The Best Practices for IT Asset Disposition (ITAD) for Healthcare Providers

Healthcare providers — hospitals, physician practices, long-term care facilities, health plans, and business associates — are subject to HIPAA's Security Rule, which requires that electronic protected health information (ePHI) be protected from unauthorized access including at the point of disposal. The HIPAA Security Rule's technical safeguards explicitly require that media containing ePHI be cleared, purged, or physically destroyed prior to reuse or disposal. Non-compliance can trigger HHS Office for Civil Rights investigations with civil penalties that range from $100 to $50,000 per violation, with annual caps up to $1.9 million.

Best-practice ITAD for healthcare providers includes several specific requirements beyond standard business practices. First, the inventory must capture all devices that may have touched ePHI — not just computers and servers, but also networked printers, copiers, fax machines, mobile devices, medical imaging equipment, and point-of-care devices. Second, data destruction must be documented with HIPAA-compliant records: serialized certificates listing each device by make, model, and serial number, destruction method, and date. Third, the ITAD provider should be willing to serve as a business associate under HIPAA — meaning they sign a Business Associate Agreement (BAA) accepting responsibility for ePHI they handle.

STS Recycling is experienced in healthcare ITAD and can execute BAAs for healthcare provider clients. Our data destruction processes meet NIST 800-88 requirements referenced in HIPAA guidance, and our certificates are formatted for HIPAA audit readiness. Contact Chicago Lamp Recycling at 866-770-2650 to discuss a HIPAA-compliant ITAD program for your healthcare organization.