The document outlines the importance of HIPAA-compliant destruction of medical records to protect sensitive patient information, known as protected health information (PHI). It details various types of medical records and PHI, requirements for retention periods, and methods for proper destruction, including on-site and off-site shredding. Compliance with HIPAA is essential to avoid costly violations, and providers must establish a structured plan for managing and disposing of medical records.

1. MEDICAL
RECORDS
DESTRUCTION
THE GUIDE TO
HIPAA-COMPLIANT
SHREDDING

2. WHAT DO
MEDICAL RECORDS
CONTAIN?
What goes into a
medical record?

3. Protected
Health
Information
(PHI)
Medical records contain
sensitive protected health
information (PHI) about a
person’s health and history.
Disposing PHI with processes for
the proper destruction of medical
records is critical to protecting patient
privacy and hefty penalties from HIPAA.

4. DIFFERENT TYPES
OF MEDICAL
RECORDS & PHI
Common medical
information to destroy

5. Different
Types of
PHI
○ Account Numbers
○ Biometric Identifiers (fingerprints,
retinal scan, etc.)
○ Certificate / License Numbers
○ Device Identifiers and Serial
Numbers
○ Dates
○ Email Addresses
○ Fax Numbers
○ Full Face Photos and
Comparable Images
○ Geographic Data
There are eighteen types of information
defined as PHI and protected under HIPAA:
○ Internet Protocol Addresses
○ Health Plan Beneficiary Numbers
○ Medical Record Numbers
○ Names
○ Social Security Numbers
○ Telephone Numbers
○ Vehicle Identifiers and Serial
Numbers
○ Web URLs
○ Unique Identifying Numbers,
Characteristics, or Codes

6. Different
Types of
Medical
Records
○ Surgical history
○ Obstetric history
○ Medications & medical
allergies
○ Family history
○ Health Habits
○ Immunization history
Common types of medical records healthcare
providers need storage and destruction for
include:
○ Growth chart &
developmental history
○ Physical examinations
○ Chief Complaints
○ Orders & Prescriptions
○ Test Results

7. FACTORING
IN HIPAA
Where does HIPAA fit
in with medical records
destruction?

8. What Is
HIPAA?
According to the HIPAA Privacy Rule, medical records
are required to be stored and maintained for at least
6 years after the date of their creation or date of last
use—whichever comes first.
Passed in 1996, the Health Insurance Portability and
Accountability Act (HIPAA) helps to protect PHI.
HIPAA requires implementing safeguards to prevent
prohibited uses and disclosures of PHI, including
during its disposal.

9. HIPAA Rules
Violations:
The Cost of
Noncompliance
Up to $100 per
violation
$100 – $50,000 (or
more) per violation
$25,000 $1,500,000

10. Medical
Record
Retention:
Diagnostic Images 5 years (after age of majority)
Disease Index 10 years
Fetal Heart Monitor Records 10 years (after age of majority)
Master Patient/Person Index Permanently
Operative Index 10 years
Patient Health Records 10 years after last use
Physician Index 10 years
Register of Births Permanently
Register of Deaths Permanently
Register of Surgical Procedures Permanently

11. MEDICAL RECORDS
DESTRUCTION
& DISPOSAL
When medical records
should be shredded

12. Medical
Records
Destruction
According
to HIPAA HIPAA leaves it up to providers
to decide on destruction
methods, but does not permit
medical records to be discarded
without proper disposal methods
like shredding or electronics
destruction.

13. After Retention
Periods Pass
Your medical
records and
other files
containing PHI
have passed
their required
retention times
Transitions to
Paperless
You’ve just
transitioned to
using electronic
health records
(EHR) and your
paper records
are scanned
Administrative
Mistakes
Clerical errors
were made
while handling
medical records
and a new copy
needs to be
created or filed
When
Medical
Records
Should Be
Destroyed

14. Steps to
Take Before
You Shred
Medical
Records
Establish
a destruction
plan for when
retention times
are up
Create a
plan to store &
track medical
records for
retention
Research
state medical
records
retention
laws

15. Common
Medical
Records
Destruction
Methods
Mobile Shredding
Mobile shred trucks come
to your location, destroying
medical records on-site
while you watch. Since
many need to document
record destruction jobs,
certificates of destruction
are also typically provided
to detail the project
specifics.
Off Site Shredding
Trucks come to your location
to pick up medical records,
but instead of shredding on-
site, the records are taken in
locked bins to an off site
facility. Since trucks don’t
need to stay for shredding,
off site becomes more cost-
efficient the more records
you dispose at one time.

16. Searching for Medical
Record Destruction?
Find HIPAA-Compliant Medical Records Shredding
& Destruction When You Visit Shred Nations Today!