1609 PR.01 Disposal of Media Containing Confidential or Protected Health Information
When use or retention of any media containing confidential information (including protected health information) is completed, the confidential information must be destroyed, rendered unrecoverable, or returned to the system owner.
The primary means of disposal of paper media containing confidential information is via shredding. All such media should be deposited in designated, locked boxes for shredding or otherwise kept secure until shredded.
If an outside supplier is employed, the shredding services must implement a process that maintains the security of the contents from pick up within the organization to the point of destruction.
Recycle bins are not to be used for confidential information as the process to dispose of this material does not guarantee security from point to point.
You must contact your local support provider to ensure your device in appropriately prepared for reuse and ensure sensitive data is properly protected.
If the data on the electronic media device is not available from another location, please ensure that the University allows you to destroy this data by reviewing the Yale Records Retention Schedule maintained by the Office of General Counsel.
Disposal of electronic media containing electronic Protected Health Information is managed by Yale data disposal suppliers. Please complete the Universal Waste Disposal request.
The supplier has contracted to use industry standard methods to dispose of electronic media devices for the University and provide certificates of destruction at the end of the destruction process.
Electronic devices with electronic protected health information (“ePHI”) or other sensitive data must remain in a secured location while awaiting pickup. A secured location is defined as one that utilizes adequate means (e.g., locked doors) to limit physical access to only authorized individuals. Devices may not be placed outside offices in hallways while awaiting pickup.
In general, other electronic media (DVD, CD, diskette, zip drive etc.,) must be physically destroyed to be rendered unreadable.
Disposal of other media varies with the nature of the item and the material.
- To the extent possible and practical, material containing patient identification that cannot be removed from the material to which it is affixed should be given to the patient to take home. This would include the patient’s wrist band, prescription bottles, etc.
- Material that is reusable for the individual patient, such as embosser plates should be filed in the patient’s medical record.
- Material that is reusable, such as some IV preparations and prescription bottles, can have either an opaque label placed on top of the original label (recording any pertinent information on the new label, such as data of contents expiration), or Protected Health Information obliterated with a non-water soluble black marker.
- Material that is not reusable and contains any chemical or biological substance must be disposed of according to any appropriate hazard or bio-hazard waste process.
- The Radiology Department is responsible for the disposal of x-ray film.
For guidance on the disposal or re-use of any material not covered in this procedure or about which any University employee is uncertain, contact the Chief Privacy Officer.