For hospitals, clinics, dental and specialty practices, health plans and their business associates, retiring a computer is a regulated event. A laptop, server drive or copier that leaves the building with electronic protected health information (ePHI) still on it can become a reportable breach. This checklist turns the HIPAA requirements into steps your IT and compliance teams can follow.

What the rule actually says

The HIPAA Security Rule's device and media controls standard, 45 CFR 164.310(d)(1), requires policies and procedures governing the receipt and removal of hardware and electronic media containing ePHI into and out of a facility, and their movement within it. Two of its implementation specifications are required, not addressable:

• 45 CFR 164.310(d)(2)(i), Disposal: implement policies and procedures to address the final disposition of ePHI, and/or the hardware or electronic media on which it is stored.
• 45 CFR 164.310(d)(2)(ii), Media re-use: implement procedures for removal of ePHI from electronic media before the media are made available for re-use.

Two related specifications are addressable: (d)(2)(iii) Accountability, maintaining a record of the movements of hardware and media and the person responsible, and (d)(2)(iv) Data backup and storage, creating a retrievable, exact copy of ePHI when needed before equipment is moved.

HHS breach notification guidance also matters here: electronic media that has been cleared, purged or destroyed consistent with NIST SP 800-88, Guidelines for Media Sanitization, so the PHI cannot be retrieved, is not considered "unsecured" PHI. That is a strong reason to make NIST SP 800-88 your written standard.

The checklist

1. Policy and inventory

• Written disposal and media re-use procedures that name a standard (NIST SP 800-88) and the methods allowed: purge for reusable media, destroy for failed or unsupported media.
• An asset inventory that captures serial numbers of devices and, where possible, of the drives inside them.
• Your Security Rule risk analysis lists every device type that stores ePHI, not only computers and servers.

2. Find the hidden storage

Many incidents involve equipment nobody thought of as a computer. Include:

• Multifunction printers, copiers, scanners and fax machines with internal hard drives or flash storage, especially leased units being returned.
• Medical devices and imaging workstations (ultrasound, X-ray, lab analyzers, patient monitors) that cache images or patient data.
• Phones, tablets, USB drives, external backups, tapes and network-attached storage.
• Servers, SAN/NAS arrays and spare drives sitting in storage closets.

In 2013, HHS announced a $1,215,780 settlement with Affinity Health Plan after photocopiers were returned to a leasing agent without erasing their hard drives. The OCR investigation also found that the plan had not included copier hard drives in its risk analysis. Check every lease-return clause for who sanitizes the drive and who keeps the proof.

3. Business associate agreement with the ITAD vendor

HHS has stated that a covered entity may, but is not required to, hire a business associate to dispose of PHI, and that it must then have a contract requiring the business associate to appropriately safeguard the PHI through disposal. In practice, an ITAD vendor that handles devices containing ePHI should sign a business associate agreement (BAA). Confirm the agreement covers:

• Permitted uses (sanitization, destruction, recycling, resale of sanitized equipment) and nothing else.
• Safeguards consistent with the Security Rule, including secure transport and storage.
• Prompt reporting of any security incident or lost device.
• Flow-down obligations to any subcontractor that touches the equipment.
• Return or destruction of PHI at termination.

4. Custody from pickup to disposition

• Devices are counted and matched to your inventory before they leave your site.
• Locked containers or secured vehicles, with a signed chain-of-custody record at each handoff.
• Any discrepancy (missing serial, extra device, unlabeled drive) is reported to you in writing.

5. Sanitization and destruction

• Reusable drives are purged with certified erasure software and verified.
• SSDs are sanitized with firmware-level commands, never with an overwrite-only routine or degaussing.
• Drives that fail erasure, or that you choose not to reuse, are physically destroyed.
• Embedded storage in copiers and medical equipment is removed and handled the same way, or sanitized using the manufacturer's documented procedure.

6. Documentation you keep

• A certificate for each device listing serial number, method, date and responsible technician.
• Chain-of-custody records and the vendor's BAA.
• Your internal disposal log tying each certificate back to the original asset record.

Under 45 CFR 164.316(b)(2)(i), Security Rule documentation must be retained for six years from the date of its creation or the date when it last was in effect, whichever is later. Store certificates where your compliance team can retrieve them during an audit, not only in an email inbox.

Common mistakes

• Accepting a single certificate that says "42 drives destroyed" with no serial numbers.
• Letting a leasing company or a departing employee take a device "to wipe later."
• Treating deleted files or a reformatted drive as sanitized.
• Recycling equipment through a vendor that has not signed a BAA.

How AVM supports healthcare clients

Asset Value Management Services (AVM) performs WipeOS certified erasure to NIST SP 800-88, physically destroys any drive that cannot be erased, and issues a certificate of destruction per serial number. Each project includes a serial-level audit, documented chain of custody and reports in a private client portal, which makes it easier to keep records ready for an audit.

If you are planning a refresh, a clinic closure or a copier lease return in the Houston area, you can request a quote and we will review your device list and documentation needs with you. Reach us at 713-869-0200 or visit 4647 Pine Timbers St., Houston, TX 77041.