E-Waste Recycling for Medical Practices

What the rule says

The HIPAA Security Rule's device and media controls standard requires covered entities to "implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility."¹ Its disposal specification requires "policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored."¹ The rule names the obligation, not the method. What it asks for, in practice, is a documented process you can show.

What a practice usually retires

Front-desk and clinical workstations, practice-management and imaging servers, copiers and fax machines with internal storage, exam-room tablets, and diagnostic equipment with embedded computers. Anything with a drive or an operating system is treated as data-bearing; anything that only displays is not. Copiers are the one most practices miss: the FTC's guidance is that "the hard drive in a digital copier stores data about the documents it copies, prints, scans, faxes or emails."²

How it works

Business associates and the recycler

Whether a recycler that destroys media for you is a business associate is a question for your privacy officer or counsel; the answer depends on what the recycler can access.

Beyond the computers

Retired diagnostic and lab equipment often contains circuit boards, batteries and displays alongside the embedded computer. It travels in the same pickup, with the data step applied to the computer inside it. Paper records retired at the same time can go through document shredding on the same visit.