HIPAA-Compliant Copier Hard Drive Sanitization Policy Template for County Health Departments

What copier hard drives and ePHI does the policy cover?

This template applies to county health department personnel and contractors who manage, service, move, reuse, return, recycle, or dispose of copiers and multifunction printers that may store electronic protected health information (ePHI). The department’s Privacy Officer, Security Officer, records-management staff, and legal counsel should adapt it to the department’s systems, contracts, applicable state and local requirements, and records schedules before adoption.

For units subject to the HIPAA Security Rule, the department shall identify and inventory copier storage media and control their movement and final disposition. HIPAA requires policies and procedures for device and media controls, final disposition, and removing ePHI before media reuse; it also includes an addressable specification for recording media movement and the person responsible. See 45 CFR § 164.310.

Depending on the model, installed options, configuration, and use, a copier may store document images, print or scan job data, fax data, address-book information, or other records. The inventory shall therefore cover each device’s hard disk drive, solid-state drive or other flash storage, removable media, and any other installed storage component that could hold ePHI. Staff shall consult device documentation and the department’s configuration records rather than assume that a particular copier has—or lacks—storage.

The department shall also identify ePHI held in connected systems, such as scan destinations or print-management systems, so that device sanitization is not mistaken for deletion from those separate systems. The HHS guidance on business associates specifically identifies certain technicians servicing electronic devices that store PHI, including copiers, as business associates when the contracted service involves disclosure of PHI to the technician.

How should the department select a sanitization method for each drive?

Before sanitization, the responsible staff member shall record the media type, device and asset identifiers, whether ePHI may be present, intended disposition, and whether the drive will remain under department control. The Privacy Officer or Security Officer shall approve a method appropriate to the information’s confidentiality, the storage technology, the planned reuse or disposal, and the risks of disclosure. HIPAA requires appropriate policies and procedures; it does not prescribe one universal copier-drive sanitization technique.

The department shall use the current, approved procedure for the specific storage technology and consult manufacturer instructions and applicable technical standards. As technical guidance, NIST Special Publication 800-88 Revision 2 describes sanitization methods and a risk-based decision process. NIST guidance is not itself a HIPAA requirement.

• Clear: Consider for approved reuse within the department’s controlled environment only when the selected technique is suitable for the drive and the department’s documented risk assessment accepts that level of protection. A reset or deletion command shall not be presumed sufficient without checking what the device’s procedure actually does.
• Purge: Consider when a reusable drive will leave the department’s direct control, or when stronger protection is warranted and a validated, compatible method is available. NIST describes purge as making recovery infeasible using state-of-the-art laboratory techniques while potentially preserving the media for reuse.
• Destroy: Use when the drive will not be reused, when it is damaged or unsupported, or when a suitable clear or purge method cannot be applied and validated. Destruction must make the drive unusable for storage and render recovery infeasible under the applicable standard.

Methods must match the media. For example, NIST SP 800-88 Revision 2 cautions that degaussing is not suitable for non-magnetic storage such as SSDs and may fail to sanitize some magnetic drives if the equipment is not appropriate. The department shall not require obsolete multi-pass overwrite patterns by default; NIST notes that such practices may provide little protection for some media. If the approved method fails or produces errors, staff shall stop release or reuse and repeat sanitization using a suitable alternative or escalate to destruction.

When should drives be cleared, purged, or destroyed?

Staff shall sanitize or arrange secure destruction before a copier or its storage media is reused, transferred outside the department, returned to a lessor, sold, donated, recycled, or otherwise disposed of. HHS confirms that ePHI must be removed before electronic media are reused or disposed of, unless the media itself is destroyed. See the HHS guidance on reuse and disposal of electronic media.

The department shall also assess sanitization when a drive or storage component is replaced, sent for repair, or handled by a vendor. If the planned service may expose ePHI, staff shall either sanitize the media first when operationally appropriate or maintain the safeguards, access controls, and contractual protections required for that service. Before sanitizing, staff shall confirm that any needed records or retrievable copies have been preserved under department procedures and applicable retention requirements.

As a policy default, consider clear only for approved, risk-assessed reuse within department control; consider purge for reuse outside that control when a suitable method is available; and destroy media that is retired or cannot be reliably sanitized. The department’s Security Officer may approve a different method based on a documented assessment of the media, data, and disposition. NIST’s current sanitization guidance likewise emphasizes the confidentiality of the information, media type, reuse plans, and control of the media when selecting a method.

How can staff verify that ePHI is inaccessible and unretrievable?

The staff member or vendor performing sanitization shall verify that the approved operation completed successfully. For software- or command-based methods, the verifier shall review completion status, tool output, errors, anomalies, and drive health. For physical destruction, the verifier shall inspect the resulting media or destruction evidence and confirm that the method used was appropriate for the drive.

A designated reviewer shall validate whether the verification results are acceptable for the data’s confidentiality and the planned disposition. If the process fails, leaves uncertainty, or is not appropriate for the media, the reviewer shall reject the result, keep the drive under controlled access, and require a suitable repeat method or destruction. NIST distinguishes verification of the operation’s outcome from validation of whether the result sufficiently protects the data; see NIST SP 800-88 Revision 2.

Validation does not necessarily require attempting forensic recovery or examining every location on every drive. NIST states that elaborate sampling after clear or logical purge is not necessary unless organizational policy requires it. The department shall follow its approved verification and validation procedure and record any limitations, exceptions, or escalation decisions.

What records should document sanitization and destruction?

For each sanitization or destruction event, staff shall create a record that allows the department to identify the media, the method used, the result, and the person accountable. The record should include:

• Copier make, model, serial number, department asset or property number, location, and media type or identifier.
• Date and time, reason for the action, intended disposition, and whether the media may have contained ePHI.
• Sanitization method and technique, tool or equipment name and version where applicable, and relevant settings or method references.
• Name and role of the person performing the work, verifier and reviewer, completion status, validation decision, and any errors, exceptions, or corrective action.
• Final destination, such as approved internal reuse, external transfer, return to lessor, recycling, or destruction, with any vendor certificate or supporting evidence.
• Movement and chain-of-custody details, including transfer dates, locations, responsible persons, and vendor handoffs.

Records should identify ePHI status or category without reproducing patient information unnecessarily. NIST provides a sample certificate with fields for media identification, method, tools, verification, validation, destination, and signatures in Appendix C of SP 800-88 Revision 2.

The department shall retain its Security Rule policies and documentation for the required period: six years from creation or from the date the documentation was last in effect, whichever is later. Other county, state, contractual, or records-management rules may require a longer period. See the HHS summary of the HIPAA Security Rule documentation requirements.

How should the department control copier transfers and vendor handling?

The department shall control and document copier and media movement into, out of, and within its facilities. Before equipment moves, staff shall identify the device and media, authorize the transfer, protect the equipment against unauthorized access, and record the person responsible at each handoff. When needed, staff shall create a retrievable, exact copy of ePHI before moving equipment, consistent with the Security Rule’s addressable data-backup specification.

Before engaging a service, transport, recycling, or destruction vendor, the department shall determine whether the vendor’s actual duties make it a business associate. When the HIPAA Rules require a business associate agreement (BAA), the agreement shall require appropriate safeguards for PHI through servicing, transport, sanitization, and disposal; address subcontractors and security-incident reporting; and specify the permitted work, custody controls, and evidence the vendor must return. HHS explains that a covered entity may use a business associate for disposal but must have an agreement requiring appropriate safeguards through disposal. See HHS guidance on business associates and PHI disposal.

The department shall keep vendor media movement and sanitization verification records with the corresponding asset record. A vendor certificate supports the department’s documentation but does not, by itself, establish that the chosen method was suitable or successfully validated. The responsible department reviewer shall assess the evidence before authorizing reuse, transfer, or closure of the disposition record.

In summary, inventory copier storage, choose a media-appropriate method based on risk and disposition, verify and validate the result, and document each transfer and outcome. These procedures support the HIPAA Security Rule’s device and media controls while giving staff a consistent process for reuse, return, and disposal.

FAQs.

Does a copier hard drive store ePHI?

It may. Depending on the copier’s model, options, configuration, and use, its internal storage may retain document images or other information associated with printing, scanning, or faxing. Check the specific device documentation and configuration, and include its storage media in the department’s inventory when it could contain ePHI.

Which sanitization method should a county health department use before reusing a copier?

Use a method suited to the drive technology, information risk, and destination. Clear may be appropriate for approved internal reuse when the department’s risk assessment accepts it; purge may be preferable when reusable media will leave department control and a suitable method is available. If a method cannot be reliably applied or validated, keep the drive secured and escalate to destruction. HIPAA does not prescribe one universal method.

What documentation should be kept after copier hard drive destruction?

Keep records identifying the copier and drive, the date and method of destruction, the performer and reviewer, verification or validation results, final destination, and chain of custody. Retain Security Rule documentation for six years from creation or the date it was last in effect, whichever is later, and follow any longer applicable county, state, contractual, or records-management schedule.

Can a business associate sanitize or destroy copier hard drives?

Yes. A covered entity may hire a business associate to dispose of PHI or electronic media, provided the required agreement calls for appropriate safeguards through disposal. Whether a copier service or disposal vendor is a business associate depends on the vendor’s actual functions and whether the contracted service involves PHI as described in HHS guidance. The department remains responsible for controlling the process and reviewing sanitization evidence.