HIPAA's Security Rule reaches the end of a device's life explicitly: covered entities must address the final disposition of ePHI and the media it lives on. Retired clinical workstations, copiers, and network-connected medical devices all carry PHI, and regulators have fined organizations specifically for the disposal step.
Where PHI hides
The obvious carriers are clinical workstations and laptops. The dangerous ones are everything else: multifunction copiers with internal hard drives that store every scanned chart, imaging systems and diagnostic devices with onboard storage, network gear with cached credentials, and departmental servers retired during EHR migrations. Affinity Health Plan's copier settlement made the point publicly: leased devices went back with drives unwiped, and over 340,000 people were exposed.
What HIPAA expects at disposal
The Security Rule requires policies addressing the final disposition of ePHI and hardware, and HHS guidance points to NIST 800-88 as the sanitization benchmark. In practice, a defensible program means: an inventory of every data-bearing device leaving the organization, sanitization or destruction to standard, a certificate per device, and a chain-of-custody record. Business associate obligations extend the same discipline to the vendor doing the work.
Local matters more in healthcare
Every mile a PHI-bearing device travels untracked is exposure. Local Tampa Bay processing shortens the chain of custody, keeps accountability close, and makes audits simpler: one metro, one facility, one record. American Circular is built for exactly this workflow, with serial-level tracking and NIST 800-88 aligned destruction, and R2v3 certification in process, targeted late this year.
Frequently asked questions
Do copiers and printers really need data destruction?
Yes. Multifunction devices store scanned documents on internal drives. Under HIPAA, those drives are ePHI media and must be sanitized or destroyed at disposition like any other drive.
What documentation should a healthcare organization keep?
A serial-level inventory of retired devices, a certificate of destruction per device, and the chain-of-custody record. Together they demonstrate the disposal safeguards HIPAA expects.