HITRUST certification is the most demoralizing thing I've done in my life. You need a policy, a procedure and evidence of things like this:

Shared system resources (e.g., registers, main memory, secondary storage) are released back to the system, protected from disclosure to other systems/applications/users, and users cannot intentionally or unintentionally access information remnants.