We previously have only destroyed paper records with associated Certificates of Destruction. Following AHIMA's guidelines of retaining records for 10 years, we are due to destroy our electronic records that are 10 years and older. This will be the first time destroying electronic medical and counseling records. Does anyone have experience with this? Is a Certificate of Destruction required as it is with destruction of paper records? Previously we used a licensed shredding company for the paper records. Is a licensed company required to do the destruction of electronic records? That really wouldn't apply for the electronic records as we will be doing it ourselves, correct? We would really appreciate all input. Also guidance to any AHIMA articles regarding this would be appreciated as well. Thanks so much!
See 45 C.F.R. @164.310(d)(2)(i). "When an organization disposes of electronic media which may contain ePHI, it must implement policies and
procedures to ensure that proper and secure disposal processes are used."
The implemented disposal procedures must ensure that "electronic media have been cleared, purged, or destroyed consistent with NIST Special Publication 800–88: Guidelines for Media Sanitization, such that the PHI cannot be retrieved."
Electronic media and devices identified for disposal should be disposed of in a timely manner to avoid accidental improper disposal.
Organizations must ensure that all electronic devices and media containing PHI are disposed of securely; including non-computer devices such as copier systems and medical devices.
I would be interested in hearing what your EMR vendor tells you about destruction of the electronic records. Has anyone done this yet?
Anna Berry Pfeil, MA, RHIA
Director, Health Information Management
This message is confidential, intended only for the named recipient(s) and may contain information that is privileged or exempt from disclosure under applicable law. Any patient health information must be delivered immediately to intended recipient(s). If you are not the intended recipient(s), you are notified that the dissemination, distribution or copying of this message is strictly prohibited. If you receive this message in error, or are not the named recipient(s), please notify the sender at either the email address or telephone number above and delete this e-mail from your computer. Thank you.