A Guide to PHI Disposal Policies for Gut Microbiome Testing Companies

Gut microbiome testing can involve a mix of sensitive information: orders, sample labels, test results, account details, and communications with customers or clinicians. If that information is protected health information (PHI) under HIPAA, your company needs a reliable way to protect it through disposal—not just while it is in active use.

A sound policy identifies which records and media contain PHI, assigns responsibility for disposal, sets secure procedures for paper and electronic materials, and documents completion. First determine whether HIPAA applies to your company; then tailor the disposal process to the information, equipment, and risks involved.

Does HIPAA apply to your gut microbiome testing company?

Selling a gut microbiome test does not automatically make a company subject to HIPAA. HIPAA applies to covered entities—health plans, health care clearinghouses, and certain health care providers—and to business associates performing specified services for covered entities. A provider generally falls within HIPAA’s covered-entity definition when it conducts certain standard electronic transactions, such as electronic billing. The HHS overview of covered entities and business associates explains these categories.

A direct-to-consumer testing company that operates independently may not be a HIPAA covered entity merely because it collects health-related test information. But the analysis can change if the company provides health care and conducts covered electronic transactions, or if it handles PHI on behalf of a covered entity. For example, a lab or technology provider that performs services for a clinic and creates, receives, maintains, or transmits PHI in that role may be a business associate. Check the company’s actual services, transactions, and relationships rather than relying on its product label.

HIPAA applies to PHI in different forms, so disposal planning should consider paper records and physical items as well as electronic protected health information (ePHI). Depending on the context, records to assess may include orders, reports, shipping documents, sample labels, and data that links a customer’s identity to a result. The HHS guidance on PHI disposal describes safeguards for PHI in any form.

What safeguards should a PHI disposal policy require?

A disposal policy should establish who may dispose of PHI, which disposal methods are permitted, how materials are secured before destruction, and how the company confirms that disposal is complete. HIPAA does not prescribe one method for every situation. Covered entities must use reasonable safeguards, and the appropriate approach depends on the circumstances. See 45 CFR § 164.530 and the HHS disposal guidance.

Set clear administrative, technical, and physical safeguards. For example, assign an accountable policy owner; limit disposal tasks to trained, authorized staff; keep PHI in secure holding areas; and use access controls for systems and equipment that contain ePHI. The policy can also require staff to stop and report a missed pickup, unsecured container, failed sanitization, or other suspected exposure.

Train workforce members according to their roles, including staff who prepare materials for destruction or oversee a vendor. HIPAA requires covered entities to provide workforce training as necessary and appropriate for employees’ functions; it does not make an annual training certificate a universal federal disposal requirement. See 45 CFR § 164.530(b).

Keep a disposal record that helps you demonstrate the process without unnecessarily reproducing PHI. Depending on the method, the record might identify the date, material category, responsible employee, equipment or vendor, destruction method, and confirmation that the process was completed. Set a retention period for these records under your own policies and applicable requirements.

How should paper records and labeled items containing PHI be destroyed?

Identify paper and physical items that may reveal PHI, such as printed test reports, order forms, shipping manifests, accession sheets, misprinted labels, and documents linking a sample identifier to a person. Secure these materials from the point they are discarded until they are destroyed. Use a locked container or restricted staging area so staff, visitors, and members of the public cannot retrieve them.

Do not place identifiable PHI in a dumpster or other container that is accessible to the public or unauthorized people. HHS describes examples of appropriate methods for paper PHI as shredding, burning, pulping, or pulverizing the records until the information is essentially unreadable, indecipherable, and not reconstructable. Select a method that fits the information and the practical risks of the disposal process.

For labeled tubes, packaging, or other items, treat the label and any associated paperwork as potential PHI when they link a sample or result to an individual. Ensure that identifiers are destroyed or rendered unreadable, and keep items secured until the approved method is complete. If an item also requires separate handling for laboratory or waste-safety reasons, coordinate that process with your applicable procedures rather than assuming privacy destruction addresses every requirement.

How should companies dispose of or reuse electronic media containing ePHI?

Inventory the devices and media that may store ePHI, including computers, removable drives, servers, laboratory equipment, and devices being returned, repaired, transferred, or retired. HIPAA requires covered entities and business associates to have procedures for the final disposition of ePHI and the hardware or electronic media on which it is stored. It also requires removal of ePHI from media before reuse. See 45 CFR § 164.310(d).

Choose a media sanitization or destruction method based on the device, the storage technology, the sensitivity of the information, and whether the media will be reused or discarded. HHS describes examples such as clearing, purging, or destroying electronic media; its guidance also cautions that the method should reasonably protect the information in the circumstances. For current program guidance, consult NIST Special Publication 800-88 Revision 2, Guidelines for Media Sanitization.

Do not assume that deleting files or performing a routine factory reset is sufficient for every device. Establish procedures for verifying that the selected method was completed, recording the disposition, and escalating failures or equipment that cannot be sanitized as planned. If you are using a service provider to sanitize or destroy media, include that process in the vendor’s documented scope and confirmation.

Address copies of ePHI as well as the original device. Your workflow may need to account for backups, shared storage, exported files, and systems managed by service providers. Define who is responsible for removing those copies, how you confirm removal or the end of retention, and what to do when a copy cannot feasibly be deleted at once. For business associate relationships, termination provisions must address return or destruction of PHI where feasible and continued protections where it is not feasible. See 45 CFR § 164.504(e)(2).

What should a disposal vendor agreement include?

A company can hire a vendor to handle PHI disposal, but outsourcing the task does not remove the need to protect the information. If a vendor performs a service on behalf of a covered entity that involves PHI, the vendor may be a business associate and a written business associate agreement (BAA) may be required. HHS’s business associate guidance explains when that relationship arises.

For a covered entity’s BAA with a business associate, HIPAA requires contract terms covering permitted uses and disclosures, appropriate safeguards, reporting of impermissible uses or disclosures, and applicable subcontractor obligations. The contract must also address return or destruction of PHI at termination when feasible, or continued protections and limits on use when return or destruction is infeasible. See 45 CFR § 164.504(e).

For a disposal arrangement, specify the vendor’s responsibilities in practical terms: which materials it may collect, how they must be secured during pickup and transport, what destruction or sanitization methods it will use, and how it will confirm completion. You may also set expectations for pickup schedules, incident notification, access restrictions, subcontractors, recordkeeping, and handling rejected or failed loads. These are useful contract controls to consider; their details should be tailored to the service and the applicable legal requirements.

Ask for a completion record or certificate that identifies the relevant service or batch and the method used, without exposing unnecessary PHI. Establish how your team will review vendor performance, raise concerns, and suspend pickups if agreed safeguards are not being followed. Confirm that the vendor’s contract and any required BAA match the actual workflow, including any subcontractors that handle PHI.

How can disposal procedures be tailored to privacy risks?

Start with a risk assessment of the information and the disposal path. Consider the form, type, and amount of PHI, how readily a person could connect a sample or result to an individual, who could access materials in storage or transit, and what could happen if the information were exposed. HHS specifically advises covered entities to consider the risks to privacy and the form, type, and amount of information when selecting reasonable disposal safeguards. See the HHS disposal guidance.

Then map the disposal process from creation to final disposition. Include ordinary records and less obvious items such as spoiled labels, test reruns, discarded printouts, returned devices, and materials held for vendor pickup. For each category, identify the approved method, responsible role, secure holding location, required documentation, and response if the expected method fails.

Apply stronger controls where the information or circumstances create greater risk. For example, a batch of labeled samples or records that directly links a person to test results may warrant tighter access and more controlled destruction than a document that contains no identifiers. Revisit the policy when your testing workflow, storage systems, vendors, or media types change, and confirm that written procedures match what staff actually do.

In short, a reliable PHI disposal policy begins by determining whether HIPAA applies, then matches safeguards to the records, items, and electronic media your company handles. Secure storage, appropriate destruction or sanitization, trained staff, accountable vendors, and clear documentation help protect PHI through its final disposition.

FAQs

Does selling a gut microbiome test automatically make a company subject to HIPAA?

No. Selling a test alone does not automatically make a company a HIPAA covered entity. HIPAA status depends on whether the organization meets the definition of a covered entity or business associate, including the nature of its health care services, covered electronic transactions, and relationships with covered entities. Review the company’s actual operations and contracts.

Can PHI be placed in publicly accessible trash?

No. Covered entities should not abandon PHI or place it in a dumpster or other container accessible to the public or unauthorized people. Secure it until an appropriate disposal method, such as shredding or another method that makes the information unreadable and unreconstructable, is completed.

How should electronic media be handled before reuse?

Remove ePHI using a sanitization method appropriate for the media and the information’s sensitivity before making the media available for reuse. Document the process and address any failure rather than assuming that ordinary file deletion or a reset is sufficient.

Can a company hire a vendor to dispose of PHI?

Yes. A company may use a disposal vendor, but it should secure the PHI until destruction and clearly define the vendor’s handling, transport, destruction, and confirmation procedures. When the vendor is a business associate, use the required written business associate arrangement and ensure applicable subcontractors are covered.