HIPAA device disposal

The short version

HIPAA requires you to have policies and procedures for disposing of ePHI and the media it sits on, and to remove ePHI from media before reuse. Both are Required, not optional.

What it does not do is tell you how. There is no mandated method, no approved vendor list, and no such thing as HIPAA-certified destruction.

The rule, quoted

The disposal obligation lives in the Physical Safeguards, at 45 CFR 164.310(d) — "Device and media controls."

The standard, 164.310(d)(1):

"Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility."

Four implementation specifications sit under it. Two are Required:

"(i) Disposal (Required). Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored."

"(ii) Media re-use (Required). Implement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use."

And two are Addressable:

"(iii) Accountability (Addressable). Maintain a record of the movements of hardware and electronic media and any person responsible therefore."

"(iv) Data backup and storage (Addressable). Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment."

(68 FR 8376, 20 February 2003, as amended at 78 FR 5694, 25 January 2013.)

"Addressable" does not mean optional, and this is where people come unstuck

It is the single most misread word in the Security Rule. Addressable does not mean you may skip it. It means you must make — and document — a decision.

45 CFR 164.306(d)(3), in full:

"When a standard … includes addressable implementation specifications, a covered entity or business associate must— (i) Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting electronic protected health information; and (ii) As applicable … (A) Implement the implementation specification if reasonable and appropriate; or (B) If implementing the implementation specification is not reasonable and appropriate— (1) Document why it would not be reasonable and appropriate to implement the implementation specification; and (2) Implement an equivalent alternative measure if reasonable and appropriate."

So for Accountability the choices are: keep the movement record, or write down why you reasonably do not and put an equivalent measure in its place. "We didn't get round to it" is neither.

Read that specification again, because it describes a document rather than a method: maintain a record of the movements of hardware and electronic media and any person responsible therefore. Who had it, when, and who took it next.

What HIPAA does not require

It does not name a method. Not shredding, not degaussing, not a particular overwrite pattern, not a particular standard. The rule says address final disposition and remove ePHI before reuse; how you do that is a risk decision under the flexibility-of-approach provision at 164.306(b), which directs you to weigh your size and complexity, your technical infrastructure, the cost of the measure, and the probability and criticality of the risk.

It does not certify anyone. HHS runs no disposal-vendor certification, publishes no approved list, and audits no shredders. A provider selling you "HIPAA certified destruction" is describing something that does not exist — the same shape of claim as "NIST 800-88 certified," which also does not exist.

How to check any certification claim covers what to ask instead.

It does not stop at hard drives. ePHI on a photocopier's internal storage is ePHI. So is the tablet in a clinic room and the phone a physician handed back. Your inventory has to know which devices those are, which is a harder problem than the disposal itself.

Where a business associate agreement comes in

If a disposal vendor creates, receives, maintains or transmits ePHI on your behalf, they are a business associate and the relationship needs a BAA. Whether a given arrangement crosses that line depends on the facts — whether the vendor takes custody of unsanitized media is usually the question that decides it — and it is a determination for your privacy officer and counsel, not for the vendor.

We raise it because it is the step most often discovered late, after equipment has already moved.

Where we fit, and where we don't

We sanitize media in our own facility, to NIST SP 800-88 Revision 2, and issue a certificate per media item. We hold no certification — not R2, not e-Stewards, not NAID, and no such thing as a HIPAA certification exists for anyone. Our R2 certification audit is pending.

We produce the Accountability record, in the sense the rule uses the word. We count the devices against the list you issue, at your site, before anything is loaded. We record discrepancies at the moment they are found. We seal what leaves and record the seal numbers. You get a signed manifest before the vehicle moves, and the intake reconciliation when it arrives.

That is a movement record of hardware and electronic media with the person responsible named at each handover — the Addressable specification at 164.310(d)(2)(iii). The Disposal and Media re-use specifications at (d)(2)(i) and (ii) are addressed by the sanitization certificate, which names the method and the people who validated it.

Whether you need a BAA with us is your privacy officer's determination, not ours. Ask it early.

How collection and custody works ·

Common questions

Is a certificate of destruction required by HIPAA?

The rule does not name one. It requires policies and procedures for final disposition, and — addressably — a record of movements. A certificate of destruction is a common and sensible way to evidence the first, not a regulatory requirement in itself. What one should contain.

Can we just factory-reset the devices?

That is a question about whether the reset actually removes the data on that device, not a question about HIPAA. See what NIST says about resets before you rely on one.

Do we need a BAA with our disposal vendor?

It depends whether they handle ePHI on your behalf. Ask your privacy officer. A vendor who tells you confidently that no BAA is needed, without knowing your facts, is answering a question they cannot answer.

What about devices that held ePHI years ago?

They held ePHI. The specification attaches to the media, and your inventory is the only thing that knows which devices those were.

Does encryption change the analysis?

It can — the Breach Notification safe harbour turns on whether ePHI was rendered unusable, unreadable or indecipherable — but that is a breach question rather than a disposal-method question, and the preconditions for relying on cryptographic erase are strict. What those preconditions are.

Where to read it yourself

45 CFR 164.310 · 45 CFR 164.306 · HHS HIPAA for Professionals