Skip to Main Content
Services Talent Knowledge
Site Search

Blog Post

August 20, 2018

Sanitize Your Media or Face a Breach: OCR Cybersecurity Guidance Signals Importance of Proper Device and Media Disposal

Health care providers are data collectors. But what about when it comes to data disposal? The federal government recently identified risks in disposing of electronic devices and media in a July 2018 cybersecurity newsletter issued by the US Department of Health & Human Services Office for Civil Rights (OCR).

The newsletter highlights how improper disposal of electronic devices often leads to data breaches, which can be time consuming and expensive for a health care organization due to costs associated with notifications, government investigations, legal action, and the need for consultants and legal counsel. The newsletter suggests that organizations take an inventory of the type and location of data they maintain, create a data disposal plan, maintain a proper chain of custody, have proper security controls in place when moving certain equipment, and securely decommission devices and media.

For paper, film, and other hard copy media, protected health information (PHI) is considered to have been disposed of securely when these items have been shredded or destroyed so that the PHI cannot be read or reconstructed. Redaction is not a proper means of data destruction. For electronic media, PHI is considered to have been disposed of securely when the media is “cleared, purged, or destroyed consistent with NIST special publication 800-88 revision 1Guidelines for Media Sanitization” in a way that the PHI cannot be retrieved.

The guidelines indicate that organizations can outsource media sanitization and destruction but recommend that organizations exercise due diligence when entering this type of contract with another party. This can include reviewing an independent audit, obtaining references from reliable sources, requiring certain certifications, reviewing security policies or procedures, or taking other appropriate measures to determine the competency and integrity of the company.

If you have any questions regarding the content of this blog post, please contact Bridget Steele, associate, at or 716.858.3704.


Click here to sign up for alerts, blog posts, and firm news.


Sign up to receive our latest news via email

Practice Areas

Featured Industries

New & Emerging Industry Practice Areas


View our Privacy Policy

Featured Media


New in-Service Distribution Event: Coronavirus-Related Distributions


COVID-19's Impact on Cannabis Businesses


COVID-19: NYSDEC DER Hits Play on Limited Essential Environmental Remediation, New York State Remains on PAUSE


COVID-19: OCR Issues Guidance to Help Ensure First Responders, Others Receive PHI From Individuals Exposed to Virus


US EPA Releases Draft Guidance for New Source Review Preconstruction Permitting, Revising Longstanding Interpretation of "Begin Actual Construction"


COVID-19: CARES Act Makes Significant Changes to 42 CFR Part 2

This site uses cookies to give you the best experience possible on our site and in some cases direct advertisements to you based upon your use of our site.

By clicking [I agree], you are agreeing to our use of cookies. For information on what cookies we use and how to manage our use of cookies, please visit our Privacy Statement.

I AgreeOpt-Out