and who is responsible for the overseeing those processes?
Obtain and review procedures related to media re-usage. Evaluate the content in relation to the specified performance criteria for removing ePHI from electronic media before they are issued for reuse.
Elements to review may include but are not limited to:
• Workforce members’ roles and responsibilities in the media re-use process
• How the removal of ePHI from electronic media is verified
• How ePHI will be removed from electronic media before external and internal re-use
Obtain documentation demonstrating media re-use procedures being implemented and how ePHI has been removed from electronic media. Evaluate and determine if the process used for the reuse of electronic media is appropriate; that ePHI is properly removed from electronic media prior to reuse; that ePHI that is removed is unusable, inaccessible, and indecipherable; and that removal of ePHI from electronic media has been verified prior to reuse of electronic media.
Required/Addressable
Required