Compliance Resources
HIPAA & IT Asset Disposal
HIPAA does not stop applying when a computer is retired. Devices that touched patient scheduling, billing, imaging exports, or email can carry protected health information (PHI) into the disposal stream — and disposal is one of the classic ways PHI ends up where it should not.
What HIPAA expects at disposal
HIPAA's Security Rule requires covered entities and business associates to implement policies for the final disposition of electronic PHI and the media it lives on, and to make that media unusable or inaccessible before disposal or reuse. Federal guidance points to NIST Special Publication 800-88 — the media sanitization standard — as the reference practice for doing that.
In plain terms: a practice that hands PHI-bearing computers to a hauler with no sanitization process and no record has a disposal problem, even if nothing bad ever surfaces. The obligation is to handle the media appropriately and to be able to show that you did.
What that means for retired healthcare IT
Exam-room workstations, front-desk PCs, nurse-station machines, back-office laptops, and the server closet behind the practice all potentially hold PHI — in applications, cached files, local exports, and email archives. So do the drives inside retired copiers of EHR-adjacent systems and the storage in old backup appliances.
A defensible retirement process is boring on purpose: inventory the devices, track data-bearing media by serial number, sanitize using a process aligned with NIST SP 800-88 Rev. 2 guidance (or physically destroy where policy requires it), and file the documentation with the project record.
How our process supports HIPAA-conscious disposal
We are not your compliance counsel and we do not certify HIPAA compliance. What we provide is a documented handling process: storage media sanitized using methods aligned with NIST SP 800-88 Rev. 2 guidance, GreenIT-issued process certificates, serialized manifests on request, and scoped on-site drive crushing where your policy calls for physical destruction. GreenIT certificates are service records, not third-party certification or government approval.
Healthcare pickups across DFW are scheduled around patient hours and facility rules, and the documentation is structured so your practice manager, compliance lead, or MSP can file it without translation.
This page is general information, not legal advice. Regulations change and their application depends on your situation — confirm your obligations with your counsel or compliance advisor. What we provide is documented disposal: sanitization aligned with NIST SP 800-88 Rev. 2 guidance, certificates, and manifests that support the procedures your advisors design.
Common Questions
Does HIPAA require physical destruction of hard drives?
No single method is mandated. Federal guidance references NIST SP 800-88 Rev. 2 media sanitization, which includes sanitization and destruction paths depending on the media and sensitivity. Many organizations sanitize as the default and reserve physical destruction for selected media; GreenIT can scope witnessed on-site drive crushing for that path.
We are a business associate, not a provider. Does this still apply?
Business associates carry HIPAA obligations for the PHI they handle, including at disposal. Billing companies, MSPs supporting clinics, and similar organizations retire equipment under the same expectations.
What documentation should we keep after disposal?
At minimum: what devices left (ideally by serial number), when, who handled them, and how data-bearing media was sanitized or destroyed. We provide pickup receipts, GreenIT-issued certificates of data sanitization, and serialized manifests on request so that record exists without extra work on your side.
Retiring Equipment With Data On It?
Free pickup for qualifying business IT equipment across DFW — with the sanitization certificates and manifests your records need.
Schedule a Documented Pickup