# Standards and Regulatory References

## Primary Legislation

### HIPAA Security Rule — Asset and Inventory Requirements
- **45 CFR §164.308(a)(1)(ii)(A)**: Risk analysis — conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the covered entity or business associate. (Requires knowing where ePHI resides.)
- **45 CFR §164.310(d)(1)**: Device and media controls — implement policies and procedures governing the receipt and removal of hardware and electronic media containing ePHI.
- **45 CFR §164.310(d)(2)(iii)**: Accountability (addressable) — maintain a record of the movements of hardware and electronic media and any person responsible therefor.
- **45 CFR §164.312(a)(1)**: Access control — implement technical policies for electronic information systems that maintain ePHI to allow access only to authorized persons or software.
- **45 CFR §164.312(b)**: Audit controls — implement hardware, software, and procedural mechanisms that record and examine activity in information systems containing or using ePHI.

### HIPAA Privacy Rule — Designated Record Set
- **45 CFR §164.501**: Definition of designated record set — medical records and billing records, enrollment, payment, claims adjudication, and case or medical management record systems, plus any group of records used to make decisions about individuals.
- **45 CFR §164.524(a)**: Right of access — individual has a right to inspect and obtain a copy of PHI in a designated record set.

### PHI Definition
- **45 CFR §160.103**: Individually identifiable health information — information created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse that relates to health condition, provision of healthcare, or payment, and identifies or could identify an individual.

## Regulatory Guidance

- **OCR Guidance on Risk Analysis (2010)**: "Identify the scope of the analysis. This includes the potential risks and vulnerabilities to the confidentiality, availability, and integrity of all ePHI that an organization creates, receives, maintains, or transmits."
- **OCR Cybersecurity Newsletter — PHI Asset Inventory (2018)**: "An accurate and thorough risk analysis begins with identification of ePHI — where it is stored, received, maintained, or transmitted."
- **NIST SP 800-66 Rev. 2 (2024)**: Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide — Section 4 covers risk analysis including asset identification methodology.
- **NIST SP 800-30 Rev. 1 (2012)**: Guide for Conducting Risk Assessments — provides framework for identifying information assets as part of risk assessment.

## Enforcement Actions

- **Premera Blue Cross (2020, $6.85M)**: OCR found that Premera failed to conduct an enterprise-wide risk analysis that identified all systems with ePHI access — incomplete asset inventory was a root cause.
- **Anthem Inc. (2018, $16M)**: Failure to identify and address risks to ePHI across the enterprise; incomplete asset inventory contributed to the breach affecting 78.8 million individuals.
- **Oregon Health & Science University (2016, $2.7M)**: OCR found no comprehensive ePHI inventory; unencrypted laptops and a cloud storage service with ePHI were not included in risk analysis.
- **Advocate Medical Group (2016, $5.55M)**: Four breaches involving unencrypted laptops; OCR cited failure to perform accurate enterprise-wide risk analysis covering all ePHI assets.

## ISO/IEC Standards

- **ISO/IEC 27001:2022 — A.5.9**: Inventory of information and other associated assets — the organization shall identify and document assets associated with information processing, including classification and ownership.
- **ISO/IEC 27002:2022 — 5.9**: Implementation guidance on creating and maintaining information asset inventories with ownership assignment.
- **ISO/IEC 27701:2019 — 6.5.2.1**: Inventory of personal information — extension requiring identification of all processing activities and systems handling personal information.