A risk analysis is only as good as its asset inventory. Asset Inventory is the authoritative list of systems, devices, and services that create, receive, maintain, or transmit ePHI — kept current from source systems, not drafted once in a spreadsheet.
What it does
- Catalogs ePHI assets: cloud services, servers, applications, databases, endpoints, media, and third-party systems with the data they touch.
- Pulls from AWS, Azure, GCP, MDM, HRIS, and identity providers; supports manual entry for the rest.
- Produces a dated network map and asset-to-control traceability.
- Flags drift between source systems and the inventory on a schedule.
How it maps to HIPAA
The inventory supports §164.308(a)(1)(ii)(A) (risk analysis — asset-based, as OCR expects), §164.310(d) (device and media controls), and §164.312(a)(1) (access control scoping). The proposed Security Rule (RIN 0945-AA22) formalises both the asset inventory and the network map as required, reviewed at least every 12 months.
Where it fits
Asset Inventory is a Security module capability and the input to the Risk Analysis Workflow and Vulnerability Tracking.