Disposal

Disposal is the next Physical Section Rule that must be addressed. It is a required task that requires agencies implement policies and procedures to address the final disposition of EPHI, and/or the hardware or electronic media on which it is stored.

You must have a policy and document the disposal of any EPHI related data, hardware, or media. When you dispose of servers, workstations, laptops, or any other portable devices, you must insure that any EPHI data is fully removed. Deleting files or formatting hard disks is not sufficient. There are special software programs that can handle this job or you can physically destroy the hard drive in the device. Retired backup tapes should be destroyed and not used elsewhere, thrown in the garbage, or given to anyone. A Disposal Log must be maintained.