A practice replacing its computers is disposing of protected health information, whether or not anyone thinks of it that way. HIPAA has specific things to say about that, and the part most practices miss isn't the wiping — it's the paperwork and the vendor relationship.
In practice it's four steps, and the order matters.
One, sign the BAA before anything moves. If a vendor collects devices with patient data and no agreement is in place, that is itself a problem, separate from whatever happens to the data afterwards.
Two, list every device and every drive. Including the ones above. The list is what the certificate gets checked against.
Three, decide where destruction happens. Many practices choose on-site shredding, so no drive holding patient information ever leaves the building. It removes the transport window from the risk picture entirely, which is easier to explain to a compliance officer than a chain-of-custody log. On-site versus off-site.
Four, file the certificate with your HIPAA documentation, not in the practice manager's email. Six years is a long time and people leave.
The Security Rule requires covered entities to have policies and procedures for the final disposition of electronic protected health information and the hardware or electronic media it is stored on, and to remove that information from media before the media is re-used. HHS guidance points to NIST SP 800-88 as the practical standard for sanitisation. In addition, a disposal vendor handling devices containing patient data is a business associate and needs a Business Associate Agreement in place beforehand.
If the devices they handle contain protected health information, then generally yes. A vendor taking custody of drives with patient data is performing a function on your behalf that involves that data, which makes them a business associate under HIPAA. The agreement should be signed before collection, not afterwards. SF IT Recovery will sign a BAA for practice work.
HIPAA does not mandate a single method. It requires that protected health information be rendered unreadable, indecipherable and otherwise cannot be reconstructed, and HHS guidance references NIST SP 800-88, which treats a verified Purge as sufficient for most media leaving an organisation. Many practices still choose physical destruction because it is simpler to evidence and easier to explain during an audit. Either is defensible if it is verified and documented.
It needs the same treatment as a computer. Multifunction copiers store scanned documents on an internal hard drive, and in a practice those scans are charts. The complication is that copiers are usually leased, so the device goes back to the leasing company with your patient data on it unless the drive is specifically dealt with first. Raise it with the leasing company before the return.
HIPAA requires documentation to be retained for six years from the date of creation or the date it was last in effect, whichever is later. Keep destruction certificates with your other HIPAA documentation for at least that long. They are PDFs, so there is no cost to keeping them longer, and no way to recreate one after the fact.
We sign a BAA, list every drive by serial number and can shred on-site so nothing leaves your building.