HIPAA compliant IT asset disposition
Devices that held protected health information are wiped to NIST 800-88 or shredded, tracked by serial number from your dock to final disposition, and documented with a certificate of data destruction your auditors can check line by line.
What HIPAA is
The law and who it covers
The Health Insurance Portability and Accountability Act of 1996 is the United States law that governs how protected health information is kept private and secure. The Department of Health and Human Services administers it, and its Office for Civil Rights enforces it. It applies to covered entities, meaning health plans, healthcare clearinghouses, and providers that bill electronically, and to the business associates that handle protected health information (PHI) on their behalf. PHI is any health information that can identify a patient, from a chart to a billing record to the cache on a retired workstation.
The three rules that reach disposal
The Privacy Rule requires safeguards against any impermissible use or disclosure of PHI, including at disposal. The Security Rule sets device and media controls for electronic PHI, which require a covered entity to address the final disposition of hardware and to remove electronic PHI from media before the media is reused. The Breach Notification Rule requires notice to patients and to HHS when unsecured PHI is exposed, and HHS's guidance on what counts as secured points to NIST Special Publication 800-88 for media that has been cleared, purged, or destroyed.
No certification, only proof
HIPAA has no certification program. No agency certifies a vendor as HIPAA compliant, so a seal on its own proves nothing. What a compliance reviewer can check is whether the vendor's process meets the rules and whether the documentation shows it did, device by device. That is how Coretek 360 approaches it: a NIST 800-88 method for every drive, a chain of custody by serial number, and a record for every device.
- Regulation
- Health Insurance Portability and Accountability Act of 1996
- Regulator
- Department of Health and Human Services, Office for Civil Rights
- Rules that apply to disposal
- Privacy Rule, Security Rule, and Breach Notification Rule
- Sanitization standard we follow
- NIST Special Publication 800-88
- Proof per device
- Certificate of data destruction per serial number and a serialized asset report
- Facility
- Concord, North Carolina
HIPAA is a law rather than a certification, so there is no certificate number to look up. Our R2v3 and RIOS certificates, which cover the audited processes behind this work, can each be verified in their public directories.
What HIPAA requires when hardware is retired
Each rule asks a different question of the device leaving your building.
Privacy Rule
No disclosure at disposal
PHI may not be disclosed through careless disposal. A drive, phone, or copier that leaves a facility with patient data still readable is an impermissible disclosure, whoever ends up with it.
Data destruction: Privacy RuleSecurity Rule
Device and media controls
Covered entities must address the final disposition of hardware that holds electronic PHI and remove that PHI before any media is reused. Both call for a documented procedure, not an assumption that a wipe happened.
ITAD services: Security RuleBreach Notification Rule
Secured or exposed
PHI on lost or mishandled media is a reportable breach unless it was secured. HHS's guidance treats media sanitized to NIST 800-88 as secured, which is why the method on every certificate matters.
NIST 800-88 compliance: Breach Notification RuleHow Coretek 360 keeps disposal HIPAA compliant
The same certified process on every job, with proof for every serial number.
Sanitized to NIST 800-88
Every drive that held PHI is cleared or purged to NIST 800-88 and verified, or shredded when policy says it must not survive. Any drive that fails verification is shredded. The method used is recorded for that serial number. Shredding is performed in house and is not yet within our R2v3 certificate scope, which we are working to add.
Our NIST 800-88 process: Sanitized to NIST 800-88Chain of custody by serial number
Assets are logged by serial number at your dock, moved in tracked vehicles, and recorded at every handoff through sanitization and final disposition. Devices that cannot leave intact are shredded on site.
White glove logistics: Chain of custody by serial numberDocumentation your auditors can check
You receive a certificate of data destruction for every serial number and a serialized asset report that reconciles each device against your inventory. It is the record a HIPAA audit or a breach investigation asks for.
All certifications: Documentation your auditors can check
Frequently asked questions about HIPAA
What compliance and privacy officers ask before retiring devices that held patient data.
What is HIPAA?
HIPAA, the Health Insurance Portability and Accountability Act of 1996, is the United States law that governs the privacy and security of protected health information. The Department of Health and Human Services administers it and its Office for Civil Rights enforces it. Its Privacy Rule, Security Rule, and Breach Notification Rule set what covered entities and their business associates must do to keep PHI private, secure, and accounted for.
Is Coretek 360 HIPAA compliant?
Yes. Our handling of devices that held protected health information is HIPAA compliant. Drives are sanitized to NIST 800-88 or shredded, every device is tracked by serial number under a documented chain of custody, and you receive a certificate of data destruction per serial number with a serialized asset report. HIPAA has no certification program, so the proof is in that process and that documentation rather than a seal.
Is there a HIPAA certification?
No. Neither HHS nor any other agency certifies a vendor as HIPAA compliant, and a HIPAA badge on its own is not proof of anything. What a reviewer can verify is the process and the records. Coretek 360 pairs HIPAA compliant handling with two certifications that are independently audited, R2v3 and RIOS, each of which can be checked in its public directory.
What does HIPAA say about disposing of devices?
The Security Rule's device and media controls require a covered entity to address the final disposition of hardware and media that hold electronic PHI, and to remove electronic PHI before media is reused. The Privacy Rule requires safeguards so that PHI is not disclosed through disposal. HHS's breach guidance treats media sanitized to NIST 800-88 as secured, which is the standard Coretek 360 works to.
Which devices hold protected health information?
More than the servers. Workstations, laptops, phones, tablets, backup tapes, the hard drives inside copiers and printers, and the storage inside imaging and clinical equipment can all hold PHI. We identify every data bearing device in scope before a pickup and choose the NIST 800-88 method suited to each. Medical device deinstallation is covered on the healthcare page.
Wipe or shred for PHI?
Either meets HIPAA when done to NIST 800-88 and documented. Wiping with the Clear or Purge method keeps a drive usable and recovers its value, and every wipe is verified. Shredding, the Destroy method, suits failed drives and media your policy says must not survive. Any drive that fails wipe verification is shredded, and each drive's certificate records which method was used.
Can devices be destroyed before they leave our building?
Yes. With on site data destruction, drives are logged by serial number and shredded at your location, so no PHI leaves intact. Shredded material then goes to R2v3 certified downstream processors and is documented through final disposition. Shredding is performed in house and is not yet within our R2v3 certificate scope, which we are working to add.
What documentation do we receive?
A certificate of data destruction for every serial number, recording the NIST 800-88 method used and the date, and a serialized asset report that records custody, sanitization, and final disposition for every device and reconciles it against your inventory. Together they give a HIPAA audit or a breach investigation a per device record rather than a summary letter.
Will Coretek 360 sign a business associate agreement?
Yes. When a covered entity or business associate retires devices that held protected health information, Coretek 360 signs a business associate agreement that sets out how the data is handled and destroyed. Send us yours with your request or ask for ours during planning. The serialized asset report and the certificate of data destruction per serial number then become the record of that destruction.
Does this also cover other regulations?
The same process and the same documentation support reviews under GLBA, FERPA, PCI DSS, CJIS, SOX, and state privacy laws. What changes between them is the regulation you answer to and the records your auditors ask for, so tell us which applies and we will plan the pickup, the sanitization method, and the serialized reporting around it.
Last reviewed on .
Related resources
Healthcare ITAD, how PHI is destroyed, and the standards and certifications behind it.
- Healthcare
Patient data destroyed with a certificate for every serial number.
- Data Destruction
Drives wiped to NIST 800-88 or shredded, with a certificate for each.
- NIST 800-88 compliance
The media sanitization guideline behind every certificate we issue.
- R2v3 certification
Certificate C0177760-R26, what it covers, and how to verify it.
- Certifications
R2v3, RIOS, NIST 800-88, and HIPAA, and what each one covers.
Retiring devices that held patient data?
Tell us what your privacy officer needs and we will plan the pickup, the sanitization method, and the documentation around it.
Contact us