(Legacy) Navigating HIPAA-Compliant Device and Cloud and Application Management

Previously, Compliancy Group provided our Clients with a Device Audit; At the end of 2022, we created and released the Device Inventory and Application Inventory, which replace the legacy content (Device Audit/Cloud Storage Audit) we had provided in the past. This Knowledge Base article will cover the transfer of information from the Device Audit to the Device Inventory, and may only be relevant to Customers who have used The Guard prior to the Inventory release in 2022/2023.

The Guard’s user interface has been updated to make it much easier to navigate and keep tabs on program progress while organizing key elements in a more intuitive way, grouping tasks with their related assessments to better show the flow between them.  

The Assets page is a new place to organize and track your two key Inventories, The Device Inventory and the Cloud and Application Inventory. In the previous version of the site, your Device Audit was in the Achieve > Audits section with all your Security Risk Assessment questionnaires. In today’s Coach’s Corner, we’ll show you how to access a Device Inventory you’ve previously uploaded so you can transfer the data into the new Device Worksheet and add it into the new Assets page.

To download the new Device Inventory worksheet from the Assets page, click on the Assets icon in the Navigation Panel on the left and then, on the Devices tab, click the Bulk Upload button. Click the Download Template button to download the new Device Inventory worksheet. Follow the steps below to access your previous Inventory to transfer the data to the new worksheet.

(Method 1:  Click on Device Inventory from Assessments page)

You can access your previous Device Inventories by clicking on the Programs icon in the Navigation Panel on the left, which will bring you to your current and former assessments and inventories.

Scroll the list of assessments until you find the “HIPAA Device Audit” from the previous year (because the view defaults to the first 10 records, you may need to go to the second page to see additional assessments by clicking the Page Navigation options at the bottom of the list.  You can also set the number of visible Rows per Page to a larger number of rows via its Rows per Page dropdown.) 

By selecting the HIPAA Device Audit, The Guard will download an Excel Spreadsheet for you. You can then open this spreadsheet using Excel, Google Sheets, etc (any valid spreadsheet viewer/editor should open the .xlsx document). Note: When attempting to open the spreadsheet, it’s possible for an error to occur. If you experience this error, this could mean your previous Device Audit had no content uploaded OR there’s another issue – Proceed to Method 2

You can copy the information from this worksheet into the New Device Inventory worksheet.

(Method 2:  Add a Report and output to CSV)

You can run an IT Device Audit Summary Report from the Reports page of The Guard to output a CSV file of your devices from previous years.  You can then copy and paste the information from that file into the new Device Inventory worksheet.  

1. Click on the Reports icon in the Navigation panel on the left.  Once on the Reports page, click the Add Report button to call up the Report Generator (See Image (1) below).  In the Add Report window, choose IT Device Audit Summary from the Report Name dropdown and click the Add Report button (See Image (2) below).
2. The Report will begin processing in the background and usually takes between thirty seconds to a minute to complete (Please note: The Status will NOT automatically change from New to Ready, you’ll need to refresh the page/table to update the Report status).  
3. Once the Report status reads READY, you can download a CSV file of the Report by clicking the icon that looks like three dashes in the rightmost column and then choose Download CSV from the menu that appears (See Image (3) below).

With both the new Device Inventory Worksheet and last year’s Device Audit open, you can copy information from last year’s document to the new one.

Only the fields marked with an asterisk* in the new Worksheet are required at minimum to be completed:

• Device Name
  • The name of the Device  
• Device Type
  • Device Type (Desktop Computer, Laptop, Server, Tablet, etc.) This is a dropdown from which you can select the appropriate Device Type
• Activation Date
  • The date you started using the device, your best approximation if you do not know the exact date
• User Assigned
  • The user assigned to the device – this must match a name exactly as entered into the Guard, put the Compliance Officer’s name in the field if there is no name to match.
• Stores/Touches ePHI
  • Yes or No dropdown, does this device access or potentially store electronic Protected Health Information (ePHI).
• Security Controls (EndPoint Protection and Encryption)
  • Yes or No drop downs, EndPoint Protection includes Antivirus and Malware protections and Encryption takes your data or written text/PHI and turns it into unreadable text using software or algorithms. This unreadable text can only be deciphered through an encryption key that will allow you to read it once again.
• Risk Rating
  • A risk assessment based on, among other things, the protections you have on the device to safeguard the ePHI. This is a dropdown with a range of number from 1 to 10. Set the Degree of Risk by selecting one of the values (if you do not have the protections, it is generally a higher risk.
• Associated Site
  • The name of the site associated with the Device, you’ll find this in the Administration section of the Guard by clicking the Admin link in the Navigation panel on the left.

Upload the Updated Device Inventory Worksheet

Once completed, click the Assets icon in the Navigation Panel on the Left, click on the Devices tab and then click the Bulk Upload button to drag and drop this new template into the upload window and upload to the Guard.