Here’s What You Need to Know
HIPAA requires covered entities, such as healthcare providers, to protect patients’ protected health information (PHI) when it’s disposed of. HIPAA doesn’t require a specific method or shred size. Richards & Richards is a family-owned, NAID AAA Certified shredding company serving Middle Tennessee since 1987, with one-time purge shredding and regularly scheduled service for healthcare organizations and any business that handles PHI.
What HIPAA Requires (General Information, Not Legal Advice)
HIPAA’s Privacy Rule requires covered entities to use appropriate administrative, technical and physical safeguards to protect PHI, including when records are disposed of. A few points worth knowing:
- PHI is health information that can be tied to a specific patient, such as medical records, billing records and other documents that connect a patient’s name, address, Social Security number or other identifiers to their health information or care.
- HIPAA doesn’t set a required shred size or method. The information must be unreadable and unable to be reconstructed.
- HIPAA doesn’t set how long medical records must be kept. State and federal record-retention laws do. HIPAA’s protections apply for as long as you hold the records, including when they’re destroyed.
Your organization’s specific obligations should be confirmed with your own counsel or compliance officer. This page is general information, not legal advice.
Why Shredding Is the Practical Answer
Paper records are most exposed before and after destruction: while they sit in an open box or unlocked bin during a cleanout, while they’re being transported, and after they’re shredded if the material isn’t handled securely. Locked collection containers and a documented chain of custody from pickup to destruction close those gaps.
What Richards & Richards Provides
- NAID AAA Certification means our destruction operation is independently audited, which supports your due diligence under privacy laws.
- Locked collection containers for disposing of PHI at your office
- A documented chain of custody from pickup to destruction
- After each completed destruction, a Certificate of Destruction is emailed automatically to the contact on file. It records what was destroyed and when, and supports your internal records and audit or due-diligence files.
- One-time purge service for backlog records and regularly scheduled pickups for ongoing disposal
- All shredded paper is sent to a paper mill for recycling.
Our NAID AAA Certified destruction process and Certificate of Destruction support your organization’s compliance program and vendor due-diligence records for laws such as HIPAA, GLBA and FACTA. Your organization remains responsible for its own compliance.
Common Myths, Corrected
Myth: “HIPAA requires a specific shred size.”
Fact: It doesn’t. HIPAA requires PHI to be unreadable and unable to be reconstructed. It doesn’t specify a particle size or method.
Myth: “Any accidental exposure of PHI is automatically a HIPAA violation with penalties.”
Fact: HIPAA civil penalties are tiered and adjusted annually.
Myth: “HIPAA tells us exactly how long we have to keep records before shredding.”
Fact: HIPAA doesn’t set retention periods for medical records. State and federal record-retention laws do. Confirm your specific requirement before scheduling a purge.
Frequently Asked Questions
Does your service support HIPAA disposal requirements?
Our NAID AAA Certified process, locked collection containers, documented chain of custody and Certificate of Destruction are designed to render PHI unreadable and unreconstructable.
Do you sign Business Associate Agreements?
Yes. We provide our standard BAA to healthcare clients that need one. If your organization requires its own agreement, let us know and we’ll work with you on it.
Does HIPAA require a specific shred size?
No. HIPAA requires PHI to be unreadable and unable to be reconstructed. It does not specify a particle size or method.
How long do we have to keep medical records before shredding them?
HIPAA doesn’t set a retention period for medical records. State and federal record-retention laws do. Once your required period has passed, we can securely destroy those records.
What happens to our documents after they’re shredded?
All shredded paper is sent to a paper mill for recycling. After each completed destruction, a Certificate of Destruction is emailed automatically to the contact on file. It records what was destroyed and when, and supports your internal records and audit or due-diligence files.
Ready to Get Started?
Handling protected health information? Set up NAID AAA Certified shredding before your next purge or scheduled pickup.
Request a Business Quote or talk to a local team member about scheduled service.
