Medical Record Shredding & HIPAA-Compliant PHI Destruction

The HIPAA Privacy Rule requires covered entities to implement policies for the final disposition of PHI that renders it unreadable, indecipherable, and unable to be reconstructed. HHS guidance confirms that shredding, burning, pulping, or pulverizing paper records satisfies this standard. Physical shredding by an industrial plant — with documented chain of custody and a notarized Certificate of Destruction — is the accepted standard because it provides both the physical destruction and the documented proof of compliance that auditors require. Placing medical records in recycling bins, standard dumpsters, or passing them to an uncertified collection service does not satisfy HIPAA.

Massachusetts M.G.L. c. 111, §70 requires medical providers to retain adult patient records for at least seven years from the date of last treatment. Minor patient records must be retained until the patient reaches age 21, or for seven years from the date of last treatment — whichever period is longer. HIPAA separately requires covered entities to retain their HIPAA policies, procedures, and documentation for six years from creation or last effective date. Billing records should be retained for seven years given the Medicare and Medicaid fraud statute of limitations. Lab reports are subject to CLIA requirements of up to 10 years for cytology records. Once these periods are met, records should be destroyed — continued indefinite storage of PHI that should have been destroyed years ago creates ongoing breach liability without any compliance benefit. Our full Massachusetts document retention schedule covers all record types.

Yes — and we have one ready. The HIPAA Omnibus Rule requires covered entities to have a signed Business Associate Agreement in place before disclosing PHI to any business associate, including a shredding vendor. Our BAA documents our obligations as a business associate, our safeguards for PHI in our custody, our breach notification obligations, and our commitment to destroy PHI and not use it for any purpose other than the contracted destruction service. We provide signed BAAs on written request at no additional cost. Contact us at (978) 636-0301 or through our booking form and we will have a signed BAA to you before any PHI changes hands.

The HIPAA Security Rule (45 CFR §164.310(d)(2)(i)) requires covered entities to implement policies for the final disposal of electronic PHI and the hardware on which it is stored. NIST Special Publication 800-88 identifies physical Destroy — shredding or disintegration of the media — as the highest and most certain level of sanitization for ePHI. Software erasure is unreliable on solid-state drives due to wear-leveling and overprovisioning; deleted ePHI may remain recoverable in unmapped sectors. Physical destruction of the storage media with a serial-number Certificate of Destruction is the accepted HIPAA-compliant standard for all ePHI-containing hardware. We provide this for HDDs, SSDs, NVMe drives, server drives, backup tapes, USB drives, tablets, and mobile devices. See our full IT asset disposal service page for details.

Yes. We provide on-site pickup at hospitals, physician practices, dental offices, behavioral health facilities, and all other healthcare settings throughout Greater Boston, the Merrimack Valley, Essex County, Worcester County, MetroWest, and southern New Hampshire. Our CORI-checked drivers transport all PHI in locked vehicles under documented chain of custody from your facility to our certified Tewksbury plant. A signed intake receipt is provided at your facility before our driver departs. We accommodate both scheduled recurring service (with locked consoles at your location) and one-time or annual purge pickups. Call (978) 636-0301 to discuss your facility’s specific volume and scheduling needs.

HHS Office for Civil Rights enforces HIPAA and can impose civil monetary penalties ranging from $100 per violation for unknowing violations to $50,000 per violation for willful neglect. The maximum penalty is $1.9 million per calendar year for identical violations. Criminal penalties under HIPAA can reach $250,000 and 10 years imprisonment for the most serious offenses involving intent to sell PHI. OCR has settled numerous cases involving improper PHI disposal — including cases where patient records were found in dumpsters or sold to recycling companies — for amounts ranging from $10,000 to millions of dollars. Beyond federal penalties, Massachusetts M.G.L. c. 93H requires breach notification to the Attorney General and affected patients, and private plaintiffs may have civil claims under state law. Our guide to what documents should be shredded explains the broader disposal obligations beyond medical records specifically.

Yes. We handle all categories of behavioral health records, including psychotherapy notes, psychiatric treatment records, and substance use treatment records subject to the heightened federal protections of 42 CFR Part 2. These records carry additional confidentiality requirements beyond standard HIPAA, but the disposal standard is the same: physical shredding that renders them unreadable, indecipherable, and unable to be reconstructed, with a notarized Certificate of Destruction. Our staff treat all PHI with the same confidentiality protocols regardless of the record type. Our Business Associate Agreement covers all categories of PHI including behavioral health records.