Q&A: Protocol for PHI disposal

Q: Many organizations have outsourced their PHI disposal for years. With coronavirus limiting the number of people coming in and out of medical facilities, what are your suggestions for organizations that now have to take care of PHI disposal themselves? What are the most important things to remember when handling this process?

A: Disposal of paper-based PHI may be done in a number of ways, including shredding, burning, and pulping. The most important thing to remember is that the disposal method must render the PHI unreadable. If you are shredding, for example, the paper records must be cut into pieces small enough that they cannot be pieced together and read. In addition, records awaiting disposal must be kept in a secure area that cannot be accessed by unauthorized individuals.

Editor's note: Mary D. Brandt, MBA, RHIA, CHE, CHPS is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to editor Kevin Duffy at kduffy@hcpro.com.