Healthcare IT asset disposition with PHI destroyed and documented.
One overlooked drive can become a reportable breach. Coretek 360 retires clinic workstations, imaging systems, and servers that held PHI, deinstalls retired medical devices, and documents every serial for your privacy officer.
HIPAA compliant ITAD for hospitals, clinics, and practices.
Every device that stored electronic PHI is identified and sanitized to NIST 800-88, the method HHS guidance points to. Each one is documented per serial for the HIPAA Security Rule's device and media controls.
Patient Data Inventory
We identify every device that stored electronic PHI. That covers nurse station PCs, clinic workstations, imaging modalities and PACS servers, copiers, tablets, phones, and medical devices with onboard storage.
- Workstations and servers
- Imaging systems and copiers
- Phones, tablets, and removable media
Medical Device Deinstallation
Retired medical devices and clinical equipment are deinstalled from patient care areas and removed under documented chain of custody. Onboard storage is identified before the device leaves the room. PHI is then sanitized to NIST 800-88 and documented by serial number, like every other asset.
- Deinstalled from clinical spaces
- Onboard storage identified first
- Chain of custody from the room to our floor
Secure Collection
Devices are collected from each facility in tracked vehicles under documented chain of custody. Where your policy requires it, drives are shredded on site so media holding PHI never leaves your building intact.
- Pickups at every facility
- On site shredding available
- Chain of custody documented throughout
Data Sanitization
Media that held PHI is wiped to NIST 800-88 and verified, or shredded. That is the sanitization method HHS guidance references for the Security Rule's disposal standard, and our handling is HIPAA compliant throughout. Shredding is done in house by Coretek 360. It is not yet covered by our R2v3 certificate, and we are actively working to add it.
- Wiped to NIST 800-88 and verified
- Shredded when media must not survive
- A certificate for every serial number
Remarketing & Recycling
Workstations, laptops, and servers with life left in them are refurbished and resold through our sales channels, once their media is sanitized, with the value returned to your organization. Everything else goes to R2v3 certified downstream processors, as a RIOS Certified Recycler.
- Working hardware refurbished and resold
- Value returned to you
- R2v3 certified downstream recycling
Audit Ready Reporting
A certificate of data destruction for every serial number and a final report go to your privacy officer, security officer, and compliance team. It is the disposal documentation an OCR audit or a breach investigation asks for.
- A certificate for every serial number
- Documentation for HIPAA audits
- Every device accounted for
Frequently asked questions.
Direct answers on the rules you answer to, the hardware we take, and the records you keep.
What does HIPAA require when disposing of devices that held PHI?
HIPAA requires a covered entity to apply safeguards to the final disposition of electronic PHI and the hardware it is stored on. HHS guidance points to the NIST 800-88 methods: clear, purge, or destroy. Coretek 360 sanitizes each device to NIST 800-88 and documents the work with a certificate of data destruction per serial number and a serialized asset report.
Do medical devices with onboard storage count?
Medical devices with onboard storage count whenever that storage held electronic PHI, so they need the same sanitization and documentation as a workstation or server. Coretek 360 deinstalls retired medical devices and clinical equipment from healthcare facilities under chain of custody. Any onboard storage is sanitized to NIST 800-88 and documented per serial number.
What documents does our privacy officer get?
Your privacy officer receives two documents from Coretek 360. A certificate of data destruction per serial number records the drive serial number, the NIST 800-88 method used, and the date. A serialized asset report records custody, make and model, sanitization method, and final disposition, resale or recycling, for every asset retired from your facilities.
Is shredding covered by your R2v3 certificate?
Shredding is not within the current scope of the Coretek 360 R2v3 certificate. Coretek 360 shreds drives in house, and the certificate covers the downstream recycling chain, logical data sanitization, and test and repair. Coretek 360 is working to add shredding to that scope. Wiping drives to NIST 800-88 is logical data sanitization, which the certificate does cover.
Last reviewed on .
More for healthcare.
How PHI is destroyed, the certifications behind it, and ITAD for life sciences.
Data Destruction
Drives wiped to NIST 800-88 or shredded, with a certificate for each.
Learn more about Data DestructionCertifications
R2v3, RIOS, NIST 800-88, and HIPAA, and what each one covers.
Learn more about CertificationsRetiring devices that held patient data?
Coretek 360 wipes or shreds them to NIST 800-88 with a certificate per serial, in support of HIPAA.