Privacy Rule
No disclosure at disposal
PHI may not be disclosed through careless disposal. A drive, phone, or copier that leaves a facility with patient data still readable is an impermissible disclosure, whoever ends up with it.
HIPAA compliantIT asset disposition
Retire devices that held protected health information without the headache: we handle the pickup, the sanitization, and the paperwork your privacy officer asks for, so the disposal is compliant and off your plate.
Talk to an expertWhat HIPAA is
The law and who it covers
The Health Insurance Portability and Accountability Act of 1996 is the United States law that governs how protected health information is kept private and secure. The Department of Health and Human Services administers it, and its Office for Civil Rights enforces it. It applies to covered entities, meaning health plans, healthcare clearinghouses, and providers that bill electronically, and to the business associates that handle protected health information (PHI) on their behalf. PHI is any health information that can identify a patient, from a chart to a billing record to the cache on a retired workstation.
The three rules that reach disposal
The Privacy Rule requires safeguards against any impermissible use or disclosure of PHI, including at disposal. The Security Rule sets device and media controls for electronic PHI, which require a covered entity to address the final disposition of hardware and to remove electronic PHI from media before the media is reused. The Breach Notification Rule requires notice to patients and to HHS when unsecured PHI is exposed, and HHS's guidance on what counts as secured points to NIST Special Publication 800-88 for media that has been cleared, purged, or destroyed.
No certification, only proof
HIPAA has no certification program. No agency certifies a vendor as HIPAA compliant, so a seal on its own proves nothing. What a compliance reviewer can check is whether the vendor's process meets the rules and whether the documentation shows it did, device by device. That is how Coretek 360 approaches it: a NIST 800-88 method for every drive, a chain of custody by serial number, and a record for every device.
- Regulation
- Health Insurance Portability and Accountability Act of 1996
- Regulator
- Department of Health and Human Services, Office for Civil Rights
- Rules that apply to disposal
- Privacy Rule, Security Rule, and Breach Notification Rule
- Sanitization standard we follow
- NIST Special Publication 800-88
- Proof per device
- Certificate of data destruction per serial number and a serialized asset report
- Facility
- Concord, North Carolina
HIPAA is a law rather than a certification, so there is no certificate number to look up. Our R2v3 and RIOS certificates, which cover the audited processes behind this work, can each be verified in their public directories.
What HIPAA requires when hardware is retired
Each rule asks a different question of the device leaving your building.
Security Rule
Device and media controls
Covered entities must address the final disposition of hardware that holds electronic PHI and remove that PHI before any media is reused. Both call for a documented procedure, not an assumption that a wipe happened.
Breach Notification Rule
Secured or exposed
PHI on lost or mishandled media is a reportable breach unless it was secured. HHS's guidance treats media sanitized to NIST 800-88 as secured, which is why the method on every certificate matters.
How Coretek 360 keeps disposal HIPAA compliant
We meet the rules so you do not have to manage them, and the records to prove it come with the job.
Sanitized to NIST 800-88
Every drive that held PHI is cleared or purged to NIST 800-88 and verified, or shredded when policy says it must not survive. Any drive that fails verification is shredded. The method used is recorded for that serial number. Shredding is performed in house and is not yet within our R2v3 certificate scope, which we are working to add.
Chain of custody by serial number
Assets are logged by serial number at your dock, moved in tracked vehicles, and recorded at every handoff through sanitization and final disposition. Devices that cannot leave intact are shredded on site.
Documentation your auditors can check
You receive a certificate of data destruction for every serial number and a serialized asset report that reconciles each device against your inventory. It is the record a HIPAA audit or a breach investigation asks for.
Frequently asked questions about HIPAA
What compliance and privacy officers ask before retiring devices that held patient data.
What is HIPAA?
HIPAA, the Health Insurance Portability and Accountability Act of 1996, is the United States law that governs the privacy and security of protected health information. The Department of Health and Human Services administers it and its Office for Civil Rights enforces it. Its Privacy Rule, Security Rule, and Breach Notification Rule set what covered entities and their business associates must do to keep PHI private, secure, and accounted for.
Is Coretek 360 HIPAA compliant?
Yes. Our handling of devices that held protected health information is HIPAA compliant, and we run the whole disposal so your team does not have to manage it. Drives are sanitized to NIST 800-88 or shredded, every device is tracked by serial number under a documented chain of custody, and you receive a certificate of data destruction per serial number with a serialized asset report. HIPAA has no certification program, so the proof is in that process and that documentation rather than a seal.
Is there a HIPAA certification?
No. Neither HHS nor any other agency certifies a vendor as HIPAA compliant, and a HIPAA badge on its own is not proof of anything. What a reviewer can verify is the process and the records. Coretek 360 pairs HIPAA compliant handling with two certifications that are independently audited, R2v3 and RIOS, each of which can be checked in its public directory.
What does HIPAA say about disposing of devices?
The Security Rule's device and media controls require a covered entity to address the final disposition of hardware and media that hold electronic PHI, and to remove electronic PHI before media is reused. The Privacy Rule requires safeguards so that PHI is not disclosed through disposal. HHS's breach guidance treats media sanitized to NIST 800-88 as secured, which is the standard Coretek 360 works to.
Wipe or shred for PHI?
Either meets HIPAA when done to NIST 800-88 and documented. Wiping with the Clear or Purge method keeps a drive usable and recovers its value, and every wipe is verified. Shredding, the Destroy method, suits failed drives and media your policy says must not survive. Any drive that fails wipe verification is shredded, and each drive's certificate records which method was used.
Can devices be destroyed before they leave our building?
Yes. With on site data destruction, drives are logged by serial number and shredded at your location, so no PHI leaves intact. Shredded material then goes to R2v3 certified downstream processors and is documented through final disposition. Shredding is performed in house and is not yet within our R2v3 certificate scope, which we are working to add.
What documentation do we receive?
A certificate of data destruction for every serial number, recording the NIST 800-88 method used and the date, and a serialized asset report that records custody, sanitization, and final disposition for every device and reconciles it against your inventory. Together they give a HIPAA audit or a breach investigation a per device record rather than a summary letter.
Will Coretek 360 sign a business associate agreement?
Yes. When a covered entity or business associate retires devices that held protected health information, Coretek 360 signs a business associate agreement that sets out how the data is handled and destroyed. Send us yours with your request or ask for ours during planning. The serialized asset report and the certificate of data destruction per serial number then become the record of that destruction.
Last reviewed on .
Related resources
Healthcare ITAD, how PHI is destroyed, and the standards and certifications behind it.
Healthcare
PHI destroyed to standard, with the paperwork your privacy officer needs.
Data Destruction
Drives wiped to NIST 800-88 or shredded, with a certificate for each.
NIST 800-88 compliance
The media sanitization guideline behind every certificate we issue.
R2v3 certification
Certificate C0177760-R26, what it covers, and how to verify it.
Certifications
R2v3, RIOS, NIST 800-88, and HIPAA, and what each one covers.
Retiring devices that held patient data?
Tell us what your privacy officer needs and we will plan the pickup, the sanitization method, and the documentation around it.
Newsroom
Retiring Clinic Laptops Under HIPAA: Hospital ITAD Use Case
How a hospital system retired ePHI laptops and imaging workstations under HIPAA: BAA, chain of custody, verified NIST 800-88 wipes, one certificate per drive.
Twenty-Five Years in ITAD: Why Coretek Became Coretek 360
Coretek was founded in 2001, R2 certified in 2013 and renamed Coretek 360 in 2026. What changed in IT asset disposition in 25 years, and why the name changed.
Chain of Custody for Examiners: A Bank ITAD Use Case
How a bank retired teller workstations and branch servers with every asset documented from dock to disposition, and value returned, before its GLBA exam.
How to Recover Value from Retired IT Assets (2026 Guide)
Six steps to recover resale value from retired IT assets: inventory, NIST 800-88 sanitization, valuation, R2v3 partner selection, logistics and settlement.
NIST 800-88 Rev. 2 Explained: Clear, Purge, Destroy (2026)
What NIST 800-88 Rev. 2 requires: clear, purge and destroy defined, what changed in 2025, SSD and cryptographic erase rules, what a certificate must record.