Coretek 360

Retiring Clinic Laptops Under HIPAA: Hospital ITAD Use Case

How a hospital system retired ePHI laptops and imaging workstations under HIPAA: BAA, chain of custody, verified NIST 800-88 wipes, one certificate per drive.

The Coretek 360 logo

By Coretek 360

Company page

Use casePublished 14 min read

The words Retiring Clinic Laptops Under HIPAA, Hospital ITAD Use Case over teal and silver waves on a black background

Written and reviewed by the ITAD team at Coretek 360, whose facility is audited to R2v3 and RIOS. The engagement below is drawn from hospital and clinic projects of this type with identifying details removed; no client figures are reported. About the company.

A hospital system had outgrown a generation of clinic laptops and imaging workstations. Every one of them had held electronic protected health information (ePHI), and every one had to leave the building with proof that the data was gone. The IT team wanted the closets emptied before the next refresh landed. The privacy officer wanted a record that would hold up if the Office for Civil Rights (OCR) ever asked where a particular drive went.

The two requests are the same job. HHS tells covered entities they "are not permitted to simply abandon PHI or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons" (HHS, 2009). Affinity Health Plan paid $1,215,780 after it "returned multiple photocopiers to a leasing agent without erasing the data contained on the copier hard drives" (HHS, 2013). This use case shows how the hospital's IT asset disposition (ITAD) was run so the privacy file was complete on the day the last laptop left. The service behind it is described at ITAD for healthcare.

Key Takeaways

  • HIPAA's device and media controls at 45 CFR 164.310(d) require disposal and media re-use procedures and ask for a record of hardware movements and the person responsible. A serialized chain of custody with a certificate for every drive answers the first three; the hospital's written confirmation that data was migrated answers the fourth.
  • An ITAD provider that takes drives holding ePHI is a business associate. HHS says the covered entity "must enter into a contract or other agreement" requiring the vendor to safeguard PHI "through disposal," so the agreement came before the first pickup.
  • HHS names no required disposal method. Wiping to NIST SP 800-88 with verification kept working laptops whole for resale; drives that failed verification were shredded and logged.
  • OCR settlements over lost, stolen or unwiped devices ran from $1,040,000 to $3 million between 2013 and 2020, each tied to a missing safeguard rather than to the hardware itself.

In this article:

What HIPAA asks of a retired device

HIPAA does not name a disposal method. It names outcomes and records. The Security Rule's device and media controls standard requires a covered entity to "Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility" (45 CFR 164.310(d)(1)). Four implementation specifications sit under it, two required and two addressable:

  • Disposal (Required): "Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored."
  • Media re-use (Required): "Implement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use."
  • Accountability (Addressable): "Maintain a record of the movements of hardware and electronic media and any person responsible therefore."
  • Data backup and storage (Addressable): "Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment."

HHS's own answer on disposal says "the Privacy and Security Rules do not require a particular disposal method." For electronic media it lists "clearing (using software or hardware products to overwrite media with non-sensitive data), purging (degaussing or exposing the media to a strong magnetic field in order to disrupt the recorded magnetic domains), or destroying the media (disintegration, pulverization, melting, incinerating, or shredding)," and points readers to "NIST SP 800-88, Guidelines for Media Sanitization" for the practical detail (HHS, 2009).

The hospital's engagement was planned against those four specifications. Each one had a document that would satisfy it:

45 CFR 164.310(d)(2) specificationWhat the engagement produced
DisposalA certificate of data destruction for every drive, naming the NIST 800-88 method and date, and a final disposition for every asset
Media re-useA verified wipe before any laptop was refurbished and resold; drives that failed verification were shredded instead
AccountabilityA signed pickup manifest at each clinic, tracked transport, and an intake record that reconciled every serial number to the manifest
Data backup and storageWritten confirmation from the hospital, before pickup, that clinical images and local files had been migrated

Why the hardware could not simply go to recycling

A recycling receipt satisfies none of the four specifications, and OCR's device cases show what the gap costs. The University of Rochester Medical Center paid $3 million in 2019 in a case OCR titled "Failure to Encrypt Mobile Devices" (HHS, 2019). CardioNet paid $2.5 million in 2017 over "the impermissible disclosure of unsecured electronic protected health information" from a stolen laptop (HHS, 2017). Lifespan paid $1,040,000 in 2020 to settle "potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules related to the theft of an unencrypted laptop" (HHS, 2020). In the Affinity case, OCR found the plan "failed to implement policies and procedures when returning the hard drives to its leasing agents" (HHS, 2013).

OCR settlements tied to devices and media that held ePHI Settlement amount in millions of US dollars, by covered entity andyear announced (HHS Office for Civil Rights resolution agreements,2013 to 2020) URMC, 2019(unencrypteddevices) 3.0 CardioNet, 2017(stolen laptop) 2.5 Affinity, 2013(copier drives) 1.22 Lifespan, 2020(stolen laptop) 1.04 Source: HHS Office for Civil Rights resolution agreements, 2013 to 2020
Source: HHS Office for Civil Rights, resolution agreements with URMC (2019), CardioNet (2017), Affinity Health Plan (2013) and Lifespan (2020).

Device cases are now a small share of the breach reports OCR receives. HIPAA Journal's tally of the OCR breach portal for 2024 counted 725 breaches of 500 or more records, of which "There were 18 loss and theft incidents (2.5%) and 4 improper disposal incidents (0.6%)," against hacking at 81.2% (HIPAA Journal, 2025). A decommissioned laptop is still the case that needs its own controls, because the drive is about to be handled by people outside the hospital, which is where Affinity's copiers went wrong.

The agreement and the inventory before pickup

Nothing moved until two documents existed: a business associate agreement (BAA) and a serialized inventory. HHS is direct about the first. "Yes, a covered entity may, but is not required to, hire a business associate to appropriately dispose of protected health information (PHI) on its behalf. In doing so, the covered entity must enter into a contract or other agreement with the business associate that requires the business associate, among other things, to appropriately safeguard the PHI through disposal" (HHS, 2009). The Security Rule puts the duty on the hospital, which may hand ePHI to a business associate only after it obtains written assurances that the vendor will safeguard it (45 CFR 164.308(b)).

The BAA carried the three terms 45 CFR 164.314(a)(2)(i) requires: Coretek 360 agreed to comply with the Security Rule, to bind any subcontractor that handles ePHI to the same terms, and to "Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information" (45 CFR 164.314(a)). The subcontractor clause mattered because shredded drive material travels on to downstream recyclers. Coretek 360 signs these agreements with covered entities and business associates retiring devices that held PHI; the terms are described on the HIPAA compliant ITAD page.

The inventory was built where the devices sat. A technician logged each laptop and workstation by serial number at the clinic, so the hospital's asset list and Coretek 360's intake record matched from the first day. Before the pickup date, the hospital confirmed in writing that imaging studies and local files had been migrated, which closed the data backup and storage specification.

Where the inventory requirement is heading

OCR's January 2025 proposed update to the Security Rule would require "an accurate and thorough written technology asset inventory" recording "the identification, version, person accountable for, and location" of each asset (Federal Register, 90 FR 898, 2025); it is not final, with final action listed for July 2027 (Office of Information and Regulatory Affairs, retrieved 2026). A serialized intake record feeds that inventory: it is the leaving-assets slice, written before anything moves.

Custody from the clinic to the facility

The accountability specification asks for a record of where hardware and electronic media moved and who was responsible for them (45 CFR 164.310(d)(2)(iii)). The engagement produced that record in three parts:

  1. At each clinic, the pickup manifest listed every serial number leaving the site. The hospital's representative and the Coretek 360 crew lead signed it, with the time.
  2. In transit, the hardware traveled sealed in tracked vehicles, straight to the facility.
  3. At intake, technicians scanned every serial number again and compared the count to the manifest. They resolved any difference with the clinic before processing a single device.

The same custody record serves other regulated industries; the bank engagement in chain of custody for examiners was built on it.

NIST frames the same discipline in life-cycle terms for information storage media, which it calls ISM. An organization "can most effectively identify how well ISM sanitization is being applied across the enterprise if records are maintained when the ISM is introduced to the environment, when it leaves the place where it was last used, and when it reaches the post-sanitization destination" (NIST, 2025). The hospital held the first record; the manifest, the intake scan and the disposition report supplied the other two.

Wiping, verifying, shredding what failed

Technicians wiped every drive to NIST SP 800-88 Rev. 2 and verified the result before the device went anywhere. NIST defines three methods, clear, purge and destroy, and states a preference: "When possible, the purge sanitization method should be used instead of the clear sanitization method," because purge "preserves the ISM in a potentially reusable state" (NIST, 2025). Keeping the media reusable is what let working laptops return value instead of becoming shredder feed. The methods and what changed in the 2025 revision are covered in NIST 800-88 Rev. 2 explained.

Verification was a step, not a checkbox. NIST expects the results of every sanitization to be inspected, and for wipes that means "checking the completion status of the tools and identifying errors, anomalies, and the health of the ISM." A failed result "would require repeating the sanitization method using a different sanitization technique or escalating to a more secure sanitization method" (NIST, 2025). Technicians escalated drives that reported errors or failed health checks to destroy, which NIST notes "may be the only option when the ISM fails or is obsolete." They logged each failed drive's serial number before shredding it, so its certificate records destroy rather than purge, and the hospital's file shows why.

The imaging workstations went through the same steps: their onboard storage was a drive like any other, logged by serial number, wiped and verified, or shredded when it would not verify. Shredding is performed in house by Coretek 360 and is not yet covered by our R2v3 certificate, which covers data sanitization, test and repair, and the downstream recycling chain. We are actively working to add it. The methods are described on the data destruction page.

What the hospital kept

The engagement closed with four records, each tied to the serial numbers logged on the first day:

  • A certificate of data destruction for every drive. NIST says a certificate "should be completed for each ISM that has been sanitized" (NIST, 2025), and the hospital's certificates carry the fields NIST lists, from the drive's serial number to the signature of the person who verified the wipe.
  • A final serialized disposition report covering every asset's make, model, custody record, sanitization method and outcome, resale or recycling, reconciled against the clinic inventory.
  • An itemized settlement listing the value returned from each refurbished laptop and workstation by serial number. Units with life left were refurbished after the verified wipe and resold through Coretek 360's sales channels, so the retired fleet returned part of its cost. What determines how much comes back is covered in how to recover value from retired IT assets.
  • The business associate file: the executed BAA, Coretek 360's R2v3 and RIOS certificate details for the hospital's vendor review, and the reports above.

For the privacy officer, the result was a single record that tied every retired device to the way its data was destroyed and the person who verified it. For IT, it was a closet emptied without an open question. For finance, it was proceeds booked against hardware that most health systems have already fully depreciated.

Frequently asked questions

Does HIPAA require hard drives to be shredded?

No. HHS says "the Privacy and Security Rules do not require a particular disposal method," and lists clearing, purging and destroying as acceptable for electronic media (HHS, 2009). A verified wipe to NIST SP 800-88 meets the media re-use requirement and keeps the device sellable. Shredding is for drives that fail verification, cannot be wiped, or that the hospital's own policy marks for destruction.

Is a business associate agreement required with an ITAD vendor?

Yes, when the vendor takes custody of devices or media that hold PHI. HHS says the covered entity "must enter into a contract or other agreement with the business associate" requiring it to safeguard the PHI through disposal (HHS, 2009), documented in "a written contract or other arrangement" (45 CFR 164.308(b)(3)). Sign it before the first pickup.

What should the certificate of data destruction show?

NIST SP 800-88 Rev. 2 lists the fields a certificate should carry, including the manufacturer, model, serial number, the organization's property number, media type and source, the sanitization method and technique, the tool and its version, the verification method, and the name, title, date, location, contact information and signature of the person who verified the work (NIST, 2025). One certificate per drive, searchable by serial number, lets a privacy officer answer a question about a single device the same day.

Before the next refresh

The hospital's last laptop left its clinic with a signed manifest, arrived against a matching intake scan, was wiped and verified or shredded and logged, and ended in a disposition report that named where it went. The privacy file was complete without anyone assembling it after the fact, and the refurbished units sent money back to the budget. If a clinic refresh or a workstation replacement is coming, send Coretek 360 the retiring inventory and you will get back a custody plan, the business associate agreement, and a residual value estimate through the contact page.

Sources

Have a project like this one?

Tell Coretek 360 what you are retiring and we will plan the pickup, the sanitization, and the report around it.

Get a quote

Newsroom