12 ms·
I'm curious what evidence you provided, or were certified to provide, or even if that's required for medical data. Coming from the financial field we often had
by hnbear 3y ago
I'm curious what evidence you provided, or were certified to provide, or even if that's required for medical data.
Coming from the financial field we often had staff want to do fun and destructive things with data storage as part of decom, but regulators (eg. SEC) and auditors (eg. for SOC, PCI, etc) always want evidence and a custody trail.
In practice that means a certified vendor who'll maintain a good paper trail and provide back a certificate of destruction that means some NIST or similar type standard. Less fun, more paperwork, but less likely to cause trouble.
And it doesn't mean their destruction is any better either, just that the associated red tape is.
- kps 3y agoNo documentation or particular methods required. I think that https://www.hhs.gov/sites/default/files/disposalfaqs.pdf https://www.hhs.gov/sites/default/files/disposalfaqs.pdf is equivalent to the guidance at the time, and it just requires ‘reasonable safeguards’. > For PHI on electronic media, clearing (using software or hardware products to overwrite media with non-sensitive data), purging (degaussing or exposing the media to a strong magnetic field in order to disrupt the recorded magnetic domains), or destroying the media (disintegration, pulverization, melting, incinerating, or shredding).