Article 3 of 12  |  HIPAA Security Readiness: A 12-Month Roadmap for Healthcare Organizations

You Can’t Protect What You Can’t See: Asset Inventories, Network Maps, and ePHI Under the Proposed HIPAA Security Rule

The issue

If someone asked you today to identify every technology asset in your organization that stores, transmits, accesses, or could affect electronic protected health information, how confident would you be in the answer?

Most healthcare organizations can readily identify their obvious systems: the electronic health record, practice-management software, servers, computers, and perhaps their backup system. But modern healthcare environments can also include cloud applications, laptops, network equipment, wireless networks, remote-access tools, connected clinical equipment, mobile devices, third-party integrations, and vendor-managed systems.

That does not mean every device or application in a healthcare organization automatically falls within the same HIPAA security scope. The more useful question is:

Could this technology affect the confidentiality, integrity, or availability of our ePHI?

Understanding that environment is already important under today’s HIPAA Security Rule. OCR recommends identifying where ePHI is located and understanding how it enters, flows through, and leaves an organization’s information systems.

The proposed HIPAA Security Rule would make this process considerably more explicit. HHS has proposed requiring regulated entities to maintain a written technology asset inventory and a network map illustrating the movement of ePHI throughout their electronic information systems. Those records would then become foundational inputs into the organization’s risk analysis.

Before you can meaningfully assess your risks, you need a reliable understanding of the environment you are protecting.

Start with the technology asset inventory

An asset inventory might seem straightforward. Count the computers, list the servers, record the firewall model, and consider the job finished.

A useful security inventory requires more detail.

The proposed rule would require an accurate and thorough written inventory of electronic information systems and technology assets that may affect the confidentiality, integrity, or availability of ePHI. Depending on the organization, relevant technology could include:

• Desktop computers and workstations
• Laptops and mobile devices
• Physical and virtual servers
• Firewalls, switches, wireless access points, and other network infrastructure
• Cloud applications and services
• Backup systems
• Remote-access technologies
• Clinical or medical equipment with network connectivity
• IoT and other connected devices
• Software and systems used to create, receive, maintain, or transmit ePHI
• Technology managed or accessed by outside service providers

Not every item on that list applies to every healthcare environment. This is why the inventory process is important.

The goal is not to treat every connected device as a HIPAA issue. The purpose is to give your organization enough visibility to identify which technology assets should be considered when protecting ePHI and evaluating risk.

A system doesn’t necessarily need to contain patient records to matter

One of the important concepts in the proposed rule is that HHS is looking beyond only those systems that directly create, receive, maintain, or transmit ePHI. A connected technology asset could potentially affect the security of another system that does contain ePHI.

Suppose, for example, a healthcare organization has clinical systems on its network along with other connected devices that do not contain patient information. Whether those other devices create meaningful risk depends on how the environment is configured.

If those devices are properly isolated, risk is limited. If they share connectivity with systems containing ePHI, a compromised device can create another path into the environment.

This is why “Could this technology affect the confidentiality, integrity, or availability of our ePHI?” is a more useful security question than simply asking whether the device itself contains patient records.

A recent OCR enforcement action reinforces the importance of understanding the complete environment. In 2026, OCR reached a $5,000 settlement with Vision Upright MRI following an investigation involving unauthorized access to a Picture Archiving and Communication System (PACS) server containing medical images for 21,778 individuals. OCR’s investigation found that the provider had failed to conduct an accurate and thorough risk analysis.

The enforcement action does not establish that the PACS server was missing from an asset inventory or that an inventory failure caused the incident. What it does demonstrate is the importance OCR continues to place on understanding the systems containing ePHI and evaluating the risks and vulnerabilities affecting them. In announcing the settlement, OCR specifically recommended that healthcare organizations identify where ePHI is located and understand how it enters, flows through, and leaves their information systems.

An inventory tells you what you have. A network map shows how it connects.

A spreadsheet might show that an organization has 25 workstations, a firewall, two wireless networks, several cloud applications, a server, and connected clinical devices. It does not show how those systems interact.

That is where network mapping becomes valuable.

Under the proposed rule, regulated entities would be required to develop a network map illustrating the movement of ePHI throughout their electronic information systems, including how ePHI enters and exits those systems and how it can be accessed externally.

A useful network map can help an organization understand:

• How workstations and servers are connected
• Which devices share network segments
• Where wireless networks fit into the environment
• How remote access is provided
• Which systems communicate with cloud services
• Where outside vendors connect
• Which systems can communicate with systems containing ePHI
• Where important security boundaries exist

Today’s Security Rule does not require a formal network map as proposed in the NPRM. Still, creating and maintaining a network map is valuable because it helps your organization understand its environment and conduct a meaningful risk analysis.

It is important to distinguish between current best practices and proposed regulatory requirements.

Then follow the data

Knowing what equipment exists and how it connects still leaves another important part of the picture: where the ePHI actually goes.

Consider a typical patient encounter. Information might be entered into an EHR or practice-management system, accessed from a workstation, exchanged with an imaging or clinical system, transmitted to a clearinghouse or another provider, stored in a cloud platform, included in an email workflow, backed up to another location, or made accessible to an outside vendor.

Every organization is different. The objective is not to assume that all of those scenarios apply. It is to understand the workflows that actually exist.

One useful exercise is to trace a typical ePHI workflow from beginning to end. Identify where the information enters, which systems interact with it, where it is stored and backed up, where it is transmitted, whether it can be accessed remotely, and which third parties can access or receive it.

No actual patient’s information needs to be documented to perform this exercise. You are mapping the flow of information, not an individual patient.

Don’t forget the systems you don’t manage yourself

Healthcare organizations routinely depend on outside companies for services such as EHR platforms, billing, cloud applications, email, backups, remote support, medical technology, and IT services.

Those relationships matter because an organization may not own or directly administer every system that affects its ePHI. This is one reason a technology inventory should not become merely an equipment list. You also need enough visibility to understand the external systems and services that interact with your environment or information.

We will address business associates and vendor risk in greater detail later in this series. For now, the objective is simply to understand which outside organizations and technologies are part of the environment you are trying to protect.

The problem with point-in-time documentation

You can perform a thorough technology audit today and create an accurate inventory and network map. Then the environment changes.

A laptop might be replaced, a new application deployed, the firewall upgraded, or a vendor could install new equipment. A cloud service or integration might be added. These changes do not automatically create a security problem, but each one can make previous documentation less accurate.

The proposed rule recognizes this challenge. HHS proposes requiring technology asset inventories and network maps to be reviewed and updated on an ongoing basis, at least once every 12 months, and when changes to the environment or operations may affect ePHI.

Creating documentation and maintaining documentation are two different jobs.

A point-in-time audit can be perfectly appropriate. A qualified provider assesses the environment, creates the necessary documentation, delivers a report, and returns when another assessment is needed.

The challenge is what happens between those assessments.

At the next review, the provider may need to reconstruct what changed during the previous year. Practice administrators and other employees may need to help identify equipment replacements, new applications, vendor changes, network modifications, and other technology decisions. This process takes time from both the provider and the healthcare organization.

Why a managed approach can be more efficient

When the provider responsible for an environment also maintains its documentation as changes occur, there is less information to rediscover during the next annual review.

For environments that change during the year, maintaining visibility through an ongoing managed service can be more efficient than paying for repeated manual audits. This approach can also reduce the administrative burden on your practice. Instead of asking staff to reconstruct a year’s worth of technology changes, start the annual review with documentation that has been maintained throughout the year.

Managed documentation is not always the least expensive option for every organization. A stable environment with few changes may have different needs than a growing organization that regularly adds technology, employees, applications, vendors, or locations.

The better question is:

What does it cost us to keep an accurate understanding of our environment?

That calculation includes both outside technical labor and the internal time required to help a provider determine what changed.

Three levels of visibility

It can be useful to think about technology documentation in three stages.

1. Undocumented environment

Knowledge about the environment may be distributed among employees, vendors, invoices, old spreadsheets, configuration files, and individual memory. Security assessment becomes more difficult because the first task is determining what actually exists.

2. Point-in-time documentation

The organization has an inventory, network documentation, or other records that provide a reliable snapshot. This is a significant improvement, but those records still need to be reconciled as the environment changes.

3. Managed documentation

Technology records are maintained as part of the ongoing management of the environment. Instead of reconstructing an entire year’s worth of changes during an annual review, relevant documentation can be updated as those changes occur.

The goal is not to create documentation just to have it. The objective is to maintain reliable visibility so you can make informed security decisions.

Four actions to take this month

1. Review your technology asset inventory

First, determine whether one exists. If it does, look at when it was last reviewed and compare it with the environment that exists today. Don’t automatically limit the exercise to computers and servers. Consider relevant network infrastructure, software, cloud services, connected clinical technology, mobile devices, and other technology that could affect ePHI.

2. Identify technology that could affect ePHI

Look beyond whether a system directly displays or stores patient information. Consider whether its connectivity, access, privileges, or relationship to another system could affect the confidentiality, integrity, or availability of ePHI. This is an assessment question, not a presumption that every connected device creates a HIPAA compliance issue.

3. Review how the environment is connected

If you have a network map, determine whether it still represents your current environment. If you do not have one, consider whether creating one would improve your organization’s ability to understand connectivity, identify security boundaries, evaluate external access, and conduct a meaningful risk analysis.

4. Trace a typical ePHI workflow

Choose a common business or clinical workflow and follow the information. Identify where it enters the organization, which systems interact with it, where it is stored and backed up, where it leaves the organization, and which third parties may access it. You do not need a perfect diagram on the first attempt. The objective is to identify what you know and what still needs to be verified.

Evidence to retain

As you complete this month’s review, consider retaining:

• Your current technology asset inventory
• The date it was last reviewed or reconciled
• Available network diagrams or maps
• Relevant software and cloud-service inventories
• Documentation identifying systems that create, receive, maintain, transmit, or may affect ePHI
• Information about relevant third-party connections and services
• Documentation of significant technology or network changes
• Records showing when inventories or maps were updated
• Any identified gaps requiring additional investigation

These records will be especially useful in the next stage. Risk analysis is easier to support when you can show what environment was actually evaluated.

How Solid approaches this

At Solid, we believe useful technology documentation should reflect the environment as it exists today, not simply the environment that existed when someone created a spreadsheet or diagram.

Our managed-services standards establish visibility into the technology we manage, including defined asset-management practices. For organizations that need greater documentation of their environment, continuously managed network and data-flow mapping is also available as part of our managed-service structure.

The important difference is that documentation can be maintained as the environment changes rather than manually recreated each year.

For an environment that changes regularly, this approach can reduce the technical labor required to rediscover changes during an annual review. It can also reduce the administrative time a healthcare organization spends helping its provider reconstruct what happened over the previous twelve months.

The result is more than a diagram for compliance. Current documentation supports security reviews, risk analysis, troubleshooting, technology planning, and future compliance requirements.

We would rather help maintain an accurate picture of your environment than repeatedly rediscover it.

At a glance

Regulatory status (September 2026)

• Proposed Rule: HIPAA Security Rule NPRM (90 FR 898, RIN 0945-AA22)
• Published: January 6, 2025
• Public comments closed: March 7, 2025
• Current Unified Agenda status: Long-Term Action
• Current Unified Agenda projection: Final action July 2027, subject to change and not binding
• Current HIPAA Security Rule: Fully effective and actively enforced

The written technology asset inventory and network-map requirements discussed in this article remain proposed requirements. Organizations should continue complying with the current Security Rule while evaluating how the proposed changes could affect future security and documentation practices.

Where this series goes next

Over the first three articles in this series, we have moved from understanding the proposed regulatory changes, to examining the changing standard for implementation specifications, to identifying the environment that needs to be protected.

Next month, we take the next step: risk analysis and risk management.

Once you understand your technology, connectivity, ePHI workflows, and relevant third parties, you are in a much better position to identify potential threats and vulnerabilities, evaluate risk, prioritize remediation, and document the decisions your organization makes.

That is where an inventory becomes an input to a broader security program.

Follow the complete series: Visit our HIPAA Security Readiness resource page to read previous articles and follow the 12-month roadmap.

This article discusses proposed modifications to the HIPAA Security Rule published as a Notice of Proposed Rulemaking on January 6, 2025. The proposals have not been finalized and may change. This content is provided for educational purposes and does not constitute legal advice.