HIPAA Handbooks

  • Privacy and security training for new and seasoned staff
  • 11 staff/setting focus areas
  • Education on protecting PHI
  • New HITECH Act changes
  • Discounts on bulk purchases



  • Role-based training using real-life case scenarios
  • Test-your-knowledge exercises with remediation
  • Post-course test to document staff participation


Other HIPAA Resources

  • Hot-topic audio conferences
  • Books on privacy and security
  • Newsletters
  • e-Newsletter
  • Videos



HIPAA Q&A: Disposing of PHI

Email This Post Print This Post


Submit your HIPAA questions to Editor Jaclyn Fitzgerald at jfitzgerald@hcpro.com and we will work with our experts to provide the information you need.

Q: I am concerned about whether my coworkers are properly disposing of paper documents that contain PHI. If data is shredded, is it acceptable for an organization to dispose of it in a dumpster? If not, can we hire a business associate to dispose of papers that contain PHI?

A: Shredding is appropriate if it is done with a cross-cut shredder. It may be hard to believe, but other types of shredders allow for putting the paper back together.

Remember, anything that contains PHI, (e.g., electronic media, prescription bottles, IV bags, copy machine drums, and printers) must be disposed of confidentially. Most organizations I have worked for hired business associates who come on-site to shred or burn information containing PHI. It is an investment that is well worth it, because OCR has imposed some significant fines upon organizations that left paper containing PHI in publicly accessible trash.

Editor’s note: Chris Simons, MS, RHIA, director of health information and privacy officer at Cheshire Medical Center/Dartmouth-Hitchcock in Keene, New Hampshire, answered this question for HCPro’s Medical Records Briefing. This information does not constitute legal advice. Consult legal counsel for answers t j o specific privacy and security questions.

Categories : HIPAA Q&A

Leave a Reply