Chain of custody is the unbroken record of who had your equipment, from the moment it left your building to the moment its data was destroyed and its hardware processed. It is what turns "we recycled it" into something a third party can check.
#The five records
A defensible chain has five documents, each handing off to the next:
- Inventory before collection. Device types, counts, serial numbers and asset tags, written by you or captured with you at the site.
- Collection manifest. Signed at the dock: what left, when, by whom.
- Destruction or sanitization record. Per data-bearing device: serial, method, date.
- Disposition record. Where the chassis, boards and materials went for recovery.
- Certificate of destruction. The summary that ties 1 to 4 together.
If any one of the five is missing, the chain has a gap, and the gap is where the questions land.
#Where chains break in practice
Drives pulled by an internal team and left in a drawer, unlisted. A copier returned to the lessor with its drive still in it. Laptops handed to departing staff and never inventoried. A "recycler" who subcontracts the data step and cannot say to whom. The fix in every case is the same: the inventory is written before anything moves, and the data-bearing devices are separated and listed at collection.
#Why it matters under the rules
The rules that reach ordinary businesses do not name a form; they require a process and a record. HIPAA requires covered entities to "implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility." The FTC Disposal Rule's standard is "reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal." A chain of custody is how you show the measures were taken.
#How to ask a recycler for it
Ask for all five records by name before the pickup, and ask which method will be applied to which device type, in writing. A recycler who cannot answer both before the job will not be able to document them after it. American Resources issues the certificate on every electronics recycling pickup; ask for the five records by name when booking an IT asset disposition job.
Tell us what is coming out of service and where it is, and we will come back with an itemized quote and a collection window. Request a quote or call (770) 934-8248.
