
Retiring Clinic Laptops Under HIPAA: Hospital ITAD Use Case
How a hospital system retired ePHI laptops and imaging workstations under HIPAA: BAA, chain of custody, verified NIST 800-88 wipes, one certificate per drive.
Your auditor will ask what happened to every retired laptop. Coretek 360 retires employee laptops, test servers, and lab racks on your schedule, with code, credentials, and customer data destroyed to NIST 800-88.
Get a quoteLaptops and servers are collected on a steady schedule, wiped to NIST 800-88, and resold for value where they still have it. Your GRC lead can answer the media disposal criteria in SOC 2, ISO 27001, and customer security questionnaires.
We plan refresh cycles and offboarding returns with your IT and people ops teams. Retired laptops, monitors, phones, and dev servers leave on a steady schedule as headcount changes.
Laptops and servers are collected from your offices in tracked vehicles under documented chain of custody, on recurring or one time pickups.
Every drive is wiped to NIST 800-88 and verified, or shredded, so no source code, credentials, or customer personal data survive to create a GDPR or CCPA exposure. Shredding is done in house by Coretek 360. It is not yet covered by our R2v3 certificate, and we are actively working to add it.
Recent laptops, monitors, and servers often still have resale value. They are refurbished and resold through our sales channels, with the value returned to you. Everything else goes to R2v3 certified downstream processors, as a RIOS Certified Recycler.
A certificate of data destruction for every serial number and a final report give your security and GRC team the disposal evidence SOC 2 auditors, ISO 27001 assessors, and enterprise customers ask for.
Direct answers on the rules you answer to, the hardware we take, and the records you keep.
SOC 2 and ISO 27001 both include media disposal criteria that your company answers for, and customer security questionnaires ask about the same thing. Coretek 360 wipes every drive to NIST 800-88 and verifies it, or shreds it, then documents each device by serial number so your GRC lead can show what happened to it.
Technology and SaaS companies typically retire hardware such as employee laptops, monitors, phones, dev and test servers, lab racks, and more. Coretek 360 takes all of it in the same program. Recent laptops, monitors, and servers often still have resale value, so they are refurbished and resold, with the value returned to you.
Disposal evidence for a SOC 2 auditor or ISO 27001 assessor comes as two documents from Coretek 360. One is a certificate of data destruction per serial number, recording the drive serial number, the NIST 800-88 method used, and the date. The other is a serialized asset report covering custody, make and model, sanitization method, and final disposition, resale or recycling, for every asset.
Laptops returned at offboarding are planned with your IT and people ops teams alongside your regular refresh cycles. Coretek 360 collects retired hardware from your offices on recurring or one time pickups, in tracked vehicles under documented chain of custody, so devices leave on a steady schedule as your headcount changes.
Yes. Laptops, phones, and servers with life left in them are tested, refurbished, and resold through our sales channels after their drives are wiped to NIST 800-88, and the value comes back to you, itemized in the report. For a fast growing fleet that is money back into the next refresh rather than a closet of old devices.
Offices in different cities are retired under one schedule and one point of contact. Coretek 360 collects from each location in tracked vehicles under documented chain of custody, and one report covers every office, so your security team answers a customer questionnaire from a single record.
Customer security questionnaires ask how retired media is handled, and the answer is the same evidence your SOC 2 auditor sees: sanitization to NIST 800-88 or shredding, a certificate of data destruction per serial number, and a final report. You can attach them to the questionnaire instead of describing the process.
Fleets of any size are retired, from one device to a company wide refresh. Smaller pickups can be grouped with your refresh cycles or offboarding returns, so devices do not pile up. Each one is still sanitized to NIST 800-88 or shredded, resold or recycled, and documented in the same certificate and report.
Last reviewed on .
Coretek 360 destroys the data, recovers the value, and hands your GRC lead the disposal evidence.

How a hospital system retired ePHI laptops and imaging workstations under HIPAA: BAA, chain of custody, verified NIST 800-88 wipes, one certificate per drive.

Coretek was founded in 2001, R2 certified in 2013 and renamed Coretek 360 in 2026. What changed in IT asset disposition in 25 years, and why the name changed.

How a bank retired teller workstations and branch servers with every asset documented from dock to disposition, and value returned, before its GLBA exam.

Six steps to recover resale value from retired IT assets: inventory, NIST 800-88 sanitization, valuation, R2v3 partner selection, logistics and settlement.

What NIST 800-88 Rev. 2 requires: clear, purge and destroy defined, what changed in 2025, SSD and cryptographic erase rules, what a certificate must record.