POLICY # 37 DISPOSAL ADMINISTRATIVE MANUAL APPROVED BY: SUPERCEDES POLICY: DATE: ADOPTED: REVISED: REVIEWED: REVIEW: PAGE: HIPAA Security Rule Language: “Implement policies and procedures to address the final disposition of EPHI, and/or the hardware or electronic media on which it is stored.” Policy Summary: All Sindecuse Health Center (SHC) information systems and electronic media containing EPHI that is no longer required must be disposed of in a secure manner. Disposal of electronic media containing PHI must be tracked and logged. Purpose: This policy reflects SHC’s commitment to appropriately dispose of information systems and electronic media containing EPHI when it is no longer needed. Policy: 1. All SHC information systems and electronic media containing EPHI must be disposed of properly when no longer needed for legitimate use. This disposal must include the EPHI received by SHC and created within SHC. Careless disposal of such information systems and media could result in EPHI being revealed to unauthorized persons. 2. Information systems and electronic media to which this policy applies include, but are not limited to: computers (both desktop and laptops), floppy disks, backup tapes, CD-ROMs, zip drives, portable hard drives and flash memory. 3. Disposal of all SHC electronic media and information systems containing EPHI must be tracked and logged. At a minimum, such tracking and logging must provide the following information: Date and time of disposal Who performed the disposal Brief description of media or information systems that was disposed 4. If an information system or electronic medium containing EPHI is to be reused within SHC (or for other entities), its previous data must be completely removed with erase tool(s) that have been approved by the Page 1 of 3 Copyright 2003 Phoenix Health Systems, Inc. Limited rights granted to licensee for internal use only. All other rights reserved. DISPOSAL SHC Information Security Office. 5. An information system or electronic medium containing EPHI that is to be disposed of permanently must be physically destroyed. 6. Destruction of SHC electronic media includes, at minimum, shredding or burning. An industrial data destruction service or facility may be used. Care must be taken to select a suitable contractor with adequate controls and experience, including the handling of confidential information. Scope/Applicability: This policy is applicable to all departments that use or disclose electronic protected health information for any purposes. This policy’s scope includes all electronic protected health information, as described in Definitions below. Regulatory Category: Physical Safeguards Regulatory Type: REQUIRED Implementation Specification for Device and Media Controls Standard Regulatory Reference: 45 CFR 64.310(d)(2)(i) Definitions: Electronic protected health information means individually identifiable health information that is: Transmitted by electronic media Maintained in electronic media Electronic media means: (1) Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card; or (2) Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the internet (wide-open), extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media, because the information being exchanged did not exist in electronic form before the Page 2 of 3 Copyright 2003 Phoenix Health Systems, Inc. Limited rights granted to licensee for internal use only. All other rights reserved. DISPOSAL transmission. Information system means an interconnected set of information resources under the same direct management control that shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people. Re-use means the use of electronic media containing EPHI for something other than its original purpose. Erase tool means hardware or software that is capable of completely removing all recorded material from electronic media. Responsible Department: Information Systems Policy Authority/ Enforcement: SHC’s Security Official is responsible for monitoring and enforcement of this policy, in accordance with Procedure # (TBD). Related Policies: Device and Media Controls Media Re-use Accountability Data Backup and Storage Renewal/Review: This policy is to be reviewed annually to determine if the policy complies with current HIPAA Security regulations. In the event that significant related regulatory changes occur, the policy will be reviewed and updated as needed. Procedures: TBD Page 3 of 3 Copyright 2003 Phoenix Health Systems, Inc. Limited rights granted to licensee for internal use only. All other rights reserved.