HIPAA asset inventory and network map: how to prepare now

A law firm handling a hospital's malpractice defense, an accounting firm preparing a medical group's books and a nonprofit running a health program all hold electronic protected health information (ePHI). Each would face the same question from the Office for Civil Rights (OCR) after an incident: where was the data, and how did you know? The proposed HIPAA Security Rule update would turn that answer into two written documents, a HIPAA asset inventory and an ePHI network map. Firms that build them now will be ready for the final rule and better positioned under the current one.

What would the proposed HIPAA rule require for asset inventories and network maps?

The proposed rule would require a written technology asset inventory and a network map showing how ePHI moves through your systems. HHS published the proposal in the Federal Register on January 6, 2025 (90 FR 898). The HHS fact sheet lists the requirement among the main changes.

According to the fact sheet, the proposal would:

• Require the development and revision of a technology asset inventory and a network map.
• Require the map to illustrate the movement of ePHI throughout the entity's electronic information systems.
• Require both to be updated at least every 12 months and in response to relevant changes in the environment or operations.
• Require the risk analysis to include a review of the inventory and the network map.

The proposal would apply to covered entities and business associates alike, which includes law firms, accounting firms and IT providers that create, receive, maintain or transmit ePHI for a client.

When would the asset inventory requirement take effect?

Not before a final rule is published, and that date is uncertain. The federal regulatory agenda entry for RIN 0945-AA22 lists the rulemaking as a long-term action with final action targeted for July 2027. Agenda dates are targets, and an earlier edition listed a date that passed without a final rule.

For the full status of the rulemaking, see where the HIPAA Security Rule update stands.

The proposal itself sets the clock that would follow. HHS proposed that a final rule take effect 60 days after publication, with compliance due 180 days after the effective date. On that schedule, a firm would have roughly eight months from publication to have its inventory and map in place. The final text could change any of these details.

Does the current HIPAA Security Rule already expect an asset inventory?

In practice, yes. The current rule does not use the words "asset inventory," but its risk analysis requirement is hard to meet without one. 45 CFR 164.308(a)(1)(ii)(A) requires "an accurate and thorough assessment" of the risks to the confidentiality, integrity and availability of ePHI.

OCR's guidance on risk analysis says the analysis should cover ePHI in all forms of electronic media and that "an organization must identify where the e-PHI is stored, received, maintained or transmitted." That is the core of an inventory and a data flow map.

Two other current provisions point the same way:

• 45 CFR 164.310(d)(1) requires policies governing hardware and electronic media containing ePHI as they move into, out of and within a facility. Its accountability specification, which is addressable, calls for a record of those movements and the person responsible.
• 45 CFR 164.308(a)(8) requires periodic evaluation in response to environmental or operational changes, which is the same trigger the proposal uses for updating the inventory and map.

A risk analysis that cannot say which laptops, cloud services and vendors touch ePHI is hard to defend as accurate and thorough.

Business associates are not exempt from that scrutiny. In August 2025, OCR announced a settlement with BST, a New York accounting firm and HIPAA business associate, as the tenth enforcement action in its Risk Analysis Initiative. Read more on why OCR keeps enforcing the HIPAA risk analysis.

What should a HIPAA technology asset inventory include?

It should list every technology asset that could affect the confidentiality, integrity or availability of ePHI, with enough detail to assign risk and responsibility. The final rule may specify fields. Until then, a practical inventory records:

• Endpoints: laptops, desktops, phones and tablets that access ePHI, including personal devices if you allow them.
• Servers and storage: file servers, network storage and backup targets, on site or hosted.
• Cloud services: email, document management, practice management, e-signature, file sharing and any AI tools staff use with client files.
• Network devices: firewalls, switches, wireless access points and remote access gateways.
• Software: applications that store or process ePHI, with version and support status.
• For each asset: an owner, a location, whether it holds ePHI and the date it was last reviewed.

Business associates should also list the client systems they log in to. A firm that works inside a hospital's portal still uses its own devices and accounts to get there.

If you want an outside structure for the list, CIS Controls 1 and 2 break hardware and software inventory into specific safeguards you can adopt.

What should an ePHI network map show?

It should show how ePHI enters your environment, where it goes and how it leaves. A useful map for a small firm traces each path from start to finish:

• How ePHI arrives: client portal upload, encrypted email, a vendor's secure file transfer or access to the client's system.
• Where it is stored: document management, a matter or engagement folder in Microsoft 365, a practice system or backups.
• Who and what can reach it: user groups, remote access methods and connected third-party apps.
• How it leaves: delivery to the client, filings, disposal or return at the end of an engagement.
• Which vendors touch it along the way, with a pointer to each business associate agreement.

The map does not need to be an engineering diagram. A clear drawing with a short narrative for each flow is easier to keep current and easier to show an auditor.

How do you keep the inventory and map current?

Tie updates to events you already track, then confirm everything once a year. The proposal's 12-month cycle and its change trigger match how most firms already operate:

• Add or retire assets as part of onboarding, offboarding and device replacement.
• Review the map before a new cloud service or AI tool goes live with client data.
• Update both after an office move, a network change or a merger.
• Reconcile the inventory against your device management and identity systems at least quarterly.
• Keep each version. 45 CFR 164.316(b) requires Security Rule documentation to be retained for six years.

Automated discovery tools reduce the manual work, but someone accountable still has to sign off that the inventory is complete.

What should your firm do this quarter?

Start with the data, then the devices. Four steps give a firm a defensible baseline before the final rule arrives:

• List every client relationship that involves PHI and confirm a business associate agreement is in place for each.
• Draft the network map for your top three ePHI flows and have the people who handle the data check it.
• Export a device and cloud application list from your management tools and mark which items touch ePHI.
• Feed both into your next risk analysis update and record the date.

If OCR or a covered entity client asks how you know where its data is, these documents are the answer.

How does s90 help?

s90 builds and maintains technology asset inventories and data flow maps for firms that handle PHI as business associates, and ties them to the risk analysis your clients and OCR expect. If you would like a second look at where your ePHI lives, we are happy to talk.