POLICY # 37
DISPOSAL
ADMINISTRATIVE MANUAL
APPROVED BY:
SUPERCEDES POLICY:
DATE:
ADOPTED:
REVISED:
REVIEWED:
REVIEW:
PAGE:
HIPAA Security
Rule Language:
“Implement policies and procedures to address the final disposition of
EPHI, and/or the hardware or electronic media on which it is stored.”
Policy Summary:
All Sindecuse Health Center (SHC) information systems and electronic
media containing EPHI that is no longer required must be disposed of in
a secure manner. Disposal of electronic media containing PHI must be
tracked and logged.
Purpose:
This policy reflects SHC’s commitment to appropriately dispose of
information systems and electronic media containing EPHI when it is no
longer needed.
Policy:
1. All SHC information systems and electronic media containing EPHI
must be disposed of properly when no longer needed for legitimate use.
This disposal must include the EPHI received by SHC and created within
SHC. Careless disposal of such information systems and media could
result in EPHI being revealed to unauthorized persons.
2. Information systems and electronic media to which this policy applies
include, but are not limited to: computers (both desktop and laptops),
floppy disks, backup tapes, CD-ROMs, zip drives, portable hard drives
and flash memory.
3. Disposal of all SHC electronic media and information systems
containing EPHI must be tracked and logged. At a minimum, such
tracking and logging must provide the following information:



Date and time of disposal
Who performed the disposal
Brief description of media or information systems that was
disposed
4. If an information system or electronic medium containing EPHI is to
be reused within SHC (or for other entities), its previous data must be
completely removed with erase tool(s) that have been approved by the
Page 1 of 3
Copyright 2003 Phoenix Health Systems, Inc.
Limited rights granted to licensee for internal use only.
All other rights reserved.
DISPOSAL
SHC Information Security Office.
5. An information system or electronic medium containing EPHI that is
to be disposed of permanently must be physically destroyed.
6. Destruction of SHC electronic media includes, at minimum, shredding
or burning. An industrial data destruction service or facility may be used.
Care must be taken to select a suitable contractor with adequate controls
and experience, including the handling of confidential information.
Scope/Applicability: This policy is applicable to all departments that use or disclose electronic
protected health information for any purposes.
This policy’s scope includes all electronic protected health information,
as described in Definitions below.
Regulatory
Category:
Physical Safeguards
Regulatory Type:
REQUIRED Implementation Specification for Device and Media
Controls Standard
Regulatory
Reference:
45 CFR 64.310(d)(2)(i)
Definitions:
Electronic protected health information means individually identifiable
health information that is:


Transmitted by electronic media
Maintained in electronic media
Electronic media means:
(1) Electronic storage media including memory devices in computers
(hard drives) and any removable/transportable digital memory medium,
such as magnetic tape or disk, optical disk, or digital memory card; or
(2) Transmission media used to exchange information already in
electronic storage media. Transmission media include, for example, the
internet (wide-open), extranet (using internet technology to link a
business with information accessible only to collaborating parties), leased
lines, dial-up lines, private networks, and the physical movement of
removable/transportable electronic storage media. Certain transmissions,
including of paper, via facsimile, and of voice, via telephone, are not
considered to be transmissions via electronic media, because the
information being exchanged did not exist in electronic form before the
Page 2 of 3
Copyright 2003 Phoenix Health Systems, Inc.
Limited rights granted to licensee for internal use only.
All other rights reserved.
DISPOSAL
transmission.
Information system means an interconnected set of information resources
under the same direct management control that shares common
functionality. A system normally includes hardware, software,
information, data, applications, communications, and people.
Re-use means the use of electronic media containing EPHI for something
other than its original purpose.
Erase tool means hardware or software that is capable of completely
removing all recorded material from electronic media.
Responsible
Department:
Information Systems
Policy Authority/
Enforcement:
SHC’s Security Official is responsible for monitoring and enforcement of
this policy, in accordance with Procedure # (TBD).
Related Policies:
Device and Media Controls
Media Re-use
Accountability
Data Backup and Storage
Renewal/Review:
This policy is to be reviewed annually to determine if the policy complies
with current HIPAA Security regulations. In the event that significant
related regulatory changes occur, the policy will be reviewed and updated
as needed.
Procedures:
TBD
Page 3 of 3
Copyright 2003 Phoenix Health Systems, Inc.
Limited rights granted to licensee for internal use only.
All other rights reserved.