+
Covered entities must use reasonable safeguards when disposing of PHI. HHS gives examples: for paper, shredding, burning, pulping, or pulverizing so PHI is essentially unreadable and can't be reconstructed; for electronic media, clearing, purging, or destroying the media. The Security Rule also requires policies for the final disposition of ePHI and for removing it from media before reuse.
+
Not without first rendering them unreadable. HHS says PHI generally shouldn't be placed in publicly accessible dumpsters or recycling bins unless it has been shredded or otherwise destroyed so it can't be read or reconstructed.
+
Yes. A covered entity may hire a business associate to dispose of PHI on its behalf, as long as there's a Business Associate Agreement requiring the vendor to safeguard the information.
+
No. Deleting a file or formatting a drive may remove its directory entry without eliminating the underlying data. Depending on the media and sensitivity, you may need clearing, purging, cryptographic erasure, degaussing, or physical destruction. MedPro's hard drive destruction delivers drives to a certified metal and electronics recycler.
+
A federal rule (16 CFR Part 682) requiring anyone who uses consumer reports for a business purpose — employers, landlords, lenders, insurers, auto dealers, debt collectors, and others — to take reasonable measures to protect that information when disposing of it, such as burning, pulverizing, or shredding papers.
+
It depends on federal and state retention rules, medical-record retention periods, tax and employment requirements, contracts, and any pending audits or litigation. Records under a legal hold must be kept. Once retention ends and no hold applies, timely destruction reduces risk.
+
Recurring service is regularly scheduled mobile shredding with a customized security program. A one-time purge clears out a backlog of records you've been holding — one call to (888) 641-6131 and it's handled.
+
Servers, USB drives, memory cards, backup tapes, optical discs, mobile devices, printers and copiers with internal storage, and medical or laboratory equipment can all hold data. Include them in your disposal procedures before equipment is donated, returned, resold, or discarded.
