Read a hospital's information security policy and you will almost certainly find "USB drives are prohibited in principle." Meanwhile, in the same hospital, radiology burns images to disc for patients, a physician takes conference slides home on a personal drive, and a technologist moves analyser data on a USB stick.
That is not a story about rules being broken. It is a story about rules that have not absorbed what the work requires. Removable media persists because tasks depend on it. Tightening a prohibition without addressing those tasks makes the usage invisible rather than absent — and invisible usage is the harder problem.
At the same time, loss and disclosure through removable media is a persistent category of incident in healthcare. Patient information carried out on an unencrypted drive and lost on the way home. Data still present on equipment that was resold. These are not the product of sophisticated attacks; they happen in the course of ordinary work.
This article sets out how to think about removable media controls. It covers the familiar measures — restriction, encryption, registers — but puts the most weight on providing an alternative, because a prohibition without a sanctioned path does not work.
Disclaimer: This article is general information. Requirements for handling medical information are governed by the MHLW guidelines, the Act on the Protection of Personal Information, and related guidance. Adapt the operational detail to your institution.
Why the Question Never Goes Away
Start by establishing what the media is used for. Designing controls without this guarantees a collision with the floor.
| Use | Typical situation | How replaceable |
|---|---|---|
| Giving images to patients | Discs for referral or second opinion | Depends on the recipient's environment; slow to replace |
| Exchange with other institutions | Images and results to and from referring practices | Depends on the counterpart; replaceable where a regional network exists |
| Moving data between devices | Extracting results, loading settings | If the device has no network capability, media is the only route |
| Taking data out for research or conferences | Presentation material, case summaries | Readily replaceable once a procedure and environment exist |
| Backups | Ad hoc backups at small sites | Should be redesigned (Backup Design) |
| Media brought in by contractors | Software and configuration for maintenance | Manage by contract and procedure (Securing Remote Maintenance) |
Filling this in separates what can be replaced from what must remain for now. The workable policy is not to ban everything but to decide what stays and bring it under management.
The MHLW's cybersecurity checklist and manual for healthcare institutions, published on 14 May 2025, are more concrete than earlier material and address cloud, BCP, IoT, and BYOD. Media control is not a standalone topic; it is continuous with endpoint management and your policy on devices brought in. See How to Use the MHLW Checklist and What the Three-Ministry Guidelines Are.
Designing the Restrictions
Stop technically what can be stopped technically. Rules alone split staff into those who follow them and those who do not, which is not management.
| Measure | What it does | Watch for |
|---|---|---|
| Endpoint media control | Control device ports so unregistered media cannot be used | Needs endpoint management (Managing Endpoints); rarely applicable to medical devices |
| Permitting issued media only | Recognise only media the hospital has issued | The most effective; pair with issue and return processes |
| Write restriction | Allow reading, prohibit writing | Useful for media brought in by contractors |
| Departmental exceptions | Enable use only on specific departments or endpoints | Keep a list of exceptions with a review date |
| Physical port blocking | Physically block unused ports | For equipment that cannot be controlled in software |
| Request and approval | Apply per use, keep a record | High overhead; unsuited to high-volume uses |
The hard part in a hospital is the number of devices endpoint control cannot reach. Analysers and imaging workstations typically sit outside the management platform. Compensate with physical port blocking and room access control (Securing Network-Connected Medical Devices).
Include inbound media in the design. A maintenance engineer's USB drive has been used in outside environments. If you permit it, define the prior checks as a procedure and state them in the contract.
Finally, avoid writing "prohibited in principle." The qualifier leaves the exceptions undefined and therefore delegated to individual judgement. Write separately what is prohibited and what is permitted under conditions, use by use.
Encryption, and Its Limits
Media permitted to leave the building should be encrypted. If it is lost or stolen and the contents cannot be read, the nature of the incident changes.
| Method | What it is | Where it fits |
|---|---|---|
| Hardware-encrypted media | The device itself encrypts and requires authentication | The default where the hospital issues media |
| Full-media encryption from the endpoint | Encrypting the whole volume via OS features | Environments with mature endpoint management |
| File-level encryption | Encrypting individual files | For material given to patients or other institutions, which must open elsewhere |
Issuing standardised, encrypted media centrally is the most manageable arrangement. Where staff bring their own purchases, you cannot verify encryption at all.
But encryption is not sufficient:
- A password carried with the media defeats it. Notes stuck to the drive or written in the case genuinely happen
- Control ends once the recipient decrypts it. What happens to media given to a patient or another hospital depends on them
- The fact of removal still matters. Without knowing what left, you cannot describe the impact of a loss
Encryption is therefore a condition for permitting removal, not a record of managing it. You also need to know what was taken, by whom, when, and why. On notification duties, see Reporting Obligations After a Data Breach.
Disposal belongs with this. Failed media, media retired at refresh, internal disks in returned or resold equipment. Define the erasure method and record that it was done — including who performed a physical destruction, and how.
Registers and Checks
Treat media as countable assets.
| Field | Content |
|---|---|
| Asset number | Labelled on the item, tying record to object |
| Type and capacity | USB, external disk, optical, and so on |
| Encryption | Method, confirmed at issue |
| Storage location | Normal location and responsible person |
| Holder | Current holder, issue date, expected return |
| Purpose | What the item is for |
| Removal records | Date, purpose, and a summary of what was carried |
| Disposal record | Date, erasure method, who performed it |
A register needs reconciliation against physical reality. Once a year is enough: confirm that the items listed still exist. What this finds is not only missing media but media in use that was never registered.
| Check | Frequency | Owner |
|---|---|---|
| Register against physical items | Annually | Departmental owner |
| Removal records | Monthly | IT lead |
| Use of unregistered media | Quarterly | IT lead |
| Disposal records | Per disposal | IT lead |
| Contractor media records | Monthly | IT lead |
The electronic clinical information coordination structure addition introduced in 2026 requires compliance with the guidelines and a dedicated medical information system safety management officer; its higher tier additionally requires backups by multiple methods, some held offline, plus a cyberattack BCP and exercises. Media used for offline backup is removable media too — do not leave it off the register. See The 2026 Fee Revision and Backup Design.
Provide the Alternative
This is the section that matters most. The fastest route to less removable media is a way to get the job done without it.
| Use | Alternative | How to approach it |
|---|---|---|
| Internal file transfer | Internal shared storage | Often already exists; depends on access design (Privileged ID Management) |
| Exchange with other institutions | Regional health information networks, secure transfer services for healthcare | Requires checking the counterpart; expand coverage gradually |
| Research and conference material | An approved cloud store, or a managed device for taking data out | Permit for defined uses, with criteria for what may leave |
| Remote reference | Secure remote access; managed mobile devices | See Managing Endpoints |
| Images for patients | Reviewing how images are provided | Heavily dependent on recipients; media will persist here for now |
| Extracting data from equipment | Network connectivity, or a dedicated intermediary server | Specify at the next refresh (Putting Security Into Procurement Requirements) |
Three cautions.
First, usability decides adoption. If the procedure is cumbersome, staff go back to the USB drive. Count the authentications, the clicks, and the waiting.
Second, cloud services must meet the requirements for handling medical information. Staff individually adopting consumer file-sharing services is harder to manage than physical media. Naming the approved service is what limits shadow IT. See Cloud Security for Healthcare Institutions.
Third, pair it with communication. Do not say only "USB is banned"; say "for this task, use this." A single-page notice posted in the department gets adopted far faster. See Designing Staff Security Training.
Conclusion
- Map removable media by use. Do not ban everything — decide what stays and bring it under management
- Stop technically what can be stopped technically. Recognising only hospital-issued media is the most effective control
- Avoid "prohibited in principle"; state separately what is prohibited and what is permitted under conditions
- Encrypt anything permitted to leave — but encryption is not management. Record what was taken
- Treat media as countable assets on a register, reconciled annually, including offline backup media
- The measure that works is the alternative: usable, named, and communicated
How you design media controls depends on which uses you can replace. If you need help mapping that against your own workflows, get in touch.
References and Sources
- Guidelines for the Safe Management of Medical Information Systems | MHLW
- Guidelines for the Safe Management of Medical Information Systems, Version 6.0 (PDF) | MHLW
- Personal Information Protection Commission
- Information-technology Promotion Agency (IPA)
- On the FY2026 Medical Fee Revision | MHLW
Note: whether and when a leak of personal data must be reported or communicated is governed by the Act on the Protection of Personal Information and the Commission's guidelines.