When you retire a server, a workstation, or a drive that held electronic protected health information, the HIPAA Security Rule requires you to have addressed two things in writing: the final disposition of the data and the hardware, and the removal of that data before the media are reused. Both are Required implementation specifications, meaning there is no documented-alternative path. What the rule does not do is tell you how. HHS is explicit that the Privacy and Security Rules do not require a particular disposal method, which puts the burden of choosing a defensible one on you.
What the rule requires
The relevant provision is 45 CFR 164.310(d), the Device and media controls standard, and it is short enough to read in full.
Four implementation specifications sit underneath it, and the labels matter:
| Specification | Status | What it says |
|---|---|---|
| 164.310(d)(2)(i) Disposal | Required | Address the final disposition of ePHI, and/or the hardware or electronic media on which it is stored |
| 164.310(d)(2)(ii) Media re-use | Required | Remove ePHI from electronic media before the media are made available for re-use |
| 164.310(d)(2)(iii) Accountability | Addressable | Maintain a record of the movements of hardware and electronic media and any person responsible therefore |
| 164.310(d)(2)(iv) Data backup and storage | Addressable | Create a retrievable, exact copy of ePHI, when needed, before movement of equipment |
Note the ordering problem hiding in that table. Disposal and media re-use are Required, but the specification that tells you where the equipment went and who had it is only Addressable. An organization can be fully compliant on paper with the two Required items and still be unable to answer the question an investigator asks first, which is: what happened to that specific drive?
Delete is not sanitize
The single most common failure here is treating a delete or a quick format as disposal. Deleting a file removes the pointer to it. A quick format rewrites the file system structures. In both cases the blocks holding the data are usually still readable with recovery software that costs nothing and requires no expertise.
NIST puts a floor under this. Its weakest recognized method, clear, is defined as applying logical techniques to sanitize data in all user-addressable storage locations. A delete does not touch all user-addressable locations, so it does not reach even the lowest rung of the ladder.
Clear, purge, destroy
NIST SP 800-88 defines three sanitization methods, separated by the level of effort each one defeats. The definitions below are the ones in the current revision's glossary.
| Method | Definition | Media remains usable? |
|---|---|---|
| Clear | Applies logical techniques to sanitize data in all user-addressable storage locations, for protection against simple, non-invasive data recovery techniques using the same interface that is available to the user | Yes |
| Purge | Applies physical or logical techniques that render target data recovery infeasible using state-of-the-art laboratory techniques | Usually |
| Destroy | Renders target data recovery infeasible using state-of-the-art laboratory techniques and results in the subsequent inability to use the media to store data | No |
Two definitions are worth pulling out because they get misused in vendor conversations:
- Cryptographic erase is a purge technique, not a category of its own. NIST defines it as key sanitization applied to one or more keys providing confidentiality protections for the encrypted target data, making recovery of the decrypted target data infeasible. It is fast, and it is only as good as the encryption and the key handling underneath it.
- Infeasible is doing careful work in all three definitions. NIST is direct about this: infeasible “acknowledges the possibility of data recovery with future, more advanced technology. It simply means that, for a given level of effort and using current 'state of the art' techniques, recovery cannot be done.” Nobody in this field promises permanence.
HHS uses the same vocabulary in its disposal guidance, describing clearing as using software or hardware products to overwrite media with non-sensitive data, purging as degaussing or exposing media to a strong magnetic field, and destroying as disintegration, pulverization, melting, incinerating, or shredding.
Choosing a method
The regulation gives you latitude and expects you to use it deliberately. HHS says covered entities must review their own circumstances to determine what steps are reasonable, and in determining what is reasonable should assess potential risks to patient privacy and consider the form, type, and amount of PHI to be disposed of. It singles out data whose exposure carries downstream harm, naming social security number, driver's license number, debit or credit card number, diagnosis, and treatment information as examples that may warrant more care because inappropriate access may result in identity theft, employment or other discrimination, or harm to an individual's reputation.
A workable decision rule for most practices:
- Media staying inside the organization, moving between users. Clear is generally the proportionate answer, and media re-use at 164.310(d)(2)(ii) is the specification you are satisfying.
- Media leaving your control but retaining value. Trade-in, resale, donation, or a returned lease. Purge, and keep the evidence.
- Media at end of life, or that failed. Destroy. A drive that will not respond to commands cannot be cleared or purged through its own interface, which is exactly the case people postpone and then forget.
That third row deserves emphasis. The failed drive in a drawer is the most common unsanitized device in a small practice, because the normal disposal workflow runs through the device's own interface and a dead device has none.
Why solid state drives break the old advice
Guidance written for spinning disks does not transfer cleanly to flash, and two mechanisms explain why.
Wear leveling. An SSD controller spreads writes across cells to extend the drive's life. The logical block you overwrite is not reliably the physical cell that held the original data, so a multi-pass overwrite aimed at a logical address can leave the original contents intact somewhere the host cannot address.
Overprovisioning. Flash drives reserve physical capacity the operating system never sees. Data can persist in that reserve, outside every user-addressable location, which is the exact scope the clear method is limited to.
Degaussing has a related problem in the other direction. It works by reducing magnetic flux to near zero, which does nothing to a device that stores no data magnetically. Degaussing an SSD accomplishes nothing at all, and it is a mistake that feels thorough while achieving zero.
For flash media, the practical paths are a purge using the device's own sanitize command, a cryptographic erase on a self-encrypting drive, or physical destruction.
The devices everyone forgets
164.310(d)(1) is written around hardware and electronic media, not around a list of device types. That framing is deliberate, and it catches equipment nobody thinks of as a computer:
- Multifunction printers and copiers. Many retain images of everything scanned, copied, and faxed on an internal drive. A leased unit returned at end of term takes that drive with it.
- Backup tapes and external drives, including the ones in a former employee's desk.
- Point-of-care and diagnostic equipment with local storage.
- Mobile phones and tablets that carried a clinical app or a mailbox.
- Virtual machine images and snapshots, where the media is someone else's and your control runs through a contract rather than a screwdriver.
- Failed drives returned to a manufacturer under warranty. An advance-replacement program that requires you to ship the old drive back is a disclosure of whatever is still on it.
A note on which NIST revision you are reading
This one is worth checking, because a great deal of published guidance has not caught up. NIST SP 800-88 Revision 2 was finalized in September 2025 and supersedes Revision 1, which had stood since December 2014. If you are working from a checklist that cites Revision 1, it is built on a withdrawn document.
The core vocabulary survived the revision. Clear, purge, and destroy are all still there, and cryptographic erase is still classified as a purge technique. Revision 2 reorganizes the material around a media sanitization program and uses the term information storage media (ISM) in place of the older phrasing.
One curiosity to be aware of rather than alarmed by: HHS's own disposal FAQ, whose content was last reviewed in November 2015, still links to a hosted copy of Revision 1. That is a citation lag in the guidance, not a conflict in the law. The regulation at 164.310(d) never named a NIST revision in the first place, which is precisely why it has not needed amending.
The paperwork that makes it provable
Sanitization you cannot evidence is, from an investigator's position, sanitization that may not have happened. Three provisions push toward a record.
The Accountability specification at 164.310(d)(2)(iii) asks you to maintain a record of the movements of hardware and electronic media and any person responsible therefore. It is Addressable, so you may determine it is not reasonable and appropriate and implement an equivalent alternative where one is reasonable and appropriate, documenting the decision either way. Deciding it does not apply and writing nothing down is not one of the available options.
Documentation under 164.316(b)(2)(i) is retained for six years from the date of its creation or the date when it last was in effect, whichever is later. A sanitization log is documentation.
A usable record answers: what the device was and its serial number, what data classes it held, which method was applied, who performed it, when, what tool or vendor was used, and how the result was verified. That last field is the one most often left blank, and it is the one that turns a claim into evidence.
Using a disposal vendor
Outsourcing destruction is normal and HHS contemplates it directly, describing the use of a disposal vendor as a business associate to pick up and destroy PHI. The business associate framing is the part to get right. A vendor handling PHI on your behalf needs a business associate agreement under 164.308(b), and the satisfactory assurances have to be documented through a written contract.
What a certificate of destruction is worth depends entirely on what it says. A certificate listing serial numbers, the method applied, and the date is evidence. A certificate confirming that a quantity of material was received is a receipt.
Worth asking before you sign: is destruction performed on site or after transport, who holds custody in between, does the certificate itemize serials, and what happens to a device that fails in transit? A chain of custody with a gap in it is the gap someone will find later.
Common questions
Does HIPAA require you to destroy hard drives that held PHI?
No. HHS states that the Privacy and Security Rules do not require a particular disposal method. 45 CFR 164.310(d)(2)(i) requires policies and procedures addressing the final disposition of electronic PHI and the hardware or media it is stored on, and 164.310(d)(2)(ii) requires procedures for removing electronic PHI from media before the media are made available for re-use. Both are Required implementation specifications, but neither names a technique. HHS says covered entities must review their own circumstances to determine what steps are reasonable, considering the form, type, and amount of PHI involved. Destruction is one option. Overwriting or a validated cryptographic erase can be appropriate for media you intend to keep using.
Is deleting files or reformatting a drive enough to sanitize it?
No. A delete removes the pointer to the data, and a quick format rewrites the file system structures, but in both cases the underlying blocks generally remain readable with ordinary recovery tools. NIST defines the weakest recognized sanitization method, clear, as applying logical techniques to sanitize data in all user-addressable storage locations for protection against simple, non-invasive data recovery techniques. A routine delete does not meet that bar because it does not address all user-addressable locations. It is also worth remembering that on solid state media, wear leveling means overwritten blocks may not be the physical blocks that held the data.
What is the difference between clear, purge, and destroy?
They are the three sanitization methods NIST SP 800-88 defines, ordered by the level of effort they defeat. Clear applies logical techniques to sanitize data in all user-addressable storage locations, protecting against simple, non-invasive recovery using the same interface available to the user. Purge applies physical or logical techniques that render target data recovery infeasible using state-of-the-art laboratory techniques. Destroy also renders recovery infeasible using state-of-the-art laboratory techniques and results in the subsequent inability to use the media to store data. Cryptographic erase, where the encryption keys are sanitized rather than the data, is classified as a purge technique.
Do copiers and multifunction printers need to be sanitized?
If they store electronic PHI, the same requirements reach them. 45 CFR 164.310(d)(1) governs the receipt and removal of hardware and electronic media that contain electronic PHI into and out of a facility, and the movement of these items within the facility. It is written around media and hardware, not around a list of device categories. Many office multifunction devices contain an internal drive that retains images of scanned, copied, and faxed documents. A leased device returned at end of term leaves the facility with that drive inside it, which is why the disposal and media re-use specifications are worth applying to anything that stores data, not only to servers and laptops.