Medical Device Decommissioning Policy Template for Freestanding Imaging Centers (HIPAA)

What devices and media does the decommissioning policy cover?

This policy applies to imaging equipment and related devices that may store, process, or provide access to electronic protected health information (ePHI). Depending on the equipment and its configuration, that may include MRI, CT, X-ray, ultrasound, and mammography systems; acquisition and review workstations; modality consoles; servers; PACS and imaging gateways; printers; network equipment; and diagnostic displays with storage.

It also covers storage media and components, including internal and removable drives, solid-state storage, USB devices, optical discs, backup media, and device memory or logs that may contain ePHI. Include leased, loaned, vendor-owned, and temporarily assigned equipment whenever the center controls it or ePHI may reside on it.

The HIPAA Security Rule requires policies and procedures addressing the final disposition of ePHI and the hardware or media on which it is stored, as well as removal of ePHI before media reuse. The policy should cover the relevant equipment and media types in your center rather than assume every device stores data. See the HHS summary of the HIPAA Security Rule and 45 CFR § 164.310(d).

How should imaging devices and ePHI-containing media be inventoried and tracked?

Before decommissioning, the assigned owner should identify the device and assess where it may store or access ePHI. Check available asset records, technical documentation, and manufacturer or service-provider guidance. Consider internal storage, removable media, local image caches, worklists, logs, and connected components; do not assume that deleting files from the main workstation removes data from every storage location.

Record the asset tag, manufacturer, model, serial number, location, owner, identified media, intended disposition, assigned approver, and status. Track the device from the decision to retire it through sanitization, reuse, return, or destruction. Keep records focused on asset and process details; do not place patient names or images in an inventory and tracking log unless necessary and authorized.

The Security Rule addresses receipt and removal of hardware and media containing ePHI into and out of a facility, movement within the facility, and final disposition. A center can use an inventory and tracking log to implement those controls, but should distinguish this recommended documentation method from the specific requirements of the regulation. 45 CFR § 164.310(d)

Which sanitization methods are appropriate before reuse or disposal?

Choose the method based on the storage technology, device condition, intended destination, data sensitivity, and the center’s approved sanitization procedure. The objective is to make ePHI inaccessible before reuse or disposal—not simply to remove visible files or perform a routine reset.

• Reuse: Use an approved clearing or purging process suitable for the particular media, then verify that the process completed. Confirm that all known storage locations were addressed.
• Encrypted media: Cryptographic erase may be appropriate when the center can verify that encryption covered the relevant data and that the required keys have been effectively sanitized. Do not assume that encryption alone or deleting a key is sufficient without validation.
• Failed or unsuitable media: If reliable sanitization cannot be verified, restrict access and arrange destruction through an approved process appropriate to the media.

HHS explains that covered entities must address final disposition and remove ePHI before media reuse; it also describes clearing, purging, and physical destruction as possible approaches depending on circumstances. For a current technical framework, use NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, which calls for methods and controls selected through an organizational sanitization program. Do not apply a method—such as magnetic degaussing—to media for which it is unsuitable. HHS guidance on reuse or disposal of electronic media

What steps are required before a medical device leaves organizational control?

Before transfer, return, resale, donation, recycling, or disposal, the device owner should coordinate with privacy, security, IT, clinical engineering, and the relevant operational lead. Confirm that images and other clinical information needed for care and recordkeeping have been transferred to an approved system and that the transfer is complete. Apply the center’s retention schedule and any legal hold; decommissioning is not, by itself, a reason to delete clinical records that must be retained.

Complete and verify the selected sanitization method before the device or media is released. If ePHI cannot be removed or the result cannot be verified, keep the item secured and arrange an approved destruction or other controlled disposition. Document any exception and the person who authorized it.

Before handoff, deactivate or remove access that is no longer needed, as applicable: network connections, user and service accounts, remote maintenance access, certificates or credentials, and PACS or modality integrations. Coordinate changes to avoid disrupting clinical operations or an authorized service transfer. These are policy safeguards for controlling access; they do not replace the HIPAA requirements for media disposal and reuse described in 45 CFR § 164.310(d).

How should chain of custody and final disposition be documented?

Maintain a device chain of custody from initial inventory through final disposition. Record who authorized the retirement, who handled or transported the item, when custody changed, where it was stored, and who received it. For off-site transport, document the carrier or vendor, shipment or work-order reference, and receipt confirmation. Use sealed or otherwise access-controlled transport when appropriate.

For each sanitization or destruction event, document the asset identifier, media covered, method used, date, responsible person or vendor, verification result, and any exception or corrective action. If a vendor provides a certificate or report, retain it with the asset record and check that it identifies the relevant device or media and the work performed. A certificate supports the center’s records; it does not by itself establish that every storage location was sanitized.

The HIPAA Security Rule requires policies and procedures for final disposition and media reuse, but does not prescribe a single chain-of-custody form. The center should retain records under its approved documentation and retention procedures and limit access to them. HHS summary of device and media controls

What safeguards apply when a business associate handles device disposal?

If a disposal provider is a business associate because it handles PHI on the center’s behalf, establish a written business associate agreement (BAA) before the provider performs the work. The agreement should address permitted uses and disclosures, required safeguards, reporting of incidents or unauthorized disclosures, and any subcontractor arrangements relevant to the service.

Define the disposal work in the agreement or related procedures: the devices and media in scope, transport and storage protections, approved sanitization or destruction methods, verification and reporting, access restrictions, and how the provider will return or destroy PHI when the arrangement ends. The HIPAA Privacy Rule generally requires a BAA to provide for return or destruction of PHI at termination when feasible; if that is infeasible, the agreement must extend protections and limit further uses and disclosures. See HHS guidance on hiring a business associate to dispose of PHI and HHS sample business associate agreement provisions.

Keep evidence of the provider’s receipt and final work, review exceptions, and resolve discrepancies before closing the decommissioning record. The center remains responsible for selecting and documenting a process that addresses its ePHI and device risks; a vendor’s assurance alone does not replace that process.

In practice, a sound decommissioning process identifies every relevant device and storage location, protects ePHI during transfer, applies and verifies a suitable sanitization or destruction method, deactivates unneeded access, and records the final disposition. Use this policy with your center’s security procedures, retention rules, and business associate agreements.

FAQs.

When must ePHI be removed before a device is reused?

Remove ePHI before making electronic media available for reuse, whether the device will be reused internally or released to another party. The process should cover the media on which ePHI is stored and be verified before reuse. The HIPAA Security Rule, 45 CFR § 164.310(d)(2)(ii), requires procedures for removing ePHI from electronic media before reuse.

Which sanitization methods can prevent ePHI retrieval?

Depending on the media and circumstances, an approved clearing or purging method, cryptographic erase where properly validated, or physical destruction may be appropriate. Select a method for the specific storage technology, follow the center’s approved procedure, and verify the result. If sanitization cannot be completed or confirmed, secure the media and arrange an appropriate destruction process. See NIST SP 800-88 Rev. 2 and HHS guidance on reuse and disposal.

What records should an imaging center keep when decommissioning a device?

Keep the asset and media identifiers, authorization, custody and transfer history, sanitization or destruction method, date, responsible person or provider, verification result, final disposition, and any exceptions or vendor records. Do not treat a particular form or certificate as universally required by HIPAA; retain records under the center’s approved procedures and applicable obligations.

What safeguards must a business associate follow when disposing of devices containing PHI?

A business associate must follow the applicable HIPAA requirements and its BAA, including safeguarding PHI through disposal and limiting its use or disclosure to authorized purposes. The agreement should specify handling, transport, sanitization or destruction, verification, reporting, and subcontractor requirements as relevant. Where return or destruction at termination is infeasible, the BAA must provide for continued protections and restrict further use or disclosure. HHS guidance on disposal by a business associate