Do you recall playing a game with friends only to realize you’ve been playing it incorrectly all along? Rules sometimes get overlooked, adapted or misunderstood, leading to alternative ways of play that persist for years. Games like Monopoly, Scrabble and even Poker and Blackjack have incorrectly hinged on “house rules,” and have been played differently until someone comes along and challenges the rule.
Similar misunderstandings can occur within a company regarding regulations for secure information disposal. Procedures may have been passed down, slightly altered with each explanation. The most reliable sources for the correct guidelines are the latest laws mandating secure information disposal, which outline specific details on handling information at the end of its use.
Health Insurance Portability and Accountability Act of 1996 (HIPAA)
HIPAA mandates organizations dealing with health-related information to have documented policies safeguarding Personal Health Information (PHI). Adherence to document retention periods is critical, ensuring information isn’t destroyed prematurely or stored beyond their designated retention dates. A Certificate of Destruction records what was destroyed, when and how. It supports your audit and due-diligence files but does not by itself establish legal compliance. Examples of protected information under HIPAA include:
- X-rays
- Insurance information and claim forms
- Medical history, billing information and notes
- Sign-in logs
- Health related images
Gramm-Leach-Bliley Act of 1999 (GLBA)
The GLBA requires banking and financial institutions, regardless of size, to establish, implement and maintain methods of protecting consumer information. Covered entities include:
- Banks
- Insurance companies
- Lenders
- Brokers
- Income tax return preparers
- Financial advice organizations
- Credit counsellors
Fair and Accurate Credit Transactions Act of 2003 (FACTA)
FACTA aims to curb fraud and identity theft by regulating the disposal of confidential information. It applies universally to all US persons and businesses holding consumer information, mandating its proper destruction before disposal. FACTA sets forth requirements for information privacy, accuracy, disposal and sharing of consumer information.
Using a Third-Party Shredding Company
Entities obligated to dispose of sensitive information can engage the services of a secure shredding company for proper document destruction. A Certificate of Destruction records what was destroyed, when and how. It supports your audit and due-diligence files but does not by itself establish legal compliance. Opting for a NAID AAA Certified shredding company means the destruction operation is independently audited, which supports your due diligence under privacy laws.
Richards & Richards is a family-owned, NAID AAA Certified shredding company serving Middle Tennessee since 1987. NAID AAA Certification means our destruction operation is independently audited, which supports your due diligence under privacy laws. We provide a Certificate of Destruction with every completed shredding job. Call us at 615-880-6314 or complete the form on this page for assistance with compliant document destruction.
