As the health care industry continues to prepare for compliance with the Health Insurance Portability and Accountability Act, two obstacles are emerging -- the safe and legal disposal of outdated computer equipment and the digital or physical data destruction of patient information contained on them. By Joseph P. Harford
As the healthcare industry continues to prepare for compliance Health Insurance Portability and Accountability Act (HIPAA), two obstacles are emerging -- the safe and legal disposal of outdated computer equipment and the digital or physical data destruction of patient information contained on them. This equipment comes in the form of computer monitors, hard drives, printers, copiers, and more. In the past, this equipment may have been placed into storage, donated to a school, or sent to the dumpster. None of these methods of disposal address healthcare organizations' environmental or legal responsibilities. But how do you know if your organization is legally positioned to handle disposal of computer equipment?
What Is Legal?
To determine if your organization is legally prepared in terms of computer equipment, three questions should be addressed:
- Does your organization have a plan in place for the removal and disposal of outdated computer equipment?
- Does your plan adhere to appropriate local, state, and federal environmental laws for equipment removal or recycling?
- Does your plan follow the appropriate local, state, and federal laws regarding the privacy of patient data that may still reside on the equipment in question?
The 1976 Resource Conservation and Recovery Act addresses the proper disposal of hazardous materials. Computer monitors contain an average of five to eight pounds of lead in the glass. Computer equipment also contains materials categorized as hazardous such as mercury, cadmium, and arsenic. Dumping large amounts of this equipment into a landfill is against the law.
It is estimated that by 2004 there will be 350 million obsolete computers in the U.S. with no clear channel for removal, recycling, or disposal. This volume of equipment not only poses an environmental nightmare but also a challenge regarding the protection of privacy. Many states are attempting to enact legislation that will control the disposal of this equipment. Massachusetts and New Jersey have created a ban on dumping it into landfills. Pennsylvania will soon require a permit for companies that want to be involved with electronic recycling. In summer 2002, the U.S. Environmental Protection Agency filed fines for the improper disposal of hazardous waste that included computer monitors.
Protecting PHI
Although it is not directly addressed by HIPAA, it is obvious that proper recycling of computer equipment that contains protected health information (PHI) is just as important as following the guidelines for secure document storage and document destruction. The removal and recycling of computer equipment should be partnered with the need to properly and securely destroy PHI.
Healthcare organizations are aware of the need to work with a trustworthy document storage and destruction company. However, in many cases, the electronic source of all of these paper documents is forgotten. There have been numerous cases in which drives have not been properly "cleansed" and information has been inadvertently given away.
Destroying Data
Data destruction is not as simple and straightforward as “formatting” the hard drive of a computer. In fact, simply formatting the hard drive is in no way secure, comprehensive, or reliable. It is critical to implement responsible practices that consider the fiduciary responsibility of a healthcare provider to its patients.
The U.S. Department of Defense has set forth standards for the reliable and secure destruction of both electronic and physical data that resides on a computer hard drive. In the absence of standards of this type, health care organizations may want to consider adopting these standards when completing the task of secure data destruction. It may be helpful to refer to the standards listed in the
National Industrial Security Program Operating Manual.
Healthcare organizations may find the internal task of electronics recycling to be a daunting one and may decide that the identification, inventory management, destruction, and certification of private data should be left in the hands of reputable recyclers.
While it is always necessary to perform due diligence on a vendor, it is critical in this case in light of the potential environmental and confidentiality liabilities that organizations face. Ideally, an electronics recycler would perform both certified digital and physical data destruction services. Simply purchasing software or removing and destroying the hard drive is not adequate to protect an organization from an information breach.
The information that is solicited from a potential recycler or destruction vendor should be similar to that collected about the document storage or destruction vendor that may already be working for the organization. When choosing a recycling/destruction vendor, consider the following issues:
- landfill policy
- employee training
- background review and bonding
- data destruction practices and insurance coverage
Even with a vendor in hand, the liability associated with improper computer disposal or data loss ultimately remains with the accused institution. Make sure your organization is prepared.
----------
Joseph Harford is vice president of sales and marketing for Reclamere Inc., a company specializing in end-of-life services for electronic equipment.
For more information on computer recycling, read our GreenBiz Essential.
March 2003
