Hard Drive Destruction for HIPAA-Regulated Data
Serial-level destruction of hard drives and other data-bearing media for healthcare organizations and their business associates, documented end to end and built to support HIPAA's media-disposal and media-reuse requirements.
- Serialized Certificate of Destruction, Every Device
- Chain-of-Custody Documentation
- Free pickup for qualifying business volumes
An unerased drive doesn't stop being ePHI when it leaves the building
For healthcare IT managers and compliance officers, STS Electronic Recycling destroys hard drives and other data-bearing media to NIST SP 800-88 Rev. 2, processing 245,988 hard drives in the most recent full reporting period alone. Verified overwrite, degaussing, or physical shredding is applied depending on the media, and every device is documented on a serialized Certificate of Destruction that records the sanitization method against it.
For healthcare organizations and their business associates, that destruction and documentation, together with BAA coverage, are built to support a covered entity's media-disposal and media-reuse procedures under HIPAA.
Ask about our FREE pick up!
How Are Hard Drives Destroyed, From Pickup to Certificate?
Destruction, documentation, and processing-location detail for hard drives and other data-bearing media retired by healthcare organizations, their business associates, and any organization handling regulated data.
Destruction Methods
NIST SP 800-88 aligned
Certificates & Chain of Custody
Documentation built for an audit
Nationwide Pickup & Processing
Collected nationwide, processed with full chain of custody
Destruction Methods for Data-Bearing Media
NIST SP 800-88 Rev. 2 sets out Clear, Purge, and Destroy as the federal sanitization categories for media containing sensitive data, and defers to IEEE 2883 for technique detail. Our hard drive destruction service applies verified overwrite, degaussing, and physical shredding, with documentation for every device processed.
Under the HIPAA Security Rule, a covered entity must implement policies for the final disposition of electronic PHI and for removing it from media before re-use. STS's destruction services, Certificates of Destruction, and BAA coverage can support those media-disposal and media-reuse procedures.
NIST SP 800-88 Wipe
Sanitization performed in accordance with NIST SP 800-88 Rev. 2, with verification reporting
Verified Overwrite
Overwrite with read-back confirmation on every device where applicable
Degaussing
Magnetic field erasure for legacy magnetic media holding patient or customer information
Physical Shredding
Facility-based destruction with witness verification available on request
Documentation Built for an Audit
Need proof a hard drive was actually destroyed, not just scheduled for pickup? Every device destroyed receives a serialized Certificate of Destruction, generated on completion. Certificate of Destruction documentation is available for every engagement and can be reconciled against your internal asset register.
In 2013, HHS's Office for Civil Rights settled with a health plan for $1,215,780 after leased photocopiers were returned to the leasing company with electronic protected health information for up to 344,579 patients still on their internal hard drives. Equipment nobody had flagged as a destruction task, and the case is still cited by compliance counsel today as the reminder that every device with a hard drive, not just servers and laptops, is a disposal obligation. (Source: HHS Office for Civil Rights, Affinity Health Plan resolution agreement, 2013.) Healthcare compliance officers frequently select destruction vendors that provide BAA coverage alongside serialized records, the combination STS documents on every engagement.
Serial-Level Records
Each device logged and matched to its Certificate of Destruction entry
Chain of Custody
Documentation from pickup through final processing
Certificate of Destruction
Serialized per device, sanitization method recorded, issued on completion
BAA Coverage
Business Associate Agreement coverage supports HIPAA media-disposal and media-reuse procedures
From Pickup to Processing Facility
Equipment collected nationwide is staged and transported to STS Electronic Recycling's R2v3 certified processing facilities in Jacksonville, Texas and Houston, Texas, where data destruction and material recovery take place.
STS processed 245,988 hard drives in the most recent full reporting period, part of 1,366,386 IT assets processed in that same period. Hard drive and media destruction at this scale is the ordinary workload, not a special project.
Nationwide Collection
Equipment collected from all 50 states and staged for transport
R2v3 Certified Processing
Processed at R2v3 certified facilities in Jacksonville, Texas and Houston, Texas
Certificate on Completion
Certificate of Destruction issued once processing is complete
Chain of Custody
Documentation carries from pickup through final disposition
Built for Organizations Handling Regulated Data
STS Electronic Recycling processed 245,988 hard drives in the most recent full reporting period, part of 1,366,386 IT assets processed in that period, with 52.9% of units routed to reuse. Healthcare organizations, financial institutions, and their business associates send hard drives and other data-bearing media here specifically because of the documentation that comes back with each one.
-
Enterprise-Scale Capacity
Our 250,000 sq ft Jacksonville, Texas facility processes hard drives and other data-bearing media alongside the rest of STS's nationwide recycling volume, with the same serialized documentation on every device.
-
RIOS, Backed by ISO
STS holds RIOS certification, and ISO 9001, ISO 14001 and ISO 45001 held through the RIOS-integrated management system, company-wide.
-
Recognized Track Record
STS is BBB A+ accredited and a three-time Inc. 5000 honoree (2018, 2020, 2021).
-
Documented Chain of Custody
Serial-level records travel with every device from pickup through processing. STS applies the same standard across every industry we serve, including healthcare.
Hard drives aren't the only data-bearing device in the building
From desktop computers to printers and copiers with their own internal storage, we process the full range of electronic equipment that can carry regulated data.
Computing Equipment
Mobile & Network
Office Equipment
What a HIPAA-regulated data disposal auditor will ask about
The standards and certifications behind hard drive and media destruction for healthcare organizations and their business associates.
Secure Recycling
RIOS certification, and ISO 9001, ISO 14001 and ISO 45001 held through the RIOS-integrated management system, cover STS's environmental management and data security controls company-wide.
NIST SP 800-88 Rev. 2
Hard drive and data-bearing media destruction performed in accordance with the federal media sanitization standard, covering Clear, Purge, and Destroy.
R2v3 Certified Processing
Equipment is processed at R2v3 certified processing facilities in Jacksonville, Texas and Houston, Texas.
For healthcare organizations and their business associates, STS's destruction, Certificates of Destruction, and BAA coverage are built to support a covered entity's media-disposal and media-reuse procedures under HIPAA. Hard drive and media destruction records can also support documentation needs under FERPA, FACTA, SOX, and the GLBA Safeguards Rule.
Request Compliance DocumentationWhy Is an Undocumented Hard Drive a HIPAA Finding Waiting to Happen?
A destroyed hard drive with no record is only slightly better than one that was never destroyed at all. For a covered entity or a business associate holding ePHI, the device itself usually isn't the exposure. The gap in the record is.
In 2013, HHS's Office for Civil Rights settled with a health plan for $1,215,780 after leased photocopiers were returned to the leasing company with ePHI for up to 344,579 individuals still on their hard drives. Equipment nobody had flagged as a destruction task. (Source: HHS Office for Civil Rights, Affinity Health Plan resolution agreement, 2013.) Serial-level records across every device type close that exact gap. Compliance officers typically expect certificate-level proof before signing off on a disposal vendor, which is why serial-level records travel with every STS engagement.
No site visit required
against the Certificate of Destruction
method recorded per device
of Destruction on completion
What compliance officers ask before choosing a vendor
Destruction methods, documentation, and processing-location detail for hard drives and other data-bearing media handling regulated data.
What destruction methods do you use for hard drives containing ePHI?
Sanitization performed in accordance with NIST SP 800-88 Rev. 2: verified overwrite, degaussing for magnetic media, or physical shredding, depending on the media and the engagement. Every method is followed by a serialized Certificate of Destruction.
Do you sign a Business Associate Agreement?
STS can enter into a Business Associate Agreement. BAA coverage, together with STS's destruction and documentation, is built to support a covered entity's media-disposal and media-reuse procedures under HIPAA.
What documentation comes with each destruction job?
A serialized Certificate of Destruction listing each device by serial number and sanitization method, plus chain-of-custody documentation from pickup through final processing.
Can you handle photocopiers and other devices with hidden hard drives?
Yes. Photocopiers, printers, and similar office equipment can carry internal hard drives that hold the same regulated data as a server or laptop; our equipment list covers copiers and scanners alongside computing equipment.
Where is the equipment destroyed?
At STS's R2v3 certified processing facilities in Jacksonville, Texas and Houston, Texas. See our NIST SP 800-88 explainer for how the sanitization standard applies at those facilities.
Is pickup free?
Ask about a free pickup for qualifying business volumes.
Still Have Questions?
Our team is ready to discuss your hard drive and media destruction requirements and HIPAA documentation needs.
Where Your Equipment Is Processed
STS Electronic Recycling, Inc. is headquartered in Jacksonville, Texas, and has served schools, businesses, healthcare systems, and government agencies across all 50 states since 2010.
Equipment collected nationwide is staged locally and transported to one of our two R2v3 certified processing facilities in Jacksonville, Texas and Houston, Texas, where all data destruction and material recovery takes place.
The Certificate of Destruction, issued on completion, lists each device by serial number with the sanitization method recorded against it.
Ready to Destroy Hard Drives the Way Your Auditor Expects?
Every device gets a serialized Certificate of Destruction, whether it's one drive or a few thousand, with chain-of-custody documentation to match.
