Asset Value Management Services, LLC 
EN
ESePHI lives in more devices than you think
Protected health information is not limited to servers and nurse station computers. It is stored on laptops, printers and multifunction copiers, networking equipment and many types of medical equipment. In a large health system these devices are spread across hospitals, outpatient clinics, labs and administrative offices, and they are retired continuously rather than in one tidy project.
When a device leaves your control with readable patient data, the consequences can include breach notification, regulatory scrutiny and lost patient trust. A defensible disposition program needs three things: a complete inventory of what left each facility, a recognized sanitization standard applied to every data-bearing component, and records that tie each serial number to its final outcome.
Regulations to plan for
HIPAA Security Rule, 45 CFR 164.310(d)(2)(i)
Requires covered entities and business associates to implement policies and procedures addressing the final disposition of ePHI and of the hardware or electronic media on which it is stored.
AVM applies certified erasure or physical destruction to every data-bearing device and records the result against its serial number.
HIPAA Security Rule, 45 CFR 164.310(d)(2)(ii)
Requires procedures for removing ePHI from electronic media before the media are made available for re-use.
Equipment is erased with WipeOS to NIST SP 800-88 before any device is remarketed, with wipe verification visible in your portal.
HITECH Act breach notification
Requires notification after a breach of unsecured PHI; under HHS guidance, media that have been cleared, purged or destroyed consistent with NIST SP 800-88 are not considered unsecured.
AVM sanitizes media to NIST SP 800-88 and documents each device, supporting your position that retired media did not contain unsecured PHI.
Texas Business & Commerce Code §521.052
Requires businesses to protect sensitive personal information, which includes health information, and to destroy records containing it that are not to be retained by making them unreadable.
Chain of custody, secure quarantine and line-item reporting give you a record of how each device was handled.
Summaries for planning only, not legal advice. Confirm obligations with your counsel.
How AVM helps
- Medical equipment processingHandling for various types of medical equipment alongside standard IT assets.
- Secure quarantineEquipment is held in a secure quarantine area until it is audited and sanitized.
- Certified data erasureWipeOS erasure to NIST SP 800-88 and DoD 5220.22-M, with physical destruction as the fallback.
- Manifest reconciliationSerial, make and model cross-referenced against your manifest so nothing goes unaccounted for.
- Audit-ready recordsLine-item reports, historical records and wipe verification comments in your client portal.
- Responsible recyclingNon-salable equipment recycled under EPA guidelines at no additional disposal cost.
Recommended services
Frequently asked questions
Yes. In addition to desktops, laptops, servers, printers and networking gear, AVM processes various types of medical equipment. Contact us with your equipment list and we will confirm how each category is handled.
