PHI Disposal Policy Guide for Pediatric Emergency Telemedicine Networks

What PHI disposal safeguards should pediatric telemedicine networks use?

Build disposal into the full lifecycle of protected health information (PHI), from creation and storage through transfer, retention, and final destruction. In a pediatric emergency telemedicine network, PHI can appear in clinical records, referral forms, printed notes, patient messages, images, session recordings, device downloads, and temporary files—not just in the central medical record.

The HIPAA Privacy Rule requires covered entities to use appropriate administrative, technical, and physical safeguards to protect PHI, including during disposal. For electronic PHI (ePHI), the HIPAA Security Rule specifically requires policies and procedures addressing final disposition of the information and the hardware or media on which it is stored. See 45 CFR § 164.530 and 45 CFR § 164.310.

Use safeguards that fit your network’s workflows and risks. These may include locked collection containers, restricted access to storage areas, secure transfer to an approved destruction provider, defined media-sanitization steps, and documented confirmation that disposal is complete. Apply pediatric telehealth access controls so only authorized people can handle PHI, and ensure temporary access for responders or volunteers ends when their assigned work is complete.

Identify which organizations in the network are covered entities, business associates, or neither under HIPAA. Responsibilities depend on those roles and the relevant agreements; do not assume every school, volunteer group, technology vendor, or referral partner has the same legal status. Where a vendor handles PHI for a covered entity, use the required business associate agreement and address safeguards through disposal. HHS explains this requirement in its guidance on hiring a business associate to dispose of PHI.

How should networks establish disposal policies and train staff and volunteers?

Write a policy that tells people what counts as PHI in your network, which records must be retained, who approves disposal, and what method applies to each material or system. Define responsibilities for clinical staff, emergency coordinators, administrators, contractors, and anyone else who may handle PHI. Include a process to pause routine destruction when a legal hold, investigation, audit, or unresolved patient-care need applies.

Make the policy operational: specify secure collection and interim storage, approved vendors, handoffs, required records of destruction, escalation steps for failed or uncertain sanitization, and how to report suspected loss or exposure. Revisit the policy when your systems, vendors, data flows, or applicable requirements change. HIPAA requires written Security Rule policies and procedures, and required Security Rule documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later. See 45 CFR § 164.316.

Provide HIPAA workforce training that matches each person’s duties. The Privacy Rule requires training for workforce members as necessary and appropriate for their functions, including new workforce members within a reasonable period and affected members when relevant policies materially change. HHS describes workforce members as including employees, volunteers, trainees, and certain other people under an entity’s direct control. There is no universal federal requirement for annual HIPAA training or annual certificate renewal; document the training required for your workforce and reinforce it according to your risks and policies. A training completion certificate is evidence of training—not proof that the organization as a whole is HIPAA compliant. See 45 CFR § 164.530 and HHS’s HIPAA Privacy Rule summary.

How can paper PHI be destroyed so it cannot be reconstructed?

Destroy paper so patient information is essentially unreadable, indecipherable, and cannot be reconstructed before it enters ordinary waste or recycling. Use an approved method such as shredding, pulping, or another process that makes the contents unrecoverable. Do not rely on tearing pages by hand, crossing out names, or placing intact documents in a standard recycling bin.

Protect records while they await destruction. Keep them in a controlled area or secured, access-restricted containers; limit who can collect and transport them; and avoid leaving papers unattended in clinics, vehicles, or shared workspaces. Check pages, labels, prescription information, wristbands, and printed telehealth summaries for identifiers before disposal.

If a vendor collects or destroys paper records, verify its role and contract requirements, control the handoff, and obtain a destruction record appropriate to the risk. HHS notes that a vendor may dispose of PHI on behalf of a covered entity when the required safeguards and agreement are in place. Its guidance also explains that PHI should not go into publicly accessible waste or recycling receptacles unless it has first been made unreadable and unreconstructable. See HHS guidance on disposal of PHI in dumpsters.

How should electronic PHI and storage media be cleared, purged, or destroyed?

Inventory where ePHI resides before deciding how to remove it. Consider computers, removable drives, mobile devices, clinical equipment, printers, memory cards, local downloads, and storage media returned, reused, or sent to a recycler. The Security Rule requires policies for final disposition and procedures for removing ePHI before media are reused. HHS describes clearing, purging, and physical destruction as possible approaches, depending on the circumstances.

• Clear: Use an appropriate, verified process to remove data from the media when it will remain under controlled use or be reused.
• Purge: Use a stronger sanitization approach when needed to make recovery infeasible for the anticipated level of effort, considering the media type and planned transfer.
• Destroy: Physically destroy media when it is not suitable for reuse or an effective sanitization method cannot be verified for the risk and circumstances.

Do not assume that deleting files, emptying a recycle bin, resetting a device, or reformatting a drive has adequately sanitized it. Choose a method designed for the specific media and data, and document the result. For cloud-hosted systems, coordinate with the provider: establish which copies, exports, backups, and retained data are covered by the service and contract, and understand any limits or timelines for deletion.

Use the current NIST SP 800-88 Revision 2, Guidelines for Media Sanitization, as a technical reference for selecting and managing sanitization methods. Revision 2 was published in September 2025 and supersedes Revision 1. NIST guidance helps organizations select processes based on information sensitivity and media; it does not replace HIPAA requirements or a network-specific risk assessment.

How should disposal methods be chosen for different privacy risks?

Match the method to the information’s sensitivity, how much PHI is involved, the storage medium, who could access it, and whether the material will be reused or leave the organization’s control. Consider the practical consequences of exposure: a telehealth recording or a file containing a child’s name, diagnosis, and emergency treatment details may create a different risk from an unlabeled, blank form.

For example, a paper note may be securely shredded on site; an encrypted device might be sanitized using a method appropriate to that device and the network’s risk assessment; and a failed or unsuitable storage device may need physical destruction. These are examples, not one-size-fits-all rules. NIST’s media sanitization guidance can help evaluate method, media, sensitivity, and control of the device.

Record which method was selected and why, especially when a device cannot be sanitized or must be destroyed. Treat a method that cannot be verified as an unresolved risk: restrict access, secure the item, and escalate to the designated privacy or security lead rather than releasing it for reuse or disposal.

How should telehealth data flows and disposal steps be documented?

Map the places PHI may be created, received, stored, copied, or retained during a telehealth encounter. Include the clinical record and referral pathway as well as session chat, images, recordings, scheduling systems, messaging tools, downloaded files, local caches, connected peripherals, and backups. For each system or medium, identify who controls it, how long data is retained, and how deletion or sanitization is carried out.

Keep documentation proportionate to the risk but useful enough to show what happened. A disposal record may identify the item or batch, media type, date, method, responsible person or vendor, verification result, and any exception or follow-up action. Avoid placing unnecessary patient details in the record itself; use a suitable inventory or reference that lets authorized staff identify the material without creating another unnecessary copy of PHI.

Maintain a PHI chain of custody for sensitive records and media when they are collected, moved, transferred to a vendor, or taken off site. Document handoffs and the person responsible. HIPAA makes device and media movement accountability an addressable specification; addressable does not mean optional without consideration—the organization must assess whether it is reasonable and appropriate in its environment and document its decision. See 45 CFR § 164.310.

Preserve policies and records that HIPAA requires you to document for the applicable retention period. In particular, Security Rule documentation generally has a six-year retention period measured from creation or the date it was last in effect, whichever is later. This documentation rule is distinct from medical-record retention requirements. See 45 CFR § 164.316.

How do state record-retention rules affect PHI disposal?

Do not destroy a pediatric medical record simply because it is no longer needed for an active telehealth encounter. The HIPAA Privacy Rule does not set a general retention period for medical records; state laws generally govern how long medical records must be kept. Other requirements may also apply, such as a program-specific rule, contract, legal hold, or an applicable federal documentation requirement. HHS explains the distinction in its guidance on HIPAA and medical record retention.

Determine which state’s requirements apply to each record and provider in a multistate network, then set a retention schedule that accounts for the applicable record type and circumstances. Pediatric records may require special review because state rules can distinguish minors’ records or treatment categories, and state law may also affect confidentiality and parental access. Do not assume one retention period applies to every state, organization, or pediatric record.

Once the applicable retention period has expired—and no other hold or requirement prevents destruction—dispose of the record using the secure method appropriate to its format and risk. Retention and disposal are separate decisions: a record must remain protected for as long as it is retained, and it should not be destroyed before the applicable requirements allow it.

In short, a sound PHI disposal policy connects retention rules, secure destruction, staff and volunteer training, vendor oversight, and documented media handling. Map the network’s data flows, choose methods suited to each medium and risk, and confirm that applicable state and other retention requirements are met before disposal.

FAQs

Does HIPAA require a specific method for disposing of PHI?

HIPAA requires appropriate safeguards and policies and procedures for final disposition of ePHI and the media on which it is stored, but it does not prescribe one disposal method for every kind of PHI. Choose a method appropriate to the information, medium, and risk. HHS describes examples such as shredding paper and clearing, purging, or destroying electronic media in its disposal guidance.

How can a telemedicine network verify electronic media has been sanitized?

Use a method appropriate to the media and risk, follow the device or sanitization process requirements, and record the method, responsible person, date, and verification result. If a vendor performs the work, define its responsibilities in the applicable agreement and obtain evidence of completion. Refer to NIST SP 800-88 Revision 2 for guidance on developing a media-sanitization process.

Can PHI be placed in a publicly accessible dumpster?

Generally, no. HHS says PHI should not be placed in a publicly accessible dumpster or other ordinary trash receptacle unless it has first been made essentially unreadable, indecipherable, and unreconstructable. Secure it until it is properly destroyed or use a suitable controlled disposal arrangement. See HHS’s guidance on publicly accessible dumpsters.

How do state retention laws affect when pediatric records can be disposed of?

State laws generally determine how long medical records must be retained, and requirements can vary by state and record type. Check the rules applicable to the provider and record, including any requirements that specifically affect minors, and account for legal holds and other applicable obligations before destruction. HIPAA requires safeguards for PHI for as long as it is maintained, including through disposal; it does not establish a general medical-record retention period. See HHS guidance on HIPAA and medical record retention.