IT disposition for healthcare organizations
Clinics, practices and health systems retire devices that held protected health information: workstations, laptops, phones, copiers and the storage inside medical equipment. Each one needs a disposal record you can produce later.
Rules that apply to disposal
A summary for orientation, not legal advice. Your counsel or compliance officer defines what your policy requires.
- HIPAA Security Rule (45 CFR 164.310(d)(2))
- Requires policies for the final disposal of electronic PHI and the media it is stored on, and for removing ePHI before media is reused.
What healthcare clients get
- Serialized certificates listing each device and the sanitization method
- Destruction of drives from copiers, fax machines and medical device workstations
- Pickup scheduled around clinic hours
- NIST SP 800-88 sanitization or physical destruction, named per device
- Certificate and serialized report for every request
Equipment we collect
- Clinical and front-desk workstations
- Laptops, tablets and phones used for charting
- Servers and storage from retired EHR and imaging systems
- Copiers and fax machines with internal drives
- Computers attached to imaging and lab equipment
- Backup tapes and removable media
Common situations
- A practice is closing, merging or moving
- Everything leaves at once and the lease has an end date. One pickup clears the site, and each device goes on a record you can keep after the keys are handed back.
- An EHR or imaging system has been replaced
- The old servers still hold years of patient records after the migration is finished. Their drives are purged or destroyed and listed by serial number, paired with the server they came from.
- Leased copiers are going back
- A copier keeps images of what it scanned on an internal drive. We remove and destroy that drive before the machine returns to the leasing company, and the certificate goes in your lease file.
Questions
Is wiping enough for devices that held patient data?
HHS guidance on disposing of electronic PHI gives clearing, purging and destroying media, consistent with NIST SP 800-88, as examples of proper disposal. A verified Purge is the usual choice for equipment that will be resold. Choose destruction if your policy requires it.
Do we need a business associate agreement?
HHS treats a vendor that disposes of media holding electronic PHI on your behalf as a business associate, so most covered entities put an agreement in place before pickup. Send yours with the request and we will review it before scheduling.
Can you take the medical device itself?
We take the computers and storage attached to medical equipment. Ask before including a clinical device, because some need the manufacturer to decommission them first.
Related guides
- Certificate of data destruction: what it must containWhat a certificate of data destruction should list, the details NIST SP 800-88 calls for, the gaps that make one worthless in an audit, and a real example.
- NIST SP 800-88 explained: Clear, Purge and DestroyNIST SP 800-88 in plain language: what Clear, Purge and Destroy mean, which applies to hard drives, SSDs and phones, and how to verify it.
Tell us what you're retiring.
Get a written, itemized quote in one business day.