| Course | HI575 Protection of Health Information |
|---|---|
| Unit | Unit 2 |
| Paper type | Data inventory |
| Length | About 970 words, 6 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | MS in Health Informatics |
| Updated | October 2026 |
Free sample paper for HI575 Unit 2
Seventeen Places the Data Lives: A Unit 2 Data Inventory of an Orthopedic Practice, Four Rows the IT List Missed
[Student Name]
Purdue University Global
HI575: Protection of Health Information
Unit 2 Data Inventory
[Instructor Name]
[Date]
Tollbridge Orthopedic Group, its systems, vendors and every count are composite; the rule and sources cited are real.
Method
The inventory began with the asset list supplied by Tollbridge's IT contractor, which named eleven systems. Interviews followed with the leads for the front desk, imaging, billing, physical therapy and the surgery center, each asked the same question: where does patient information go in your day that a list like this would miss? A walk-through of two clinics and the surgery center checked what the interviews described. The Security Rule's risk analysis requirement begins with knowing where electronic protected health information is created, received, maintained or transmitted (45 C.F.R. § 164.308, 2024), and the government's resource guide treats this inventory as the first step of any assessment (Marron, 2024). Federal guidance on risk analysis adds that the scope must include every form of media, portable devices among them, not only the main clinical system (Office for Civil Rights [OCR], 2010). Six rows exist only because people were asked what they actually use; four of those are electronic and on no IT list.
The Inventory
Each row gives the location, the data it holds, how data arrive, where they go next, how they are disposed of, the internal owner, and whether a business associate agreement is on file for any vendor.
1. Registration and scheduling in the hosted health record: demographics, insurance, appointments; entered at the desk and portal; flows to billing; vendor retains; owner practice administrator; agreement on file.
2. Paper intake tray at each front desk: completed intake forms awaiting scanning; handed in by patients; scanned within a day; shredded by contracted service; owner front desk lead; shredding agreement on file.
3. Patient portal: messages, forms, results; entered by patients and staff; synchronized to the record; vendor retains; owner practice administrator; agreement on file.
4. Imaging modalities (two MRI scanners, digital X-ray): images; acquired at the scanner; sent to the archive; overwritten on the modality after transfer; owner imaging lead; not applicable.
5. On-site imaging archive: all images since 2014; received from modalities; viewed by surgeons and sent to outside facilities; never deleted; owner imaging lead; equipment vendor holds remote access, agreement on file.
6. MRI disc burner: image discs for patients and outside physicians; burned at the console; handed out or mailed; spoiled discs kept in a drawer; owner imaging lead; not on IT list.
7. Hosted health record, clinical documentation: notes, orders, results; entered by clinicians; shared through exchange; vendor retains; owner medical director; agreement on file.
8. Eleven surgeon laptops: local copies of operative schedules and some exported notes; downloaded by surgeons; carried between sites; no disposal procedure; owner each surgeon; not applicable.
9. Fax server: referrals, records requests, prior authorizations; received from outside and sent from staff desktops; stored ninety days; owner IT contractor; agreement on file.
10. Billing platform and clearinghouse: claims, remittances; created from charges; sent to payers; vendor retains seven years; owner billing manager; agreements on file.
11. Workers' compensation spreadsheet on the shared drive: claim numbers, injuries, employer contacts for about 600 patients; typed by billing staff; emailed to adjusters as attachments; never purged; owner billing manager; not on IT list.
12. Email system: messages with attachments; created by staff; sent internally and externally; retained indefinitely; owner IT contractor; agreement on file.
13. Appointment-texting vendor: names, phone numbers, appointment times and clinic location; exported nightly from scheduling; texts sent to patients; vendor retention unknown; owner front desk lead; no agreement on file; not on IT list.
14. Physical therapy home-exercise app: names, diagnoses, exercise plans; entered by therapists; accessed by patients; vendor retains; owner therapy lead; agreement on file.
15. Copier and scanner fleet, nine devices: images of every page copied or scanned, stored on internal drives; created at the device; drives never wiped when leases end; owner office manager; not on IT list.
16. Surgery center anesthesia records: paper and device printouts; created during cases; scanned to the record; paper shredded after scanning; owner surgery center director; not applicable.
17. Backup service: nightly copies of the record extracts, archive and shared drive; created automatically; stored offsite; retention thirty days; owner IT contractor; agreement on file.
Four of the seventeen locations, a copier drive, a disc burner, a spreadsheet and a texting vendor, hold patient data that no one responsible for security knew to protect.
What the Shaded Rows Show
The four unlisted locations share a pattern: each was set up to solve a local problem by someone outside IT. The copier fleet is leased, and leases end with devices returned to the vendor with their drives intact. Spoiled image discs accumulate in a drawer beside the MRI console. The workers' compensation spreadsheet began as one biller's tracking tool and became the department's system. The texting vendor was signed up with a credit card by the front desk lead to reduce no-shows, and no business associate agreement was ever requested, although the vendor receives names, phone numbers and appointment details.
Record Counts
Counts are approximate and come from the systems themselves where possible: about 48,000 active patients in the record, roughly 310,000 imaging studies in the archive, about 600 rows in the workers' compensation spreadsheet and some 42,000 phone numbers exported to the texting vendor last year. The copier drives cannot be counted without forensic review.
Questions Passed to the Threat Analysis
1. What happens to copier drives when a lease ends?
2. Who can reach the imaging archive from outside?
3. Which laptops are encrypted?
4. What does the texting vendor do with exported data?
References
45 C.F.R. § 164.308 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
Marron, J. A. (2024). Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A cybersecurity resource guide (NIST Special Publication 800-66r2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-66r2
Office for Civil Rights. (2010). Guidance on risk analysis requirements under the HIPAA Security Rule. U.S. Department of Health and Human Services.
The Purdue Global HI575 Unit 2 instructions
Unit 2 typically asks you to inventory the locations of electronic protected health information in an organization from the course case or your workplace. Expect a table listing each system or place, the data it holds, how information arrives and leaves, how it is disposed of, who owns it and whether a vendor agreement exists. Three or four pages is common. Explain your method first, especially if you went beyond an IT asset list. Order rows along the information's life cycle so disposal and transfer are not forgotten. Include paper and portable devices where they hold patient data. Mark any vendor that receives information without a business associate agreement. End with questions the threat analysis should answer next.
How the HI 575 Unit 2 example is put together
A method paragraph explains how interviews and a walk-through added rows the IT list missed, citing the Security Rule's risk analysis requirement, the federal resource guide and OCR's guidance on scope. Seventeen numbered rows follow, from the hosted record's registration module to the backup service, each with data, flows, disposal, owner and agreement status. The highlighted sentence identifies the four unlisted locations. A section on the shaded rows explains how each grew from a local fix outside IT, including a texting vendor signed up on a credit card. Record counts are given where systems allow, and copier drives are noted as uncountable. Four questions passed to the threat analysis close the inventory.
Reading the HI575 Unit 2 grading rubric
An inventory like this one is typically marked for how much it finds, how exactly it describes each row, how it is ordered, and whether vendors and disposal get proper attention. Completeness carries the largest share, and graders look for locations beyond the main record system, including portable devices, paper, copiers and vendors. Accuracy is judged on whether each row's data and flows are plausible and specific. Organization earns credit when rows follow a logical order and columns are consistent. Vendor agreement status and disposal practices are often scored separately because they are commonly missed. A clear method paragraph adds credibility. Correct citations complete the rubric. Inventories that list only servers and applications from an IT perspective tend to lose most completeness points. Row-level detail matters too: a vague entry such as cloud storage earns less than one naming the service, its data and its owner.
Common HI575 Unit 2 mistakes, and how to avoid them
The most common weakness is an inventory copied from an IT asset list, which misses the places staff actually use. Another is leaving out disposal, so the end of the information's life stays invisible. Some students forget portable devices, copiers or texting services. Vendor rows often lack agreement status. Counts presented without a source draw questions. When your organization keeps information in unusual places, such as a research freezer log or a transport tablet, list them for us with the prompt, and the inventory will be built around those locations. Rows without a named owner are another frequent gap, because nobody can be asked to fix a location that belongs to no one.
Get an HI575 Unit 2 example written to your instructions
Your section may supply its own organization or leave the setting open. Either way, send the Unit 2 prompt and rubric, plus any system list or scenario you were given, and a first custom inventory arrives free inside 24-48h, organized around the locations and vendors that particular setting actually has. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More HI575 papers and MS in Health Informatics samples
- HI575 Unit 1: Discussion Board Post
- HI575 Unit 3: Threat and Vulnerability Analysis
- HI575 Unit 4: Risk Analysis Matrix
- HI575 Unit 5: Access Control Policy
- HI575 Unit 6: Technical Safeguards Brief
- HI575 Unit 7: Incident Response Plan
- HI575 Unit 8: Seminar Reflection
- HI575 Unit 9: Contingency and Recovery Plan
- HI575 Unit 10: Security Risk Assessment Report
- HI570 Unit 2: Case Brief
- HI560 Unit 2: Data Set Description
- HI501 Unit 2: Capture Workflow Analysis
- HI555 Unit 2: Account Trace
HI575 Unit 2 questions, answered
Should paper records appear in a data inventory?
Yes, wherever paper holds protected information. The Security Rule itself addresses electronic information, but many assignments ask for the complete picture, and paper often feeds the electronic systems. The example lists the intake tray and scanned forms as rows, then notes which rows fall under the electronic rule and which under broader privacy obligations, so the scope is stated rather than assumed.
How many rows does a strong inventory need?
As many as the setting has locations, which is why no fixed number applies. The composite practice produces seventeen, including four that surfaced only in interviews. A short inventory is not itself a defect, but one that omits devices with storage, removable media or a vendor that clearly touches patient data will look incomplete to a grader who knows clinics.
Do I need real record counts for each system?
No. Invented figures read as fabricated, and graders tend to notice. The example places volumes in brackets and states that only the organization could supply them. Where your scenario provides numbers, carry them into the table and cite the scenario. Where it does not, a bracketed placeholder with the reason attached is the more defensible choice.
Where can I find a free HI575 Unit 2 sample paper?
The complete Unit 2 inventory is posted here, with seventeen rows, four locations the IT list missed and questions for the threat analysis.
Should copiers appear in a health information data inventory?
Yes. Many copiers and scanners store images of every page on an internal drive, and leased devices are often returned with those drives intact.