Shredding: the disposal standard and the dumpster cases

How do I dispose of paper records legally?

Render them unreadable so the information cannot be reconstructed — that is the core of the federal requirement. The Privacy Rule requires reasonable safeguards to protect PHI, and OCR reads that to include disposal, so discarded charts do not end up readable in the trash 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule requires reasonable safeguards to protect PHI, which OCR applies to disposal of records.. The rule text does not prescribe one method 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative rule text for disposal and media-destruction safeguards and the retention framework.; it prescribes the outcome. For paper, the accepted methods are cross-cut shredding, pulping, or incineration.

reasonable safeguards is the operative phrase: HIPAA sets a performance standard, not a product list, and scales it to your practice. A solo office is not expected to run an industrial shredder, but it is expected to make discarded PHI unreadable before it leaves your control.

The disposal standard: unreadable and unreconstructable

The test is whether someone retrieving the discarded material could read or rebuild the PHI. Cross-cut (confetti) shredding meets it; a single straight-cut strip shredder often does not, because strips can be reassembled. Pulping and incineration meet it. Old electronic media that holds PHI — a drive, a USB stick — is not covered by shredding paper; it must be cleared, purged, or destroyed under the same rule 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative rule text for disposal and media-destruction safeguards and the retention framework..

Match the method to the medium, and to the sensitivity: prescriptions, billing sheets, and intake forms all carry identifiers, so they all get the unreadable treatment, not a quick tear.

Shred in-house, or hire a vendor?

Both are allowed; the choice is about volume and proof. A small practice can shred low volumes on a good cross-cut machine and log it. Once volume grows, a bonded destruction vendor is usually cheaper per pound — but that vendor handles your PHI, which makes it a business associate, so a signed business associate agreement is required before the first pickup 3Ref 3HHS Office for Civil Rights (2026).Business Associates.That a records-destruction vendor handling PHI is a business associate requiring a signed BAA.. Ask for a certificate of destruction for each job and keep it.

The dumpster cases: how this actually gets caught

Improper disposal is one of the most reliably penalized HIPAA failures because it is visible from the street. OCR has settled cases where paper records — labeled prescriptions, charts, billing sheets — were dumped intact in unsecured containers 4Ref 4HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR has settled improper-disposal cases, including against small practices, and enforces through penalties.. Improper disposal that exposes PHI is a breach, which triggers the notification clock: individuals without unreasonable delay and no later than 60 days, plus HHS 5Ref 5HHS Office for Civil Rights (2026).Breach Notification Rule.That a disposal that exposes PHI is a breach requiring notice to individuals within 60 days and to HHS.. The shredder is far cheaper than the notice.

The failure is almost never a decision; it is a habit. An overflowing shred bin, a box of old files by the recycling, a departing tenant's leftover charts — each is a headline waiting for a passerby with a phone.

Retain before you destroy

Never shred a record you are still required to keep, and never shred one while it is in play. Retention periods run under state law and your professional guidelines — a common professional example is seven years after the last service for adults, and longer for minors, always deferring to the stricter state rule 6Ref 6American Psychological Association (2007).Record Keeping Guidelines.The professional retention norm — commonly seven years after last service for adults, longer for minors — always deferring to state law.. Confirm your state's retention schedule before scheduling any purge, and pause destruction on any file touched by a request.

Three holds override any disposal schedule: an open the right of access request from the patient 7Ref 7HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That patients have a right to obtain copies of their records, so records subject to an access request must be produced rather than destroyed., an active the subpoena or litigation hold, and a pending records transfer. Destroying a record you still owe the patient — or one under legal demand — converts a filing decision into spoliation. When the requester is not the patient, confirm the personal representative before you release or destroy anything, and remember that copy fees for what you produce are capped separately.

Scan-then-shred: destroying paper you have digitized

Going paperless does not exempt you from the disposal standard — it adds a step. The safe sequence is scan-then-shred: scan the chart, verify the image is complete and readable, confirm it is inside your backed-up system, and only then destroy the paper by the same unreadable standard 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative rule text for disposal and media-destruction safeguards and the retention framework.. Destroying paper before you have a verified, retained digital copy can itself violate the retention rules you were trying to satisfy.

Build the verification into the workflow, not into your memory: a batch is not cleared for shredding until someone has confirmed the scans opened, and the destruction is logged the same day.

A disposal workflow for a practice of one

Build the whole thing once and it runs itself. Keep a locked shred bin for anything with PHI, empty it on a set cadence, and log each destruction with a date and a method. Sign a BAA with any vendor and file each certificate of destruction. Confirm your state retention period and check for holds before every purge. The documentation is what turns 'I shredded it' into something you can prove 4Ref 4HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR has settled improper-disposal cases, including against small practices, and enforces through penalties..

• A locked, opaque shred bin — never an open recycling box — for every scrap with PHI.
• A destruction log: date, general description, method, and who did it.
• A signed BAA and a certificate of destruction on file for every vendor pickup.
• A pre-purge check: state retention period met, and no access, subpoena, or transfer hold open.

The everyday paper, not just the old charts

The disposal standard applies to the small stuff too, and that is where a solo practice actually leaks. A printed schedule with names, a fax cover sheet, a superbill, a sticky note with a message, an abandoned intake form — each carries identifiers, and each belongs in the shred bin rather than the wastebasket by your desk.

Set one rule that is easy to follow: if a page has a name and anything clinical or financial on it, it never touches regular trash. Put a small locked bin at each spot where paper is generated, so the compliant choice is also the nearest one, and empty those into the main shred stream on your set cadence.