How do healthcare teams find every asset that touches patient data?

To find every healthcare asset that touches patient data, start from the data, not the device list. Trace where electronic protected health information (ePHI) is created, stored and sent, then record each system, owner and connection on that path. Repeat the trace on a schedule, because the inventory ages fast.

Why does the HIPAA text point to an inventory?

The HIPAA Security Rule, in 45 CFR 164.308, requires a risk analysis, defined as an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by a covered entity or business associate. It also requires risk management: security measures sufficient to reduce those risks to a reasonable and appropriate level.

You cannot assess risk to systems you do not know exist. The rule does not use the words asset discovery, but the risk analysis cannot be accurate and thorough without one.

Two other parts help. Section 164.310(d) covers device and media controls, including an addressable specification to maintain a record of the movements of hardware and electronic media and the person responsible. And 164.312(b) requires audit controls: mechanisms that record and examine activity in systems that contain or use ePHI.

Where do healthtech inventories usually have holes?

A constructed example: a telehealth startup lists its production database, two web apps and a cloud storage bucket. A walk through the data finds more:

• A reporting export that a billing contractor downloads to a shared drive each week.
• A test environment loaded with a copy of production data, still running.
• A mobile app crash tool that records screen text, including a patient name field.
• A messaging channel where support staff paste appointment details.
• An old integration with a lab, using credentials nobody rotated.

None of these were on the asset list. All of them hold or move ePHI. Discovery by device would have missed several, because they are services, accounts and data flows, not machines.

What should an asset record hold?

Keep it short enough that people maintain it:

1. Name and type: server, database, SaaS application, mobile app, API, device, account.
2. Owner: one named person or team.
3. Data held: does it store, process or transmit ePHI, and which kinds?
4. Connections: what it sends data to and receives from.
5. Where it runs: cloud account, region, facility.
6. Protection: access method, encryption, logging, backup.
7. Vendor and agreement: whether a business associate agreement is in place, where relevant.
8. Last verified date.

Where can you discover things automatically?

Use several sources, because each has blind spots:

• Cloud account inventories and billing lists show services you pay for.
• Network and DNS logs show what talks to what.
• Identity provider logs show which applications staff sign in to, including ones IT never approved.
• Code repositories show dependencies, API calls and third-party services in the software you build.
• Procurement and expense records show subscriptions bought outside IT.
• Software bills of materials and dependency scans show the components inside your own applications.

For the software side, Safeguard offers asset discovery and SBOM and dependency scanning as generally available capabilities, which can feed the application layer of this inventory. The data-flow trace and the vendor review still need people.

How to check or apply this

1. Pick one patient journey, such as booking a video visit, and trace its data from sign-up to billing to deletion.
2. For each stop, add or update an asset record with the fields above.
3. Compare your list with cloud accounts, identity provider apps and expense records. Every item on those that is not in your list is a finding.
4. Mark each asset by whether it holds ePHI, and rank your risk analysis effort by that mark.
5. Record movements of devices and media that carry ePHI, in line with 164.310(d).
6. Assign an owner to each unowned asset within two weeks, or shut it down.
7. Rerun the trace every quarter and after every new vendor or integration.

Quick check

Sources

• 45 CFR 164.308, Administrative safeguards (eCFR)
• 45 CFR 164.310, Physical safeguards (eCFR)
• 45 CFR 164.312, Technical safeguards (eCFR)

Last reviewed: 18 October 2026.