When a facility upgrades its computers, replaces a copier or cleans out a storage room, old equipment often heads to a closet, a recycler or a donation bin. Many of those devices still contain resident records, staff information and saved credentials. A discarded hard drive can create a reportable breach long after the device left the building.
HIPAA's Security Rule includes physical safeguards for device and media controls, with required policies for the disposal of electronic protected health information and the media on which it is stored, as well as for media reuse. Here is how to handle retirement properly.
The obvious devices are desktops, laptops and servers. But many other items store information.
Multifunction copiers and printers with internal drives that store scanned and printed documents
Fax machines and scanners with memory
Smartphones and tablets, including those used on medication carts
External hard drives, USB sticks and old backup tapes or disks
Network equipment such as firewalls and switches that hold configuration data and sometimes credentials
Medical devices that store resident data, such as monitors with memory
Phone system voicemail storage
Build an inventory of these so retirement does not leave anything behind.
The NIST guidelines for media sanitization describe three broad levels, which many organizations use as a reference.
Overwriting data using standard tools. It protects against simple recovery but may not suit highly sensitive data or every kind of storage.
Using methods that make data recovery infeasible even with advanced lab techniques, such as cryptographic erase or specialized secure erase commands for certain drives.
Physically destroying the media, for example by shredding or crushing. This is generally the most certain option, and it is common for failed drives that cannot be wiped.
The right choice depends on the type of media and the sensitivity of the data. Solid-state drives and phones need methods designed for them, because ordinary deletion or formatting does not reliably remove data.
If your devices use full-disk encryption throughout their lives, securely erasing the encryption key at retirement renders the data unreadable. This makes retirement faster and more reliable, and it is another reason to encrypt laptops and workstations from day one.
Keep a record of each retired device, including:
Type, make, model and serial number
Date of retirement
The method used to sanitize or destroy it
Who performed the work
A certificate from the vendor, if one was used
This documentation is your proof if you are ever asked what happened to a missing device.
If you use a recycler or destruction company, treat it like any vendor handling protected information.
Sign a business associate agreement where the vendor may access protected health information
Ask about the destruction methods, chain of custody and security of their facility
Request itemized certificates listing serial numbers, not a generic statement
Consider witnessed or onsite destruction for high-risk media
Ask where data-bearing equipment goes if it is resold, and how it is sanitized first
Be cautious about free pickup offers and donations without clear sanitization assurances.
Devices waiting for disposal are vulnerable. Do not leave them in unlocked closets or hallways. Keep them in a locked area, logged in your inventory and handled promptly. Stacks of old computers that sit for years are a common source of incidents.
Leased copiers and computers go back to the lessor with whatever is on them. Before returning equipment, ask the vendor to sanitize or remove the drives, and get written confirmation. Include data-handling terms in lease agreements.
When an employee leaves or replaces a phone, make sure work data is removed. Mobile device management can remotely erase work data and confirm the result.
Write a short policy covering inventory, authorization to retire, the method of sanitization, documentation and vendor requirements. Assign someone responsible, and review it annually.
UnityCare IT can sanitize and document retired equipment, help you evaluate disposal vendors and set up encryption so future retirements are simpler and safer.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172