HIPPA compliant

[Joe Nelson]

Hey Gang, Is there a simple way to determine what qualifies for HIPPA compliance when it comes to wiping hard drives? 

Thanks in advance

Joe Nelson

eWaste Direct, Inc.

C: 925.437.9558

FREE Online Business pick up request: CLICK HERE

[mi...@ereuseservices.com]

Hi Joe,

Fortunately, HIPAA does not require any specific algorithm or pattern, but rather defers to NIST SP 800-88, which only requires a single pass (true-random or pseudo-random). That said, I’ve seen a higher concentration of healthcare organizations with internal policy that dictates 3 or even 7 pass processes than any other vertical market, as arbitrary as it seems. Regardless, I’ve worked with many organizations that fall under HIPAA who determined that a single pass “NIST” wipe is sufficient for compliance, and have yet to encounter any interpretation of HIPAA that suggests otherwise.

I hope this helps.

-Mike C.
E-Reuse Services, Inc.

[Joe Nelson]

Thanks Mike, And as long as we have single chain custody from the customer to our facility that should be within the compliance too?

Joe Nelson

eWaste Direct, Inc.

C: 925.437.9558

FREE Online Business pick up request: CLICK HERE

--
You received this message because you are subscribed to the Google Groups "refurbishers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to refurbishers+unsubscribe@googlegroups.com.
To post to this group, send email to refurb...@googlegroups.com.
Visit this group at https://groups.google.com/group/refurbishers.
For more options, visit https://groups.google.com/d/optout.

[Michael Cheslock]

Hi Joe,

That is my understanding, yes, however I am less familiar with any HIPAA chain of custody provision(s), and cannot confirm whether they dictate anything superfluous.  

Best,

Mike C.

Sent from my mobile device; please excuse my brevity.

Mike Cheslock

E-Reuse Services, Inc.

To unsubscribe from this group and stop receiving emails from it, send an email to refurbishers...@googlegroups.com.

[Bob Johnson]

Hi Joe,

Technically speaking, HIPAA is completely silent on data destruction per se. When pressed, Health and Human Service separately has referenced NIST 800-88 as a possible source of guidance, but under the Privacy Rule, the only obligation is to "prevent unauthorized access to Protected Health Information (PHI)." Service providers will want to pay as much attention to their internal employee training and written policies and procedures, especially as they relate to breach notification and incident reporting/ remediation. Those are actually more important with regard to compliance than the type of overwriting process that's used (as long as that wiping process is effective). 

Bob Johnson, NAID

[Joe Nelson]

Thanks Bob

Joe Nelson

eWaste Direct, Inc.

C: 925.437.9558

FREE Online Business pick up request: CLICK HERE