E-Waste Recycling for Medical Practices

What the rule says

The HIPAA Security Rule's device and media controls standard requires covered entities to "implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility."¹ Its disposal specification requires "policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored."¹ The rule names the obligation, not the method. What it asks for, in practice, is a documented process you can show.

What a practice usually retires

Front-desk and clinical workstations, practice-management and imaging servers, copiers and fax machines with internal storage, exam-room tablets, and diagnostic equipment with embedded computers. Anything with a drive or an operating system is treated as data-bearing; anything that only displays is not. Copiers are the one most practices miss: the FTC's guidance is that "the hard drive in a digital copier stores data about the documents it copies, prints, scans, faxes or emails."²

How the pickup runs

Inventory with serial numbers before anything moves. Data-bearing devices separated at collection. Storage media are wiped or physically destroyed before any device enters the recycling stream, and every job closes with documents listing the devices processed, the method, and the date. You receive the collection manifest, the per-device record and the certificate of destruction for your compliance file.

Business associates and the recycler

Whether a recycler that destroys media for you is a business associate is a question for your privacy officer or counsel; the answer depends on what the recycler can access. What we can say is what we do: media are destroyed or sanitized before processing, the method is named on the certificate, and the records are yours to keep.

Beyond the computers

Retired diagnostic and lab equipment often contains circuit boards, batteries and displays alongside the embedded computer. It travels in the same pickup and is listed on the same manifest, with the data step applied to the computer inside it. Paper records retired at the same time can go through document shredding on the same visit.