Submit your HIPAA questions to Editor Jaclyn Fitzgerald at firstname.lastname@example.org  and we will work with our experts to provide the information you need.
Q: I am concerned about whether my coworkers are properly disposing of paper documents that contain PHI. If data is shredded, is it acceptable for an organization to dispose of it in a dumpster? If not, can we hire a business associate to dispose of papers that contain PHI?
A: Shredding is appropriate if it is done with a cross-cut shredder. It may be hard to believe, but other types of shredders allow for putting the paper back together.
Remember, anything that contains PHI, (e.g., electronic media, prescription bottles, IV bags, copy machine drums, and printers) must be disposed of confidentially. Most organizations I have worked for hired business associates who come on-site to shred or burn information containing PHI. It is an investment that is well worth it, because OCR has imposed some significant fines upon organizations that left paper containing PHI in publicly accessible trash.
Editor’s note: Chris Simons, MS, RHIA, director of health information and privacy officer at Cheshire Medical Center/Dartmouth-Hitchcock in Keene, New Hampshire, answered this question for HCPro’s Medical Records Briefing.  This information does not constitute legal advice. Consult legal counsel for answers t j o specific privacy and security questions.