HIPAA Rules for Document Disposal: What Your Practice Must Know

PHI is any individually identifiable health information that relates to a person's physical or mental health, the healthcare they receive, or payment for that care. It includes 18 specific identifiers that, if present alongside health information, make the document PHI.

• Names, addresses, dates (birth dates, admission dates, discharge dates)
• Social Security numbers, account numbers, certificate numbers
• Phone numbers, fax numbers, email addresses
• Medical record numbers, health plan beneficiary numbers
• IP addresses, device identifiers, URLs
• Photographic images and comparable identifiers
• Any other unique identifying number or code

The HIPAA Privacy Rule (45 CFR §164.530(c)) requires covered entities to have policies and procedures to protect PHI from unauthorized disclosure at the time of disposal. The rule does not mandate shredding specifically — but HHS guidance makes clear that shredding, burning, pulping, or pulverizing paper records is the standard.

The HIPAA Security Rule applies to electronic PHI (ePHI). Before disposing of any electronic device that held ePHI — hard drives, USB drives, old computers, copier hard drives — you must render the data unreadable and unrecoverable. Deleting files or reformatting a drive is not sufficient.

HHS guidance specifies that simply placing PHI in a recycling bin does not constitute proper disposal. Acceptable methods for paper PHI include:

• Cross-cut or micro-cut shredding (strip-cut shredding is less secure and not recommended for PHI)
• Incineration or burning in a permitted facility
• Pulping or pulverizing the paper so that reconstruction is impossible
• Using a NAID AAA Certified shredding vendor (the gold standard)

For electronic devices and media containing ePHI, acceptable disposal methods include:

• Degaussing: exposing magnetic media to a strong magnetic field to erase data
• Physical destruction: shredding, disintegrating, or crushing hard drives so platters are unreadable
• Overwriting: using NIST-approved software to write over every sector of the drive (7 passes minimum for older drives)
• Encryption followed by key destruction: if data is encrypted and the key is destroyed, the data is effectively unreadable

When you use a professional shredding service, always obtain a Certificate of Destruction. This document serves as your paper trail proving that PHI was disposed of properly on a specific date. It is your primary defense in the event of an HHS audit or breach investigation.

A proper Certificate of Destruction should include: the date of service, the name and address of your organization, the type and approximate volume of material destroyed, the destruction method used, and the signature of an authorized representative of the shredding company.

If you hire a third-party shredding company to handle PHI, that company is a Business Associate under HIPAA, and you must have a signed Business Associate Agreement (BAA) before any PHI changes hands. Using a shredding company without a BAA is itself a HIPAA violation — even if the shredding is done perfectly.

Exodus Waste Solutions provides a HIPAA-compliant BAA as part of every shredding service agreement. We issue Certificates of Destruction for every service visit and offer on-site witnessed shredding for sensitive materials.

Before destroying any medical records, confirm you have met the required retention period. Florida law requires that adult patient records be retained for at least 5 years from the date of service. Records for minors must be retained until the patient's 18th birthday or 7 years from the date of service, whichever is later.

Federal regulations may impose different retention periods for Medicare/Medicaid records (generally 10 years). Review both sets of requirements before scheduling a purge.