Submit your HIPAA questions to Edito r John Castelluccio at firstname.lastname@example.org  and we will work with our experts to provide the information you need.
Q: Do healthcare organizations need to log all documents before shredding? I have my staff log all documents that were scanned and indexed before they are placed in the bin for shredding. Once I receive the certificate of destruction, we match the log sheets with the certificate of destruction for documentation purposes. Once matched with our log sheets, the certificates of destruction are kept in log books. This is done with the anticipation of court appearance. I will need to produce policies and procedures for certificates of destruction.
A: If these documents have been scanned and indexed into your electronic medical record (EMR), your legal medical record is your electronic record. When you have completed reasonable quality checks to ensure the scanned documents are legible and indexed to the correct patient record, you may destroy the original paper documents. There is no need to log them and obtain certificates of destruction. If you receive a subpoena or a court order, you will produce the requested information from your EMR.
Editor’s note: Mary Brandt, MBA, RHIA, CHE, CHPS, vice president of health information, Central Texas Division, Baylor Scott & White Health in Temple, Texas, answered this question for HCPro’s Briefings on HIPAA .  This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions.