Assets
This page explains the Assets page: what to put on the list, what each field means, and how the list turns your HIPAA controls green or red.
The idea in one minute
Your asset list is where your patient data lives: the applications, devices, cloud storage, paper and removable media. For each one you say who owns it, how important it is, whether it is encrypted, and, if an outside company hosts it, who that company is.
You don't set any control by hand. RiskFlow reads the list and turns the controls it covers green or red, and the failing control names the asset that caused it.
- Only assets that hold patient data (ePHI) change a control. Everything else is listed for completeness.
- No assets, no signal. Turning on HIPAA doesn't turn anything red. A control only moves once you list something it checks.
- The readiness score on Frameworks moves with it.
Who can do what
| Role | Assets |
|---|---|
| ORG Admin | See, add, edit, import, retire, record disposal, delete, mark reviewed |
| ORG Auditor | See everything. Read-only |
| Other ORG roles | No access |
A custom role needs the asset-management permission (MANAGE_ASSETS) to change the list. Each clinic sees only its own assets. Another clinic, even one managed by the same MSP, can't see yours, and asking for one of your assets behaves as if it doesn't exist.
What to list
| Type | Examples | Which controls look at it |
|---|---|---|
| Application | EHR, billing app, patient portal | Data criticality, Business associate agreements |
| Device | Laptop, desktop, phone, tablet, server | Device inventory, Encryption at rest, Media disposal |
| Cloud storage | Dropbox, a shared drive | Data criticality, Encryption at rest, Business associate agreements |
| Paper | Paper charts, a filing cabinet | None yet. Listed so risks and the assessment can point at it later |
| Media | USB drive, backup disk | Device inventory, Encryption at rest, Media disposal |
List anything that holds or can reach patient data. If it never touches ePHI, either leave it off or switch Holds patient data (ePHI) off.
What each field means
| Field | What to put | Why it matters |
|---|---|---|
| Name | What staff call it, for example Front desk laptop | The name shows up in the failing control |
| Type | One of the five above | Decides which controls look at it |
| Identifier | A serial number, asset tag or URL. Optional | Must be unique on your list. A CSV import uses it to find an asset that already exists |
| Owner | A member of your team | A device with no owner fails Device inventory. If the owner leaves the team, the asset counts as having no owner |
| Location | Where it is, for example Billing office | A device with no location fails Device inventory |
| Holds patient data (ePHI) | On by default | Only these count toward your controls |
| Criticality | Low, Medium, High or Critical. Starts as Not rated | An application or cloud store that isn't rated fails Data criticality |
| Longest it can be down (hours) | Optional | Recorded for planning. No control uses it yet |
| Encryption | Encrypted, Not encrypted or Unknown. Starts as Unknown | Not encrypted fails Encryption at rest. Unknown turns it to Needs evidence until someone checks. This is your own answer. RiskFlow doesn't check the device |
| Hosted by | Not set, One of your vendors, or Someone else… | See below |
| Notes | Optional |
Hosted by
If another company runs the system, say so. It needs a signed BAA.
- One of your vendors. Pick a vendor you already invited. It is covered when it has signed your current BAA. A vendor you no longer work with is never covered, even if it signed earlier. Anyone who can change the asset list can pick a vendor. You don't need access to Documents for this.
- Someone else… Type the company's name, for example Google or Dropbox, and attach their BAA file. Use this for big providers that sign outside RiskFlow and will never log in here. The file is saved in Documents, in the Asset records folder, together with disposal certificates. Attaching a file also needs permission to upload documents. If the file doesn't upload, the asset is still saved and the form stays open so you can try the file again. If you delete that file in Documents later, the asset loses its BAA and the control updates right away.
- Not set is for things you run yourself, like in-house devices and paper.
How the list drives controls
| Control | Looks at | Failing when | Needs evidence when |
|---|---|---|---|
| Device inventory | Active devices and media that hold ePHI | A device has no owner on the team, or no location | The list hasn't been reviewed for a year |
| Data criticality | Active applications and cloud storage that hold ePHI | A system isn't rated | |
| Encryption at rest | Active devices, media and cloud storage that hold ePHI | One is marked Not encrypted | One is Unknown |
| Media disposal | Retired devices and media that held ePHI | A retired device has no disposal record | |
| Business associate agreements | Active assets that hold ePHI and have a host | The vendor hasn't signed, or the typed company has no BAA file attached |
When every asset in scope is fine, the control is Passing and says how many it checked. If two sources disagree, the worst one wins, the same as on Evidence.
Adding assets
- Add asset opens a form for one asset.
- Import takes a spreadsheet (CSV), good for a first load of many devices. The Import window has a template to download with the right columns. The columns are
name,type,identifier,owner_email,location,holds_ephi,hosted_by,criticality,encryptionanddescription. Onlynameandtypeare required.
How an import works:
- RiskFlow checks the file first and shows each row as create, update or error. Nothing is saved yet.
- If any row has an error, nothing can be imported. Fix the file and check it again.
- A row whose
identifiermatches an existing asset updates it. A blank cell leaves the stored value alone. A row with no match creates an asset. - The import is all or nothing, with a limit of 1,000 rows. It is written to the audit log as one entry.
Owners are matched by email and must already be on your team. A vendor name in hosted_by must match one of your vendors.
Retiring a device
Retire a device instead of deleting it, so you can still prove what happened to it.
- Select Retire on the asset. It leaves the active list and moves to the Retired tab. Device inventory and Encryption at rest stop looking at it.
- Media disposal now looks at it. It fails until you select Record disposal.
- Record how it was disposed of (wiped, destroyed, returned or other), when, an optional note, and an optional certificate file, which is saved in Documents in a folder called Asset records.
Delete is only for an asset added by mistake.
Reviewing the list once a year
HIPAA expects the list to be checked, not only kept. Select Mark as reviewed and confirm the number of active assets. RiskFlow records who reviewed it and when.
- A year after the last review (or, if it was never reviewed, a year after your oldest device was added), Device inventory turns to Needs evidence. A brand-new list is never stale on day one.
- Marking the list reviewed turns it back to Passing.
- The page shows when the next review is due.
The check runs in a daily job. For whoever deploys RiskFlow, see Evidence: the daily job.
Audit trail
Every change is written to the audit log: compliance.asset_created, compliance.asset_updated, compliance.asset_retired, compliance.asset_disposed, compliance.asset_deleted, compliance.asset_inventory_reviewed and compliance.assets_imported. Each time a control changes colour because of the list, compliance.control_status_changed is written too.
Good to know
- A control that the asset list drives shows the assets behind it on its page, and the Vendors page shows how many of your systems each vendor hosts.
- Details of the design are in ADR 010.