Estimated reading time: 12 minutes
Remember that stack of old client files in your home office closet? Or the laptop you replaced last year that's still sitting in a drawer?
If you're like most solo practitioners, you're aware that these items contain protected health information (PHI) that requires special handling, but the technical requirements can feel overwhelming.
Destroying PHI properly doesn't have to be complicated or costly. You just need to know which methods HIPAA actually accepts and how to implement them in your small practice.
This guide walks you through acceptable methods for destroying PHI. You'll learn practical solutions that work for solo and small practices. Keep reading for clear steps you can actually follow.
TL;DR: HIPAA doesn't mandate a single disposal method. PHI must be destroyed so that it is unreadable and cannot be reconstructed in any way. For paper, use cross-cut (or micro-cut) shredding or a certified destruction service (with a BAA + Certificate of Destruction). For devices, wipe drives or physically destroy media. Document what you destroy and train anyone who handles PHI on disposal. Small practices get fined, too: simple safeguards prevent expensive mistakes.
You might think data breaches only happen to big hospital systems, but small practices face real risks too.
Take New England Dermatology. The practice tossed specimen containers with patient labels straight into their parking lot dumpster. This went on for a decade. When discovered, it cost them $300,640 in penalties, and they were required to enter into a Corrective Action Plan.
Here's what's more relevant to your practice. Even accidentally recycling a single client's intake form counts as a HIPAA violation. The same goes for donating an old computer without properly wiping it.
The good news? Preventing these mistakes is actually pretty straightforward once you know what to do.
💡Pro tip: Don't worry if your past disposal methods weren't perfect. Starting proper procedures today shows good faith compliance. HIPAA investigators look more favorably on practices that self-correct than those that continue to ignore the rules.
The technical requirement says PHI must be "unreadable, indecipherable, and unable to be reconstructed."
Here's what that means for your practice: if someone finds your disposed records, they shouldn't be able to read any client information — not names, not diagnoses, not even appointment dates.
The good news is that HIPAA doesn't require any specific method. You get to choose what works for your situation and budget.
Everyone in your practice who handles PHI, including:
HIPAA uses the term "reasonable safeguards", which means you need to think about:
Not all shredders are HIPAA compliant. That $30 strip-cut shredder from the office store? Not enough.
❌ What doesn't work:
✅ What does work:
HIPAA also allows burning, pulping, or pulverizing. These are more common in large facilities and usually not practical for small practices, but they remain acceptable if done correctly.
Another practical option for small practices is to use a professional disposal service — especially if you're clearing out years of old files. Just make sure you get:
Deleting files or reformatting drives isn't enough because the data can still be recovered. But don't panic. Here are practical solutions for small practices:
Option 1: Free software solutions
Think of it like painting over a permanent marker. You're covering the old data with new, meaningless data multiple times, until the original data can no longer be recovered.
Option 2: Physical destruction
Here's a quick reference for common devices and how to properly destroy them:
| Device | ✅ What works | ❌ What doesn't work |
|---|---|---|
| Old laptops | Remove the hard drive + destroy it | Deleting files only |
| USB drives | Smash or shred | Just hitting "delete" |
| CDs/DVDs | Shred or break into pieces | Surface scratches |
| Old phones/tablets | Factory reset + physically destroy the device | Factory reset alone |
| Copier/printer memory | Wipe/remove memory before disposal | Returning without checking |
The government's NIST 800-88 guidelines are the gold standard for sanitizing electronic media. Following them ensures that data on laptops, drives, and other devices is truly unrecoverable.
The takeaway?
When in doubt, physically destroy it. A hammer works great for USB drives and old phones. For computers, use either the free DBAN software we mentioned or remove the hard drive for destruction.
Not all PHI is obvious, and some situations need extra care:
💡Pro tip: Write down your policies and procedures for PHI disposal, and keep records of what you destroy.
Staying compliant means knowing the rules at every level. Here's what you need to keep in mind federally, at the state level, and within your own practice.
While HIPAA doesn't have a specific "shredding law," it does require that any PHI disposal method renders the information "unreadable, indecipherable, and unable to be reconstructed."
This is where the cross-cut (or micro-cut) shredders are strongly recommended — they align with the federal definition of "unreadable." Avoid strip-cut shredders, since the long ribbons can sometimes be pieced back together.
Some states go beyond HIPAA and impose their own regulations. These may include:
The penalties for improper PHI disposal can be steep, and they don't just apply to large healthcare systems. Small practices can be held fully accountable. Consequences may include:
Real-world example: A small pharmacy, Cornell Pharmacy, paid $125,000 for the improper disposal of paper records.
👉 Recommended reading: What are the consequences of violating HIPAA? and How to do your HIPAA risk assessment (with template)
Your practice should have a basic written policy for how you dispose of PHI. It doesn't need to be long, just clear and consistent. Here's what to include:
The Department of Health and Human Services (HHS) explicitly states that hiring a certified disposal service is not only allowed — it's an officially recognized HIPAA-compliant option.
Here's a quick decision guide to help small practices choose the right method:
| Question | Recommendation |
|---|---|
| How much PHI do you generate? |
|
| What's your budget? |
|
| What's your comfort level with technology? |
|
Always get a signed Business Associate Agreement (BAA) before handing over PHI. If a vendor can't provide one, move on.
| ✅ What to look for | 🚩 Red flags |
|---|---|
| NAID AAA Certification (industry gold standard) | No written agreement |
| Certificate of Destruction | Can't explain their process |
| Clear process + secure chain of custody | Suspiciously cheap prices |
| Insurance coverage | No certification |
"A BAA doesn't guarantee a vendor is doing everything right. It's up to you to vet them — and review the relationship every year."
Steve Youngman, VP Legal, Hushmail
Even well-meaning practices make these errors every day, but they're all easily preventable once you know what to watch for.
Keep a simple log with the following details:
Date: __________________________
Records: _______________________
Method: ________________________
By: ____________________________
Certificate # (if using a service): ____________________
Keep your destruction logs for a minimum of 6 years. Store them digitally if you prefer, just make sure they're backed up.
👉 Recommended reading: HIPAA Documentation Requirements for Small Healthcare Practices Made Simple
The less paper you create, the less you need to destroy. Hushmail for Healthcare, trusted by over 47,000 healthcare professionals, helps by moving PHI into a secure online space from day one.
✅ Less paper to shred
✅ Better control over digital PHI
✅ Made for small practices
If you think about it, every client form you collect digitally through Hushmail is one less paper form to shred later. Every encrypted email conversation stays secure without printing. And when it's time to clean out old records, your digital files are already organized and protected.
Ready to reduce your PHI disposal burden?
Try Hushmail for Healthcare free for 14 days and see how much easier HIPAA compliance can be when you start with the right tools.
Here are the questions we hear most from small practices:
Q: Does HIPAA specify shred size for PHI disposal?
A: HIPAA doesn’t specify dimensions. As a rule of thumb, if you can't read a full word, you're probably okay. Cross-cut (or micro-cut) shredders are the safest choice.
Q: Can I put shredded PHI in regular recycling?
A: Yes. Once properly shredded to HIPAA standards, it's just paper.
Q: Do deceased clients' records need special handling?
A: HIPAA protection continues after death. The same destruction rules apply.
Q: What if I accidentally threw PHI in regular trash?
A: Document it, retrieve it if possible, and assess if it's a breach. In the future, use proper methods (self-correction matters).
Q: How long must I keep destruction documentation?
A: Minimum 6 years from the destruction date.
Q: Is a home paper shredder sufficient?
A: Only if it’s cross-cut (or micro-cut). Check the specifications before buying — avoid strip-cut shredders.