Hipaa and hard drives from a medical clinic

I have a friend who is an IT professional. He is contracted to support a medical clinic. I asked him if the clinic will give me there outdated equipment. He said the clinic pays someone to take away the old equipment. I told him I would take away all of the old equipment for free. Sounds like I have found a good stream of E scrap. We were chatting and he said he had dozens of hard drives from the clinic. He has been storing them for some time and is waiting to get rid of them due to HIPAA regulations. As far as he is aware, he must have the hard drives disposed of by a certified company. Have any of you dealt with this situation or know what I can do to obtain these hard drives? Thanks, silverockdzl

You'll pretty much have to send them to a facility that is certified.

You may be better off trying to get everything other than hard drives.



Federal regulations on hospitals isn't for the faint of heart!

That's what I'd do.

The boards are what you want. If you can get them and leave the metal part to a destruction company, you'll have done very well.

That is one of the reasons companies, like the one I work for, invest all the money and the time and effort it takes to get certified.

ya sometimes I get people thinking if I take the boards I am taking the info as well so that I don't have to deal at all with this in these situations I contacted a few places and found a good contact that will get back to a company right away for certified destruction and come with a big truck with a shredder which really is nothing like a paper one with knifes most call them hammers as they pulverize material with heavy strong pieces of blended steel. this my contact still makes money from material and can in the future and I can still pick up other things.

People throw around the word "certification" without understanding what they are talking about. There is no rule that says you need a special certification to destroy hard drives. You do need to follow HIPAA guidelines to destroy them though.

Most large companies and more and more smaller companies every day only use "certified" recyclers. Being certified says to a prospective client that you handle their assets, as well as their data, exactly the way you say you do and have a third party come in on a regular basis to prove that you are conducting business by the regulations set forth in the standard you are certified to.

Depends.. around this part of NY, no one cares as long as it's being taken care of.

It seems logical that a person could take the board out of the hard drive and send the rest off to the crusher. Hard drive boards are what, $10 per pound. Would it be worth the trouble to get just the boards out? I will have to ask if my friend would be comfortable letting me take the boards out. Thanks for the replies.

I tried our local hospital and the service that does their document destruction also does all their data destruction (including devices), which is mandated by the "parent" hospital. Hypersensitive about data security, which I understand. It sucks, though, because I would imagine there is a steady supply of quality material.

Revisiting this past thread, and since it has been discussed more recently in others, I looked up an online "training" for HIPAA certification and found a couple that are specific to parties that work in / around the medical field as so-called Business Associates (the list included specifically "asset recyclers"). The course was $29.99 and upon completion some type of certificate is available.

Any idea if this would help at all, or is it an "all in" R2 / esteward type situation?

on site destruction is not required in the HIPAA rules, but the generator(hospital) cannot delegate responsibility for the loss of control of patient data. SO even if a full R2 certified facility takes the material and signs away their life, if the data is lost and resurfaces, the Generator(hospital) is still responsible, though the Hospital has legal recourse...

But any lawyer worth a SH12 will tell the hospital to have the data destroyed before it gets into other hands. No one trusts degaussing anymore since there are so many (real crime dramas) showing that stuff getting put back together. So an on site shredder is what you are going to have to compete with if you want into this line of work, and most Lawyers if asked will want the entire hard drive destroyed board and all, and no one from the hospital IT department will waste their time arguing about getting to sell the hardrive boards.

Beware and tell your customers to beware of the people claiming to be R2 compliant. this is a common scam to avoid getting certified and still being treated like you are.

V/r HT1

I would contact mario aka ewasted and give him a shout. He could provide this service and still buy the drives at reduced cost in exchange for the certificate of destruction. He is licensed to do so per a conversation years ago.

Originally Posted by jeanbean0109

I would contact mario aka ewasted and give him a shout. He could provide this service and still buy the drives at reduced cost in exchange for the certificate of destruction. He is licensed to do so per a conversation years ago.

The problem with shipping these to someone for destruction is the chain of custudy. How can you be sure they won't wind up in the wrong hands before being destroyed?

Since hospitals are multi billion dollar businesses usually with more then one location and federal laws for medical data theft are pretty bad I am surprised they would sell or give away ANY data gathering medical devices or computers they no longer use.