Device and media tracking for HIPAA §164.310(d)
The HIPAA Security Rule asks you to "maintain a record of the movements of hardware and electronic media and any person responsible therefore." CustodyTap makes that record with a tap: an NFC tag on each laptop, drive and device, and a phone tap each time it moves.
For security and privacy officers, IT asset managers and biomedical engineering teams at hospitals, clinic groups, imaging centers, labs, and the billing and IT firms that serve them.
The accountability record, kept as you go
Each check-out, hand-off, check-in and move records who had the item, where it went and when. This supports evidence for §164.310(d)(2)(iii) Accountability without a sign-out sheet anyone has to remember.
Hand-offs that someone has to accept
Passing a drive to a colleague isn't complete until they tap it and accept it. If they don't, it stays with the sender and shows up as an exception, before it becomes a lost device. Drives going to a shredding vendor travel in a sealed, tagged box. The vendor's driver accepts it, the seal is checked at the plant, and the vendor records the destruction against every drive in the box.
Re-use and disposal you can show
Wiping a drive for re-use, or destroying it, records the method, a witness and photos with their SHA-256. Each one produces a certificate. This supports evidence for §164.310(d)(2)(i) Disposal and (d)(2)(ii) Media re-use.
Lost means reported the same day
The person holding an item, or an admin, can report it lost from their phone without the tag. It stays on the exceptions report until someone finds it, taps it and checks it in. That gives your breach risk assessment a starting point: who had it last, and where.
A record that shows if anyone changes it
Events are chained together by hash, and each day's head is emailed to your admins. Exports can be checked without CustodyTap.
It tracks the device, not the data
Items are recorded by asset code and serial number. CustodyTap never reads what's on a drive.
What does your record-keeping cost now?
Enter how many devices you have and how you track them today. You'll see an estimate of the staff time and expected losses, with its range and every assumption shown.
Start a 90-day pilot with one department
Biomed, imaging or IT asset recovery are good places to start. Some report wording still comes from the utility edition and is being adapted for healthcare during pilots.
dbrown@enthropicdata.com