What does it mean to properly dispose of ePHI?
HIPAA Weekly Advisor, November 28, 2005
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
In a nutshell, electronic PHI (ePHI) can be easily recovered off of hard drives, CD-ROMs, and other media storage devices if it's not properly erased and/or they're not properly destroyed. The final security rule requires covered entities to ensure the digital bits and bytes are inaccessible before being destroyed, sold, auctioned off, given away, or otherwise thrown out.
Many people believe that simply deleting files or formatting drives is sufficient to keep ePHI out of the hands of criminals-this simply is not the case. Any type of storage media must be properly sanitized and there are just a handful of ways to ensure this, such as
- overwriting the disk media with multiple passes as specified in the Department of Defense 5220.22-M standard for hard drive sanitization
- performing a hardware reinitialization of the storage space (if possible)
- physically breaking, burning, or otherwise destroying the storage device
Editor's note: Kevin Beaver, CISSP, security consultant with Atlanta-based Principle Logic, LLC, answered this question. This is not legal advice. Consult your attorney for legal matters.
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Related Products
Most Popular
- Articles
-
- HIPAA Q&A: Flu shot requirement for hospital employees
- Running an effective peer review committee meeting
- HealthDataInsights posts new issues for medical necessity claims
- Sneak Peek: Effort underway to establish caseload benchmarks
- New FAQ posted on storing laryngoscope blades
- Q/A: Coding for telescopic intraocular lens
- Tip: Perform your own internal investigation prior to government audit
- HIPAA 5010 deadline extended, but threat remains, says AMA
- HHS task force: Consider privacy, security with text messages
- What does case-mix index mean to you?
- E-mailed
-
- Running an effective peer review committee meeting
- HIPAA Q&A: Flu shot requirement for hospital employees
- What does case-mix index mean to you?
- HHS task force: Consider privacy, security with text messages
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- Q/A: Coding for telescopic intraocular lens
- Q/A: Correct use of modifier -PT
- Tip: Correctly code bilateral pain management procedures
- "Wall fountains" may be spreading Legionnaires to patients, visitors
- 2012 CPT code changes for ASCs: Shoulder and knee scopes and pain management
- Searched