164.310(d)(1) — Device and media controls (R)

Requirement

Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility, including disposal, media re-use, accountability and data backup and storage.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.