HIPAA Compliant Medical Document (PHI) Shredding Guide

Understanding Guidelines for Shredding Medical Records

If you’re in the healthcare industry, you are probably well acquainted with HIPAA regulations. Industry and federal privacy regulations are on the rise, and protecting people's privacy is becoming the norm. You and your practice cannot afford to get lax with following them or overlook opportunities for protected health information (PHI) to fall between the cracks. HIPAA compliance is required not only for healthcare providers but for any entity that transfers health data, according to the Department of Health and Human Services (HHS). If you are a health practitioner or manage a health organization and meet the criteria, it’s always a good idea to review the guidelines, especially those related to destroying or shredding medical records.

What Does HIPAA Require for Medical Record Disposal?

When HIPAA came into law in 1996, an important element was Section II, the Privacy Rule, also known as Standards for Privacy of Individually Identifiable Health Information. It requires entities handling PHI to “apply appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information (PHI), in any form.”

If you handle PHI, you have a duty to not only regulate how and with whom you share protected information, but you also need to avoid “incidental” disclosure of PHI, including during disposal. It is your responsibility to set forth policies and procedures that dictate how you dispose of electronic media containing PHI (ePHI). It is also your responsibility to train employees in these policies and procedures.

A properly destroyed medical record or piece of PHI is defined, according to HIPAA, as being rendered “unreadable, indecipherable, and otherwise unable to be reconstructed.” PHI cannot and should not be abandoned in dumpsters or public containers, including recycling bins. Although HIPAA doesn’t require a particular disposal method, shredding is listed as a proper method for disposing of PHI in the forms of both paper and electronic waste.

When Should Medical Documents Be Destroyed?

HIPAA requires that you keep medical records for ten years from the date of their creation or last use, whichever comes later. States have additional requirements for record retention. If the state requires that you keep a record longer than six years, their law supersedes HIPAA. Conversely, HIPAA supersedes any state document retention laws of less than six years. After the allotted time, if you no longer need the record, properly destroy the information itself along with any electronic storage that houses it.

• Names
• Birth Dates
• Geographic Identifiers
• Phone Numbers
• Fax Numbers
• Email Addresses
• Medical Record Numbers
• Biometric Identifiers
• Photos of Faces
• Social Security Numbers

Who Needs Medical Document Shredding?

Any “covered entity” that deals with medical information must comply with the HIPAA Privacy Rule. This includes:

Healthcare Providers

These include:

• Doctors
• Clinics
• Psychologists
• Dentists
• Chiropractors
• Nursing Homes
• Pharmacies