HIPAA Data Disposal

HIPAA protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)."

“Individually identifiable health information” is information, including demographic data, that relates to:

• the individual’s past, present or future physical or mental health or condition,
• the provision of health care to the individual, or
• the past, present, or future payment for the provision of health care to the individual,

and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual. Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number). 

Proper disposal of electronically stored data is required under HIPAA as stated at 164.310 (d)(1) and 164.310 (d)(2)(i):

“Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility.”

And

“Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.”

These sections of the HIPAA law speak to Access Control, Accountability and Disposal, among other topics, however to get down to the specifics of what you must do to meet the standard, we must also look at the Department of Health and Human Services guidelines, which point to NIST Special Publication 800-88, as well as the document HHS HIPAA Security Series 3: Security Standards – Physical Safeguards, while providing the following general guidance for proper disposal of Protected Health Information (PHI)”

• “For PHI on electronic media, clearing (using software or hardware products to overwrite media with non-sensitive data), purging (degaussing or exposing the media to a strong magnetic field in order to disrupt the recorded magnetic domains), or destroying the media (disintegration, pulverization, melting, incinerating, or shredding)”

Moving on to HHS HIPAA Security Series 3: Security Standards, the HHS provides the following guidance:

• “When covered entities dispose of any electronic media that contains EPHI (Electronic Protected Health Information) they should make sure it is unusable and/or inaccessible. One way to dispose of electronic media is by degaussing. Degaussing is a method whereby a strong magnetic field is applied to magnetic media to fully erase the data. If a covered entity does not have access to degaussing equipment, another way to dispose of the electronic media is to physically damage it beyond repair, making the data inaccessible.”

• The consequences of willful neglect of HIPAA Rules with no effort made to correct the violation within 30 days of discover can result in $50,000 per violation with a maximum fine of $1.5 million per year.