Retiring Clinic Laptops Under HIPAA: Hospital ITAD Use Case
How a hospital system retired ePHI laptops and imaging workstations under HIPAA: BAA, chain of custody, verified NIST 800-88 wipes, one certificate per drive.
Healthcare IT asset disposition,with PHI destroyed and the paperwork handled.
One overlooked drive can become a reportable breach. Coretek 360 retires clinic workstations, imaging systems, and servers that held PHI, deinstalls retired medical devices, and takes the disposal paperwork off your privacy officer's desk.
Get a quoteHIPAA compliant ITAD for hospitals, clinics, and practices.
Every device that stored electronic PHI is identified and sanitized to NIST 800-88, the method HHS guidance points to, and the documentation the HIPAA Security Rule's device and media controls call for comes back to you ready to file.
Patient Data Inventory
We identify every device that stored electronic PHI. That covers nurse station PCs, clinic workstations, imaging modalities and PACS servers, copiers, tablets, phones, and medical devices with onboard storage.
- Workstations and servers
- Imaging systems and copiers
- Phones, tablets, and removable media
Medical Device Deinstallation
Retired medical devices and clinical equipment are deinstalled from patient care areas and removed under documented chain of custody. Onboard storage is identified before the device leaves the room. PHI is then sanitized to NIST 800-88 and documented by serial number, like every other asset.
- Deinstalled from clinical spaces
- Onboard storage identified first
- Chain of custody from the room to our floor
Secure Collection
Devices are collected from each facility in tracked vehicles under documented chain of custody. Where your policy requires it, drives are shredded on site so media holding PHI never leaves your building intact.
- Pickups at every facility
- On site shredding available
- Chain of custody documented throughout
Data Sanitization
Media that held PHI is wiped to NIST 800-88 and verified, or shredded. That is the sanitization method HHS guidance references for the Security Rule's disposal standard, and our handling is HIPAA compliant throughout. Shredding is done in house by Coretek 360. It is not yet covered by our R2v3 certificate, and we are actively working to add it.
- Wiped to NIST 800-88 and verified
- Shredded when media must not survive
- A certificate for every serial number
Remarketing & Recycling
Workstations, laptops, and servers with life left in them are refurbished and resold through our sales channels, once their media is sanitized, with the value returned to your organization. Everything else goes to R2v3 certified downstream processors, as a RIOS Certified Recycler.
- Working hardware refurbished and resold
- Value returned to you
- R2v3 certified downstream recycling
Audit Ready Reporting
A certificate of data destruction for every serial number and a final report go to your privacy officer, security officer, and compliance team. It is the disposal documentation an OCR audit or a breach investigation asks for.
- A certificate for every serial number
- Documentation for HIPAA audits
- Every device accounted for
Frequently asked questions.
Direct answers on the rules you answer to, the hardware we take, and the records you keep.
What does HIPAA require when disposing of devices that held PHI?
HIPAA requires a covered entity to apply safeguards to the final disposition of electronic PHI and the hardware it is stored on. HHS guidance points to the NIST 800-88 methods: clear, purge, or destroy. Coretek 360 sanitizes each device to NIST 800-88 and documents the work with a certificate of data destruction per serial number and a serialized asset report.
Do medical devices with onboard storage count?
Medical devices with onboard storage count whenever that storage held electronic PHI, so they need the same sanitization and documentation as a workstation or server. Coretek 360 deinstalls retired medical devices and clinical equipment from healthcare facilities under chain of custody. Any onboard storage is sanitized to NIST 800-88 and documented per serial number.
What documents does our privacy officer get?
Your privacy officer receives two documents from Coretek 360. A certificate of data destruction per serial number records the drive serial number, the NIST 800-88 method used, and the date. A serialized asset report records custody, make and model, sanitization method, and final disposition, resale or recycling, for every asset retired from your facilities.
Is shredding covered by your R2v3 certificate?
Shredding is not within the current scope of the Coretek 360 R2v3 certificate. Coretek 360 shreds drives in house, and the certificate covers the downstream recycling chain, logical data sanitization, and test and repair. Coretek 360 is working to add shredding to that scope. Wiping drives to NIST 800-88 is logical data sanitization, which the certificate does cover.
Will Coretek 360 sign a business associate agreement?
Yes. Coretek 360 signs business associate agreements with covered entities and with business associates retiring devices that held PHI. The agreement is in place before the first pickup, so your privacy officer has the contractual safeguard HIPAA expects alongside the certificates and the report that follow the work.
Can you work around clinic hours and patient care?
Yes. Pickups and deinstallations are scheduled around clinic hours, patient care areas, and facility access rules, so devices leave without interrupting care. Our team does the packing and removal, and your IT and facilities staff stay on their own work while the hardware moves under documented chain of custody.
What happens to the hardware after the PHI is destroyed?
Once a device's storage is sanitized to NIST 800-88 and verified, or shredded, the hardware is tested and resold through our sales channels where it still has value, and the value comes back to you. What cannot be reused is recycled through R2v3 certified downstream processors, and the final report records which path each asset took.
Can one engagement cover several hospitals and clinics?
Yes. A health system's hospitals, clinics, and administrative offices can be retired under one schedule and one point of contact. Each site gets the same pickup, the same sanitization, and the same documentation, and one report covers every location, so your privacy and compliance teams work from a single record.
Last reviewed on .
Retiring devices that held patient data?
Coretek 360 deinstalls them, destroys the PHI to NIST 800-88, and hands your privacy officer the HIPAA paperwork.
Newsroom
Twenty-Five Years in ITAD: Why Coretek Became Coretek 360
Coretek was founded in 2001, R2 certified in 2013 and renamed Coretek 360 in 2026. What changed in IT asset disposition in 25 years, and why the name changed.
Chain of Custody for Examiners: A Bank ITAD Use Case
How a bank retired teller workstations and branch servers with every asset documented from dock to disposition, and value returned, before its GLBA exam.
How to Recover Value from Retired IT Assets (2026 Guide)
Six steps to recover resale value from retired IT assets: inventory, NIST 800-88 sanitization, valuation, R2v3 partner selection, logistics and settlement.
NIST 800-88 Rev. 2 Explained: Clear, Purge, Destroy (2026)
What NIST 800-88 Rev. 2 requires: clear, purge and destroy defined, what changed in 2025, SSD and cryptographic erase rules, what a certificate must record.