To dispose of medical records under HIPAA, keep each record for the longest retention period that applies to it, destroy it using a method approved for its medium so the information cannot be read or reconstructed, and document the destruction in a log or vendor certificate. If a third party handles the destruction, sign a Business Associate Agreement before any records leave your custody.
Those are the four moving parts. The rest is detail: which retention period governs, which destruction method fits which medium, what your documentation needs to say, and what happens when something goes wrong.
Confirm the Record Is Past Its Retention Period
Disposal is only lawful once every applicable retention clock has run out. There is no single number that covers every record.
HIPAA’s Security Rule requires covered entities to keep certain administrative documents, such as written privacy policies, security risk assessments, workforce training logs, and signed authorizations, for at least six years from the date of creation or the date the document was last in effect, whichever is later.1eCFR. 45 CFR 164.316 – Policies and Procedures and Documentation Requirements That six-year period covers administrative documentation, not clinical charts.
Medicare providers must keep medical records for at least seven years from the date of service. This applies to any provider or supplier furnishing covered Part A or Part B services, and to physicians who order, certify, or refer those services. Failure to maintain or provide access to these records can result in revocation of Medicare enrollment.2Centers for Medicare & Medicaid Services. Medical Record Maintenance and Access Requirements
For clinical records generally, HIPAA sets no retention period. State law does.3U.S. Department of Health and Human Services. Frequently Asked Questions About the Disposal of Protected Health Information Most states require seven to ten years for adult records measured from the last date of service, and pediatric records usually run until the patient reaches the age of majority plus an additional period, often three to seven years. Check your state before scheduling any destruction.
One boundary worth flagging: a patient’s death does not immediately clear the records. The HIPAA Privacy Rule continues to protect a deceased person’s health information for 50 years after death. That is a privacy protection, not a retention mandate. You may destroy the records whenever state law allows, but until they are gone, the same disposal safeguards apply.4U.S. Department of Health & Human Services. Am I Required To Keep the Decedents Information for 50 Years
Choose a Destruction Method That Fits the Medium
HIPAA requires covered entities to implement policies and procedures for the final disposition of protected health information on any medium and to use reasonable safeguards that prevent prohibited disclosures during disposal.5eCFR. 45 CFR 164.310 – Physical Safeguards The technical reference most organizations use is NIST Special Publication 800-88, updated to Revision 2 in September 2025.6National Institute of Standards and Technology. SP 800-88 Rev 2, Guidelines for Media Sanitization
Paper Records
Cross-cut shredding, pulping, and incineration are all accepted. Standard strip-shredding is generally discouraged because modern scanning technology can piece strips back together. For in-house work, a cross-cut shredder that reduces documents to confetti-sized particles is the minimum most compliance officers accept. High-volume destruction is usually handled more efficiently by commercial pulping or incineration services, which also provide documentation of the job.
Electronic Media
Hard drives, flash storage, backup tapes, and any other device holding electronic protected health information need method-specific treatment. For traditional magnetic hard drives, degaussing uses a strong magnetic field to scramble the stored data patterns beyond recovery. Solid-state drives do not respond to degaussing because they store data differently. For SSDs, overwriting every storage sector with non-sensitive data patterns or physically disintegrating the chips are the accepted approaches. When in doubt, physical destruction is the most reliable option; forensic recovery software cannot pull data from a drive that has been shredded into fragments.
Simply deleting files or reformatting a drive is not disposal. The data remains recoverable and the records are still your responsibility.
Document Every Destruction Event
Destroying records without documentation is almost as risky as failing to destroy them properly. If a patient or auditor asks why a record no longer exists, you need proof it was disposed of on schedule and by an approved method.
Internal Destruction Logs
A destruction log is a permanent internal record of each disposal event. At minimum it should capture the date of destruction, the method used, a description of the records destroyed (document types and date ranges), and the name of the person who performed or supervised the work. These logs become part of your administrative records and should be retained for at least six years, consistent with the HIPAA documentation requirement.1eCFR. 45 CFR 164.316 – Policies and Procedures and Documentation Requirements
Certificates of Destruction from Vendors
When a third party performs the disposal, insist on a formal Certificate of Destruction. It typically includes the date and location of destruction, the method used, an inventory of what was destroyed, serial numbers for any hardware disposed of, and a signed statement that the process followed applicable regulatory standards. Cross-reference the certificate against your internal inventory before filing it. If your inventory lists 47 boxes and the certificate accounts for 45, resolve the gap immediately rather than discovering it during an audit two years later.
Working With a Third-Party Disposal Vendor
Most providers outsource large-scale destruction. Before any protected health information leaves your custody, get a signed Business Associate Agreement in place. The Privacy Rule at 45 CFR 164.504(e) spells out what the contract must include: limits on how the vendor can use the information, a requirement to use appropriate safeguards, an obligation to report any unauthorized disclosures or breaches, and a provision to return or destroy all protected health information at the end of the contract.7eCFR. 45 CFR 164.504 – Uses and Disclosures Skipping the agreement exposes your organization to HIPAA penalties even if the vendor never actually mishandles anything.
The physical hand-off matters too. Verify the credentials of transport personnel, use locked bins or encrypted transfer portals depending on the media, and maintain a chain-of-custody log that tracks records from the moment they leave your facility until the vendor confirms destruction.
Train Everyone Who Touches Records
A disposal policy on paper means nothing if the people handling records do not know it exists. HIPAA requires covered entities to train every workforce member whose role involves disposing of protected health information, including anyone who supervises disposal activities. This extends to volunteers, not just paid employees.3U.S. Department of Health and Human Services. Frequently Asked Questions About the Disposal of Protected Health Information
Training should cover approved methods, how to handle different media types, where secure disposal bins are located, and what to do if someone finds improperly discarded records. Depth can vary by role. A front-desk employee who occasionally shreds documents needs different training than an IT administrator wiping server drives. When workforce members fail to follow established procedures, the covered entity is required to apply appropriate sanctions. Documenting both the training and any disciplinary actions protects the organization during compliance reviews.
If Disposal Goes Wrong: Breach Notification
Records dumped in an unsecured dumpster, hard drives sold without wiping, or boxes left at a curb for pickup all constitute potential breaches of unsecured protected health information. The HIPAA Breach Notification Rule applies whenever protected health information is accessed, used, or disclosed in a way not permitted by the Privacy Rule, unless the covered entity can demonstrate a low probability that the information was actually compromised.
Reporting obligations depend on the size of the breach. For a breach affecting 500 or more individuals, you must notify the affected individuals, the Secretary of Health and Human Services, and prominent media outlets in the affected state or jurisdiction, all without unreasonable delay and no later than 60 days after discovering the breach.8U.S. Department of Health & Human Services. Breach Notification Rule For a breach affecting fewer than 500 people, notify the affected individuals within 60 days of discovery, log the breach, and report it to HHS no later than 60 days after the end of the calendar year in which it was discovered.9eCFR. 45 CFR 164.408 – Notification to the Secretary
Individual notifications must describe what happened, what types of information were involved, what steps the person should take to protect themselves, and what the organization is doing to investigate and prevent future breaches. Disposal-related breaches tend to draw outsized enforcement attention because they suggest systemic failures rather than one-off mistakes.
Disposal When a Practice Closes
When a practice shuts down, every record in its custody still needs a plan. Patients should receive written notice at least 60 days before the closure date, though starting closer to 90 days in advance gives more realistic breathing room. The notice should include the anticipated closure date, the option to transfer records to another provider, the option to obtain a personal copy, and contact information for whoever will serve as custodian of the remaining records.
A successor custodian is essential. Another provider, a records storage company, or a designated administrator must take responsibility for records that patients do not claim. That custodian must store and eventually dispose of those records in compliance with HIPAA, and the retention clock does not reset because the practice closed. If state law required seven years from the last date of service, that timeline still applies. State medical boards generally require notification of anticipated closures as well.
HHS guidance notes that a covered entity winding down its business should consider giving patients the opportunity to pick up their records before any disposition occurs.3U.S. Department of Health and Human Services. Frequently Asked Questions About the Disposal of Protected Health Information A Business Associate Agreement with the custodian or storage vendor remains necessary so HIPAA-compliant handling continues after the original covered entity no longer exists.7eCFR. 45 CFR 164.504 – Uses and Disclosures
What Non-Compliance Costs
HIPAA civil monetary penalties scale with fault, from a low tier when the entity had no knowledge of the violation up to a top tier for willful neglect that goes uncorrected. Penalties are set per violation and adjusted annually for inflation, with the uncorrected willful-neglect tier reaching an annual cap of $2,190,294.10Federal Register. Annual Civil Monetary Penalties Inflation Adjustment Correcting a known problem quickly is one of the most effective ways to limit financial exposure; the minimum per-violation penalty jumps substantially between the corrected and uncorrected willful-neglect tiers.
Premature destruction can also cause trouble in malpractice litigation. If records that should have been available are missing, courts may treat it as spoliation of evidence, with consequences ranging from monetary sanctions to jury instructions telling the jury it can assume the missing records would have helped the other side. A documented retention schedule that was followed consistently is your defense; destroying records after a litigation hold or before the retention period expired is much harder to explain.