Every healthcare facility generates paper. Patient intake forms, lab requisitions, insurance authorizations, explanation of benefits documents, prescription pads, appointment reminders — the list goes on. And every one of those documents that contains patient information is protected health information (PHI) under HIPAA.

The HIPAA Privacy Rule doesn't just govern how you use and share PHI — it governs how you destroy it. And the consequences of getting it wrong range from significant fines to reputational damage that's hard to recover from.

What HIPAA Actually Requires for Document Destruction

The HIPAA Privacy Rule (45 CFR § 164.530(c)) requires covered entities to implement policies and procedures to protect PHI from unauthorized use or disclosure — including at the time of disposal. The rule doesn't prescribe a specific destruction method, but the standard is clear: PHI must be rendered unreadable, indecipherable, and otherwise unable to be reconstructed.

For paper records, the HHS guidance specifies that shredding, burning, pulping, or pulverizing the records so that PHI is unreadable meets this standard. Simply tossing documents in a recycling bin — even in a locked office — does not.

The Most Common Compliance Gaps

1. No Formal Destruction Policy

Many smaller practices handle document disposal informally — staff shred what they remember to shred, and the rest goes in the trash. Without a written policy that defines what must be shredded, when, and how, you have no defensible position in an audit or breach investigation.

2. Relying on In-Office Shredders Alone

Desktop shredders are better than nothing, but they create their own problems. Strip-cut shredders (the kind that produce long ribbons) don't meet the standard — documents can be reconstructed. Cross-cut and micro-cut shredders are more secure, but they require staff time, create maintenance issues, and produce no documentation trail. If OCR audits your facility, "we have a shredder in the break room" is not a compliance program.

3. No Certificate of Destruction

This is the most common gap we see. Even facilities that are doing the right thing — using a shredding service — often don't have certificates of destruction on file. A certificate of destruction is your documented proof that PHI was destroyed on a specific date, by a specific vendor, in a compliant manner. Without it, you cannot demonstrate compliance to an auditor.

4. Forgetting Non-Paper PHI

Paper is obvious, but PHI lives on other media too. X-ray films, CD/DVDs with imaging data, old hard drives from retired computers, and even fax machine memory can contain PHI. A complete destruction program covers all of these.

What a Compliant Shredding Program Looks Like

• Locked collection containers placed throughout the facility — not open bins or recycling boxes
• A scheduled pickup cadence that prevents containers from overflowing
• A NAID AAA-certified or equivalent destruction vendor
• A certificate of destruction issued for every service event
• Documentation of the chain of custody from collection through final destruction
• A written policy that defines what documents must be destroyed and the retention schedule
• Staff training on what goes in the shred bin vs. regular trash

HIPAA Fines Are Real — and They Scale

HHS Office for Civil Rights (OCR) enforces HIPAA and has levied fines ranging from $100 to $50,000 per violation, with annual caps up to $1.9 million per violation category. Improper disposal of PHI has been the basis for enforcement actions against practices of all sizes — including a $125,000 settlement against a small physician practice for disposing of paper records in an unsecured dumpster.

Beyond the fines, a breach involving improperly disposed PHI triggers notification requirements — you may be required to notify affected patients, HHS, and in some cases the media. The reputational cost of that notification often exceeds the fine itself.

Building an Audit-Ready Program

The goal isn't just to be compliant — it's to be able to demonstrate compliance quickly and confidently if you're ever audited or investigated. That means documentation: a written policy, a vendor agreement that includes a Business Associate Agreement (BAA), and a file of certificates of destruction going back at least six years (HIPAA's standard retention period for policies and records).

Nu Endeavors provides all of this as part of our secure document shredding service — locked containers, scheduled pickup, certificates of destruction for every service, and a BAA. We make it easy to build a program that holds up under scrutiny.