Disposing of protected health information (PHI) isn’t as simple as tossing your hard drive in the trash and calling it a day. There are many safeguards you need to have in place to make sure your customer’s sensitive data doesn’t end up in the wrong hands. These range from training your staff on best practices to using proper disposal methods to make PHI unreadable.

The industry standard for managing IT recycling, data destruction, hard drive shredding, or computer recycling of PHI is known as the HIPAA Privacy and Security Rules. This article covers all the different safeguards and standards you’ll need to have in place to remain HIPAA compliant.

Here’s what you need to know about HIPAA

• Organizational Standards:  Creating organizational standards is a critical first step when getting rid of public health information on your hard drive or IT infrastructure. Organizational standards are especially important if you regularly exchange public health information with other business associates or organizations.These standards should comply with all the latest rules and standards set by HIPAA and should explain each associate’s responsibilities and areas of accountability when handling public health information or managing IT recycling of PHI.
• Policies and Procedures: Creating internal policies and rules in your organization is the best way to ensure you remain compliant with the latest HIPAA Privacy and Security Rules when shredding a hard drive or recycling a computer containing PHI.Your company must maintain written records of its security policies and procedures for at least six years after their date of creation and regularly update them based on any changes that may affect the security of PHI.
• Administrative Safeguards: HIPAA also requires that you create administrative safeguards to prevent and detect security threats that may compromise PHI during data destruction. These safeguards should outline how your workers will handle sensitive client information and deal with any risks associated with handling PHI.Creating administrative safeguards usually starts with a comprehensive risk analysis of PHI, followed by an implementation phase. During the risk analysis stage, your goal should be to identify all vulnerabilities that may affect public health information stored on your electronic devices. You’ll then need to create and implement a detailed plan for managing data destruction, hardware and software storage, and PHI removal.
• Physical Safeguards: Physical safeguards are policies and procedures designed to protect PHI systems, buildings and equipment from external hazards such as natural disasters and unauthorized intrusion. HIPAA requires that you implement physical safeguards within your company, and perform a complete risk analysis to evaluate all possible locations that PHI may be accessed.You may discover that PHI can be accessed in different areas of your office, or an employee’s house. In any case, you’ll need to develop a detailed facility security plan that outlines what entities have access to PHI and what steps they need to take to protect PHI in case of emergencies.

Get Rid of Public Health Information the Right Way

Getting rid of PHI doesn’t need to be complicated. If you would like to learn more about how to properly dispose of PHI, please contact us at any time. We would be happy to discuss ways to keep your data safe, both while you’re using public health information, and after you’re done with it.