Secure Handling
Protect devices and storage media from unauthorized access while they are collected, transported, stored and processed.
HIPAA-ALIGNED DATA SECURITY
HIPAA Data Destruction for Healthcare Organizations
Protect Patient Information Through Final Device Disposition
Healthcare organizations must protect electronic protected health information throughout equipment collection, transportation, storage, sanitization and disposal.
LAeCycle provides secure data erasure and physical storage-media destruction for healthcare computers, servers, hard drives, SSDs and other data-bearing devices. On-site, off-site and witnessed service options are available based on project requirements.
- NIST SP 800-88 Aligned
- On-Site and Off-Site Options
- Witnessed Destruction Available
- Certificates Available
DEVICE AND MEDIA CONTROLS
What HIPAA Requires When Retiring Technology
The HIPAA Security Rule requires covered entities to establish policies and procedures for the final disposition of electronic protected health information and the devices or media on which it is stored.
Procedures must also address the removal of ePHI before electronic media is released for reuse.
45 CFR § 164.310(d)(2)(i)–(ii) · HHS guidanceAppropriate Sanitization or Destruction
Select a method appropriate for the media, information sensitivity, intended disposition and risk of unauthorized recovery.
Controlled Media Reuse
Do not release electronic media for internal reuse, resale, donation or other transfer until ePHI has been appropriately removed.
Written Procedures and Accountability
Document disposal responsibilities, approved methods, verification requirements and the personnel authorized to handle data-bearing equipment.
HIPAA does not require one universal destruction method for every device. The organization must select and document safeguards appropriate to its risks and circumstances.
HEALTHCARE ORGANIZATIONS
Secure Services for Small Practices and Large Health Systems
LAeCycle supports healthcare organizations with different equipment volumes, security requirements and documentation needs.
- Hospitals and Health Systems
- Medical Clinics
- Dental Practices
- Behavioral Health Providers
- Pharmacies
- Diagnostic Laboratories
- Imaging Centers
- Surgery Centers
- Health Plans
- Medical Billing Companies
- Healthcare Business Associates
- Biotech and Research Facilities
DATA-BEARING EQUIPMENT
Healthcare Technology That May Store Patient Information
Patient information may remain on obvious storage devices as well as computers, clinical workstations and connected systems. Include every data-bearing component in the project scope before equipment leaves organizational control.
Computers and Workstations
Desktop computers, laptops, thin clients, nursing-station systems and administrative workstations.
Servers and Storage Systems
Application servers, file servers, storage arrays, NAS systems and data-center hardware.
Hard Drives and SSDs
SATA, SAS and NVMe drives, external drives and removable solid-state storage.
Mobile and Portable Devices
Tablets, smartphones, handheld scanners and portable clinical technology.
Backup and Archived Media
LTO tapes, backup cartridges, USB drives, memory cards and other removable media.
Medical and Laboratory Systems
Data-bearing computers and storage components connected to diagnostic, imaging, laboratory or patient-care equipment.
Clinical and laboratory equipment must be disconnected, legally transferable and free of biological, pharmaceutical, chemical or radioactive contamination before acceptance.
MEDIA-SPECIFIC METHODS
Choose the Appropriate Data-Destruction Method
The correct method depends on the media type, condition, sensitivity of the information and whether the equipment will be reused or permanently retired.
Secure Data Erasure
Software-based sanitization may be appropriate for supported, functioning media when the organization intends to retain or release the equipment after verified processing.
Cryptographic Erase or Purge
Supported encrypted media may qualify for cryptographic or other purge procedures when the method is appropriate, authorized and validated.
Physical Media Destruction
Physical destruction may be selected for failed, damaged, unsupported or permanently retired storage media when reuse is not intended.
LAeCycle uses methods selected for the media and confirmed project scope. Available services include secure erasure, cryptographic erase, degaussing for supported magnetic media, and physical destruction. Drive punching and crushing are described as physical hard drive destruction.
MEDIA SANITIZATION GUIDANCE
Data Sanitization Aligned With NIST SP 800-88
NIST Special Publication 800-88 Revision 2 provides guidance for establishing a media-sanitization program based on information sensitivity, media type, intended disposition and organizational risk.
LAeCycle can perform media-sanitization services in alignment with the confirmed project scope and selected method.
Clear
Applies logical techniques to sanitize data in user-addressable storage locations when appropriate for the media and intended disposition.
Purge
Uses appropriate logical, cryptographic or media-specific techniques intended to make recovery infeasible using advanced laboratory methods.
Destroy
Physically destroys media to make recovery of the target data infeasible and leave the media unusable for storing data.
NIST publishes guidance; it does not certify LAeCycle.
View NIST SP 800-88 Revision 2SERVICE OPTIONS
Choose Where and How Destruction Takes Place
On-Site Service
Eligible storage media can be processed at the healthcare organization’s location when required by the approved project scope.
Off-Site Service
Devices and media are collected through a controlled transfer process and transported to an LAeCycle processing facility.
Witnessed Destruction
Authorized representatives may watch eligible media being physically destroyed at their location or at an LAeCycle facility.
Availability depends on media type, quantity, location, access requirements and the selected destruction method.
THIRD-PARTY RESPONSIBILITIES
Business Associate Agreements and Outside Vendors
A healthcare organization may hire an outside provider to dispose of protected health information. When the provider performs the service as a business associate, the parties must establish an appropriate written contract or Business Associate Agreement before protected health information is transferred.
The agreement should define permitted activities, required safeguards, incident reporting, subcontractor obligations and the return or destruction of protected information when the engagement ends.
Read HHS guidance on disposal providersDOCUMENTED PROCESSING
Maintain Visibility From Collection Through Completion
Documentation requirements should be established before service begins. LAeCycle can provide project records based on the agreed scope and equipment processed.
Collection and Transfer Record
Documents the transfer of equipment or media into LAeCycle’s custody.
Serialized Media Inventory
Records available serial numbers, asset identifiers and media details when included in the project.
Processing and Verification Record
Identifies the approved sanitization or destruction method and applicable verification result.
Certificate of Data Destruction
Documents completed destruction services for the devices or media included in the certificate.
Not every recycling pickup automatically includes serial-number tracking, witnessed destruction or individual certificates. Confirm documentation requirements before scheduling.
A CONTROLLED WORKFLOW
How Healthcare Data Destruction Works
- 01
Define the Project Scope
Identify the equipment, media types, locations, security requirements, selected methods and required documentation.
- 02
Confirm Service and Custody Requirements
Confirm scheduling, access, packaging, transportation, authorized contacts and any Business Associate Agreement requirements.
- 03
Sanitize or Destroy the Media
Process each eligible device or storage medium according to the approved method and project scope.
- 04
Verify and Document Completion
Complete applicable verification, inventory records, chain-of-custody documentation and Certificates of Data Destruction as agreed.
IMPORTANT RESPONSIBILITY NOTICE
HIPAA Compliance Is a Shared Responsibility
LAeCycle provides secure handling, sanitization, physical destruction and documentation services based on the agreed project scope.
The healthcare organization remains responsible for identifying devices and media containing ePHI, performing its risk assessment, selecting appropriate safeguards, maintaining required policies, authorizing the disposition method and determining its legal and contractual obligations.
This page provides general information and is not legal advice. Healthcare organizations should consult their privacy, security or legal professionals when establishing HIPAA policies and vendor requirements.
COMMON QUESTIONS
HIPAA Data-Destruction Questions
Does HIPAA require electronic media to be destroyed?
HIPAA requires covered entities to establish policies and procedures for the final disposition of ePHI and the hardware or media on which it is stored. Depending on the media, risk and intended disposition, an organization may select appropriate sanitization or physical destruction.
Does HIPAA require hard-drive shredding?
HIPAA does not mandate one universal method for every hard drive. Appropriate options may include clearing, purging or physically destroying the media based on its condition, information sensitivity, intended disposition and organizational risk.
Is a factory reset enough for HIPAA data disposal?
A factory reset should not automatically be treated as verified media sanitization. The organization should use an approved method appropriate for the device and verify the result before the equipment is reused or released.
Is a Business Associate Agreement required?
When an outside disposal provider performs the service as a business associate, the covered entity and provider must establish an appropriate written agreement before protected health information is transferred. The organization should confirm the provider’s role and agreement requirements before service.
Can we watch our hard drives being destroyed?
Witnessed physical destruction is available for eligible storage media. Service may be performed at the customer’s location or an LAeCycle facility, depending on the approved scope, quantity and scheduling.
Do you provide Certificates of Data Destruction?
Certificates of Data Destruction are available when included in the service agreement. Documentation requirements should be confirmed before service begins.