
Retiring Clinic Laptops Under HIPAA: Hospital ITAD Use Case
How a hospital system retired ePHI laptops and imaging workstations under HIPAA: BAA, chain of custody, verified NIST 800-88 wipes, one certificate per drive.
Coretek 360 wipes drives to NIST 800-88 or shreds them, on site or at our facility, by our own team, and gives you a certificate of destruction for every drive.
Get a quoteHard drives, SSDs, phones, tapes, and other media are wiped to NIST 800-88 or destroyed, on site or at our facility, with a certificate for every drive. This is not the full list, so ask about anything you do not see.
Drives that can be reused are sanitized with the NIST 800-88 Clear or Purge method suited to the media, then verified before release. Logical data sanitization is within the scope of our R2v3 certification.
Solid state drives and flash media need different handling than spinning disks. We use the NIST 800-88 method suited to each, such as cryptographic erase, and verify the result. Any drive that fails verification is shredded instead.
Media that must not survive is shredded, the Destroy method in NIST 800-88, so no data can be recovered from it. Each drive's serial number is logged before it is destroyed.
Hard drive shredding is performed in house by Coretek 360 and is not yet covered by our R2v3 certificate, which covers data sanitization, test and repair, and the downstream recycling chain. We are actively working to add it.
When policy says media cannot leave the building intact, we destroy it at your location. Drives are logged by serial number and shredded on site, so they never leave whole.
On site shredding is performed in house by Coretek 360 and is not yet covered by our R2v3 certificate, which covers data sanitization, test and repair, and the downstream recycling chain. We are actively working to add it.
Data lives on more than drives. We identify every data bearing device in scope, including phones, tablets, backup tapes, and other storage media, and choose the right NIST 800-88 method for each based on media type and the regulations your data falls under.
Physical destruction of media is performed in house by Coretek 360 and is not yet covered by our R2v3 certificate, which covers data sanitization, test and repair, and the downstream recycling chain. We are actively working to add it.
Media is collected in tracked vehicles and kept under documented chain of custody. Before any media is touched, each drive's serial number is scanned and logged, so every certificate traces back to a specific device on your inventory.
You receive a certificate of data destruction tied to the serial number of every drive, with the NIST 800-88 method used and the date, ready for auditors under HIPAA, GLBA, PCI DSS, or whichever rules you answer to.
Direct answers on wiping, shredding, on site destruction, and certificates.
Drives are wiped to NIST 800-88 and verified before any reuse, or physically shredded when the media must not survive. Wiping uses the Clear or Purge method suited to the media, and shredding is the Destroy method. Both end with a certificate of destruction tied to the drive's serial number, issued by Coretek 360.
NIST 800-88 defines three sanitization methods. Clear overwrites the media with standard commands so data cannot be recovered with ordinary tools. Purge uses stronger techniques, such as cryptographic erase, so data cannot be recovered even with laboratory methods. Destroy makes the media physically unusable, which is the shredding path. Coretek 360 records the method used for every serial number.
A certificate of data destruction from Coretek 360 records the drive's serial number, the NIST 800-88 method used, and the date. One certificate is issued for every serial number, and the certificates are filed with the serialized asset report that reconciles every drive against your inventory, so an auditor can trace each certificate to a specific device.
Wiping to NIST 800-88 keeps a drive usable and recovers its resale value. Shredding suits failed drives and media that policy says must be destroyed outright. We can plan a mix across your fleet, and any drive that fails wipe verification is shredded instead. Either way, each drive gets a certificate of destruction that records the method.
Yes. With on site data destruction, drives are shredded at your location and never leave it whole. Each drive's serial number is scanned and logged before destruction, so the certificate of destruction still traces to a specific device. Shredded material then goes to R2v3 certified downstream processors and is documented through final disposition.
Sanitization follows NIST 800-88, the media sanitization guideline most auditors and compliance teams ask for, using its Clear, Purge, and Destroy methods. Coretek 360 is NIST 800-88 compliant and HIPAA compliant, and destroyed media is recycled through R2v3 certified downstream processors. These are the standards behind every certificate of destruction we issue.
Drives that pass NIST 800-88 verification can be reused or resold, and the value comes back to you. Working hardware is refurbished and sold through our sales channels, with the return itemized by serial number in your report. A certificate of destruction still issues for each wiped drive, recording the method used.
Shredded material goes to R2v3 certified downstream processors and is documented through final disposition. Shredding itself is performed in house by Coretek 360 and is not yet within the scope of our R2v3 certificate, which covers logical data sanitization and test and repair. We are actively working to add physical destruction to that scope. The serialized report lists each shredded drive by serial number with its certificate of destruction.
Last reviewed on .
Get every drive destroyed by our own team, on site or at our facility, with a certificate for each.

How a hospital system retired ePHI laptops and imaging workstations under HIPAA: BAA, chain of custody, verified NIST 800-88 wipes, one certificate per drive.

Coretek was founded in 2001, R2 certified in 2013 and renamed Coretek 360 in 2026. What changed in IT asset disposition in 25 years, and why the name changed.

How a bank retired teller workstations and branch servers with every asset documented from dock to disposition, and value returned, before its GLBA exam.

Six steps to recover resale value from retired IT assets: inventory, NIST 800-88 sanitization, valuation, R2v3 partner selection, logistics and settlement.

What NIST 800-88 Rev. 2 requires: clear, purge and destroy defined, what changed in 2025, SSD and cryptographic erase rules, what a certificate must record.