164.310(d)(2)(i) Disposal: requirements and evidence

164.310(d)(2)(i) disposal: what the requirement asks before a drive leaves the building

If you are retiring servers, laptops, backup tapes or copiers that held electronic protected health information, 45 CFR 164.310(d)(2)(i) requires you to have written policies and procedures for the final disposition of that ePHI and the hardware or electronic media it is stored on. It is a required implementation specification, so you cannot treat it as optional or document a reason for skipping it. The rule sits under the device and media controls standard and asks for a documented process, not a particular tool. The risk is simple: data left on discarded media can often be recovered by someone who has no authority to see it. The difficulty is where ePHI lives. It spreads across endpoints, server volumes, backups, printer and copier hard drives, removable media, and devices held by vendors for repair or lease return. A disposal procedure that covers only the laptops in the asset register will miss the copier that scanned patient forms. Start by asking your asset inventory and backup owners which systems have ever held ePHI, then confirm that each category has a named disposal path. The text of the rule does not prescribe one sanitization method. HHS points to NIST SP 800-88, *Guidelines for Media Sanitization*, as informational guidance, and NIST SP 800-66 Rev. 2 lists implementing methods for final disposal as a key activity. Your policy should state which method applies to each media type, who approves destruction, how the outcome is verified, and how certificates from third-party destruction vendors are kept. Confirm the approach with your own counsel and security officer, because the rule leaves that judgment to you.

Which media and disposal paths fall under 164.310(d)(2)(i)

Disposal policy only works if it covers every place ePHI is stored, including hardware you do not think of as storage. The cards below set out each category, why it falls within the final disposition requirement, and the scoping question to answer before you write the procedure.

Servers and virtual hosts

Physical servers hold databases, file shares and application data that often contain ePHI, and their drives are usually replaced in batches during refresh cycles. Confirm which servers have ever hosted ePHI, including test or reporting copies. For virtual machines, ask whether the disks sit on storage arrays that you will retire, since disposing of the host without addressing the virtual disks leaves ePHI behind. Record the asset owner for each server so the disposition record has a name attached.

Workstations and laptops

Desktops and laptops are the most common disposal events in most organizations, and they often leave service with ePHI in local caches, downloads and synced folders. Ask which devices have accessed ePHI systems, including staff who used local clients or browser sessions. Check whether full-disk encryption was enabled, because that changes how you approach sanitization, but it does not replace a documented disposal step.

Mobile phones and tablets

Phones and tablets used for clinical messaging, email or EHR access store ePHI in apps, caches and backups, and personal devices may sit outside your asset inventory. Confirm whether these devices are company-owned or enrolled in a mobile device management program, and whether the program can wipe them remotely. Ask who is responsible for disposal when an employee leaves with a personal device that still holds ePHI.

Removable and portable media

USB drives, external hard disks, optical discs and memory cards are easy to overlook because they are small and often shared. Ask how many such devices exist, who issued them, and whether any were used to move ePHI for reports or transfers. Media that cannot be tracked to an owner should be treated as in scope until someone proves otherwise, and the disposal procedure should name the method used for each media type.

Backup tapes and archived media

Backup tapes, backup disks and archive sets are frequently retired on schedule and kept in off-site storage that no one reviews. Confirm the backup retention schedule and the vendor that holds the media. Ask whether any tapes contain data for systems that were decommissioned, because those sets remain ePHI even when no live system uses them. Disposal of backup sets needs its own entry in the procedure so that retention and destruction decisions stay linked.

Network storage and multifunction printers

Network-attached storage devices and multifunction printers with scan-to-disk or internal hard drives store copies of ePHI that teams often forget. Ask whether any device in your environment caches documents, scans or print jobs, and whether the vendor offers a documented drive-removal or wipe process. Leased copiers are a common gap, since the storage drive may leave your control when the lease ends.

Media held by hosting and managed service providers

When a cloud host, data center operator or managed IT provider stores or retires hardware for you, final disposition becomes a shared process that must be written into the contract. Ask which provider handles retired drives, whether they issue a certificate or log of destruction, and whether you can review that record. The business associate agreement should state who performs disposal and how you will learn that it happened. Your organization still owns the policy and the evidence that the step occurred.

How an assessor tests disposal of ePHI media

This table compares what an assessor does, what evidence they ask for and where disposal controls usually fail under 164.310(d)(2)(i). Read each row as one test step, and use the evidence column to prepare the records the assessor will request before fieldwork starts. The main takeaway is that an assessor follows a single asset from the register into a disposal record, so the link between the two has to exist before the audit.

Test step	Evidence the assessor requests	Common findings
Review the written disposal policy and procedures	Current policy and procedures for final disposition of ePHI and the hardware or media it sits on, with approval date and owner	Policy exists but names no owner, no trigger for disposal, or no reference to ePHI on media
Sample retired assets from the asset register	Asset register extract showing media marked retired, decommissioned or pending disposal, with serial numbers and storage locations	Retired devices are missing from the register, or status fields are not updated when equipment leaves service
Trace each sampled asset to a disposal record	Sanitization log, destruction ticket or chain-of-custody form that names the same asset identifier and a completion date	No record links the asset to a disposal event, so the assessor cannot confirm the media was handled
Check that the method fits the media type	Documented method for each media class, such as magnetic disks, solid-state drives, optical media, mobile devices and paper-backed media, with the reference standard used	One generic method is applied to all media, or flash storage is overwritten where it requires physical destruction
Confirm vendor certificates of destruction	Signed certificate of destruction from the third-party disposal provider, listing serial numbers or quantities and the destruction method	Certificate is generic, lists no serial numbers, or is missing for a shipment that left the facility
Match sanitization and destruction records to the inventory	Reconciliation between the asset register, disposal logs and vendor certificates, showing counts and identifiers that agree	Counts differ between records, and the organization cannot explain units that appear in one source but not another
Check disposal of cloud and virtual storage	Documented approach for deprovisioning virtual disks, snapshots and cloud storage, with provider confirmation of data erasure where available	No defined method for cloud or virtual storage, so deleted volumes and snapshots are never addressed
Interview staff who perform disposal	Staff can describe the steps they follow and where records go, and the steps match the written procedure	Staff follow an informal practice that differs from the documented policy

How to implement a disposal procedure that produces evidence

This sequence turns the disposal requirement in 164.310(d)(2)(i) into a documented, owned procedure in which every retired device or medium has a traceable record of how its ePHI was removed or destroyed. Each step ends with an artifact an assessor or OCR investigator can inspect.

Assign a named owner for disposal
Name one accountable person, usually from IT operations or the security function, and record who approves the procedure and who signs disposal records. The owner coordinates with facilities, procurement and any disposal vendor, and is the person who answers an auditor's questions about how media leave the organization. The output is a signed assignment in the security policy or a role description. Confirm with your own leadership that the owner has authority to stop a disposal that lacks documentation.
Inventory every media type in scope
List each place ePHI can sit at rest that may eventually be retired: servers, laptops, desktops, mobile devices, removable drives, backup tapes, printers with storage, network storage arrays, copiers, and cloud-hosted volumes you control. Start from your existing asset inventory and check it against system owners' lists, because storage hidden in medical imaging devices, appliances or shared drives is often missed. The output is a media register that states the device class, the system it supports and whether it can hold ePHI.
Write a method for each media type
For every class in the register, document the final disposition method: for example, overwriting or cryptographic erase for drives that will be reused, and physical destruction for drives that will not. Reference the sanitization approach in NIST SP 800-88, which HHS lists among its informational Security Rule resources, and state which method you chose and why it fits each media type. Have the security owner and a system administrator approve the document. The output is a signed disposal procedure with one method per media type and a stated rule for what happens when a method fails.
Link each retirement to an asset record
Before any device leaves inventory, open a retirement ticket that references its asset record, including serial number, asset tag, last known custodian and the system it held ePHI for. If you run an open-source asset register such as GLPI, the Assets module can hold these records and the GLPI Agent can keep hardware details current. If you run Wazuh, its system inventory can confirm what software and hardware each endpoint reported before retirement. The output is a retirement ticket tied to a specific asset record, which connects the disposal to the accountability specification in 164.310(d)(2)(iii).
Run sanitization or destruction and log the result
Carry out the chosen method and record who performed it, the date, the asset identifier, the method used and the outcome, including any device that failed verification and was re-processed or destroyed. Verification should be recorded as a separate check, not assumed from the tool exit status. The output is a disposal log entry for each item, kept with the retirement ticket. Keep the log so that a reviewer can reconstruct every disposal from a sample of asset records.
Obtain vendor documentation for third-party disposal
If a recycler, destruction company or hardware lessor handles any media, ensure your contract requires the vendor to document the method and to provide a certificate of destruction or sanitization for each batch or serial number. Check that the vendor's stated method matches your procedure, and that the contract covers chain of custody during transport and storage. This is also where a business associate agreement may apply, which the organization type and vendor pages cover in more detail. The output is a signed vendor agreement and a certificate for each disposed batch, filed against the retirement tickets.
Review the procedure after changes
Revisit the media register and disposal methods whenever you adopt new storage types, change hosting, change a disposal vendor or when a method is found to fail. Record the review date, reviewer, changes made and the reason, and keep prior versions available because the documentation standard in 164.316 requires documentation to be kept and updated. The output is a version-controlled procedure with a revision history and a dated review record. Confirm your own retention period for these records against your legal and contractual obligations.

Which sanitization methods HHS points to and what NIST SP 800-88 adds

The Security Rule does not name a sanitization method for 164.310(d)(2)(i) Disposal. What it requires is a documented policy and procedure for the final disposition of ePHI and the hardware or media that hold it. HHS points covered entities and business associates to NIST publications for the technical detail, and the one it names for media is NIST SP 800-88, *Guidelines for Media Sanitization*. HHS describes those publications as informational and not legally binding, so the legal duty stays with your written procedure, while NIST supplies the vocabulary and method choices an assessor will expect you to have considered. Confirm the current wording of the publication directly on the HHS Security Rule guidance page and in NIST's own release before you cite it in a policy.

In plain terms, NIST's sanitization guidance groups methods into families: clear, purge and destroy. Clearing removes data through ordinary write operations and protects against casual recovery. Purging applies stronger techniques intended to resist more capable recovery. Destruction renders the media unusable and the data unrecoverable through physical means. The central idea is that the method should match the media type and its risk. A spinning disk, a solid-state drive, a phone, a printer with a hard drive and a backup tape do not respond to the same technique in the same way, so one blanket method is rarely defensible. Your procedure should list each media type you use and the family you apply to it, along with who verifies the result and how that verification is recorded.

NIST SP 800-66 Rev. 2 treats implementing methods for the final disposal of ePHI as a key activity under device and media controls, and it offers sample questions an assessor might ask. Use it as a checklist for your procedure: does the policy cover every device class, including those held by a managed IT provider or a cloud host? Does it say what happens to equipment leased back to a vendor? Does it keep a record of each disposal that links to the asset inventory? Method details, including which techniques suit which media and how verification should be done, change over time, so confirm the current content in the NIST publications themselves rather than relying on a summary, including this one.

Evidence that satisfies the disposal specification

Disposal is tested by evidence, not by intent. The written policy sets the rule, and the records below show that each device or medium holding ePHI was actually handled under it, from the asset record through sanitization to a final certificate or log entry.

Written disposal policy and procedure

The policy states how ePHI and the media that hold it are finally disposed of, who approves disposal, which sanitization method applies to each media type, and who signs off the record. Assessors look for a document that names an owner, a review date and the link to the asset inventory. Check that the procedure covers paper and electronic media, leased equipment and cloud-hosted storage, and that staff can point to the current version. This is the starting point every other record refers back to.

Disposal log tied to asset identifiers

A disposal log is a register of each retirement event, with one row per device or medium, its asset tag or serial number, the date, the reason and the person responsible. Assessors test whether the log can be matched to the inventory, so a serial number that appears in the log should also appear in the asset record. Confirm that your log can be exported, that entries cannot be edited silently after the fact, and that it covers devices returned by vendors and leased equipment.

Sanitization records for each device

For each device or medium, keep a record of the sanitization method used, the tool or procedure, the operator, the start and end time and the verification result. The method should match the guidance your team has adopted, and HHS points to NIST SP 800-88 as informational reference. Ask your own technicians which records their tools produce, and whether a failed verification blocks the device from leaving the facility until it is re-processed.

Vendor certificates of destruction

When a third party shreds drives, degausses media or takes equipment for recycling, obtain a certificate of destruction that lists each item by serial number or quantity, the method and the date. Your business associate agreement should require this document and the vendor's own controls over custody during transport. Confirm whether the vendor will provide the certificate for each batch, how long it retains its records, and what happens if a lot cannot be reconciled to your inventory.

GLPI asset record for the disposal log

GLPI's Assets module can hold the asset record that a disposal entry points to. It manages computers, monitors, network equipment, peripherals and other hardware, entered manually or pushed by the GLPI Agent through native inventory built into GLPI since version 10. Use the asset's status field to mark it for retirement and keep the serial number as the join key. Confirm in your own environment which disposal-related fields and statuses are available and whether your version records the date and person for each status change.

Wazuh inventory before retirement

Wazuh Syscollector collects hardware, operating system, installed software, network interfaces and users from each endpoint and stores them in the Wazuh indexer for inventory views and reports. Export the last inventory snapshot before a machine is wiped, so the disposal file shows what software and accounts were present. This does not prove sanitization. Confirm which Syscollector fields your agent version reports and how long snapshots are retained in your deployment.

Exception records

An exception record documents any disposal that departs from the policy, such as a drive that failed sanitization, a device destroyed on site without a certificate, or media disposed of after a loss event. Each entry should state the reason, the compensating step taken, the approver and the follow-up date. Under the addressable and required framing of the Security Rule, assessors expect to see the reasoning, not just the outcome. Review exceptions at a set interval and confirm that recurring exceptions lead to a policy change.

What meeting the disposal requirement costs in money and effort

This table breaks the cost of meeting 164.310(d)(2)(i) into components, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. No dollar figures or durations are supplied for this requirement, so use the table to structure quotes and internal budgets, and confirm every number with the vendors and your own environment.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it up or down
Disposal policy and procedure drafting	Internal privacy or security staff, or an outside consultant if scoped	One-time, then reviewed periodically	Number of media types, sites and disposal vendors the policy must cover
Asset inventory cleanup	Internal IT staff, sometimes with a services partner	One-time, then ongoing as assets change	Age of records, number of untracked devices and whether storage is cloud or on-premises
Sanitization tooling or software licenses	Software vendor or open-source project maintainers	Usually recurring if licensed; confirm separately	Method chosen, number of endpoints and whether tools cover servers, storage arrays and cloud volumes
Internal engineering time per retirement	Internal IT or platform engineers	Recurring with each device, drive or storage volume retired	Media volume, hardware refresh cycles and how much sanitization is automated
Destruction vendor fees	Certified destruction or recycling vendor	Recurring per pickup or batch; confirm the pricing basis in writing	Number of vendors, volume of physical media, and whether certificates of destruction are included
Evidence upkeep	Internal compliance or IT staff	Recurring, with each disposal event and each review	Logging method, whether records are centralized and how many sites produce evidence
Auditor sampling time	Independent auditor or assessor, billed by the engagement	Recurring with each assessment cycle	Number of disposal events sampled and how quickly records can be produced on request

Who owns disposal, who can outsource it, and where the auditor stops

Your organization owns the disposal policy and every decision that ends the life of a device or medium holding ePHI. The Security Rule places the duty on the covered entity or business associate itself, so no vendor, partner or auditor can take it over. Your security official, privacy staff and the owners of the affected systems should agree on which sanitization methods are acceptable for each media type and who approves each disposition.

Policy and method approval: Write the final disposition policy and approve the sanitization methods for each media class, including whether a method follows NIST SP 800-88 guidance.
Disposition decisions: Decide, case by case, whether a device is wiped, reused, destroyed or returned, and record the decision.
Sign-off: Name the individual who signs off on each disposal and who can overrule a decision.
Vendor selection: Choose and contract any destruction or recycling vendor, and keep its certificates of destruction on file.
Exceptions: Approve any deviation, such as a failed wipe or a device that cannot be sanitized, and document the compensating action.

Confirm that the policy names an accountable owner for each step before any outside party starts work.

Where disposal programs usually fall short and how to close the gap

Disposal programs tend to fail at the edges: equipment that left the asset register without a record, copies of ePHI that sit outside the main systems, and policies that say "securely destroy" without naming how. Each card below pairs one gap with a concrete fix that an assessor can test against 164.310(d)(2)(i).

No disposal record for retired hardware

Laptops, servers and phones are often wiped informally, handed to a recycler or stored in a closet with no entry showing what happened to them. Under 164.310(d)(2)(i), the organization needs to show the final disposition of the hardware that stored ePHI. Check that every retirement creates a ticket that records the serial number, the sanitization method used, the person who approved it and the date. Keep a certificate of destruction or wipe log with each ticket.

Backup media forgotten

Tape sets, external drives and replicated backup volumes are usually missing from the retirement workflow because they were never linked to a production system. A decommissioned backup appliance can still hold full copies of patient records. Build the disposal checklist from the backup inventory as well as the asset inventory, and confirm that backup retention expiry triggers the same sanitization step as hardware retirement.

Cloud and virtual disks not covered

Snapshots, block volumes, object storage buckets and virtual machine disks can hold ePHI long after an instance is terminated, and the physical media belongs to the cloud provider. The disposal policy should say how the organization deletes these resources, whether it uses cryptographic erasure where the provider supports it, and how it confirms that deleted snapshots are not retained by a backup job. Ask the provider to document its media sanitization for the services in use.

Printers and copiers with storage excluded

Multifunction devices write scanned pages, print jobs and fax images to internal drives, and many are leased and returned without anyone clearing them. These devices fall outside most endpoint inventories. Add every device with storage to the asset register, record whether its drive is removed or overwritten at lease return, and get the vendor's written statement of how the drive is cleared.

Vendor destruction certificates missing

When a recycler, shredding company or data destruction service handles media, the covered entity or business associate still needs proof of what was done. A missing certificate leaves the organization unable to show the final disposition of the ePHI. Require the vendor to name the media received, the method used, the date and the serial numbers where applicable. Put the destruction vendor under a business associate agreement where it touches ePHI, and file the certificates with the disposal tickets.

Policy that does not name a method per media type

A policy that says media will be disposed of securely does not tell staff what to do with a hard drive, a flash drive or a tape. NIST SP 800-66 Rev. 2 treats the implementing methods for final disposal as a key activity, and HHS points to NIST SP 800-88 for sanitization guidance, which is informational rather than binding. Write a table in the policy that lists each media type, the sanitization method (clear, purge or destroy), the verification step and the person who signs off. Review the table when new media types enter use.

Questions buyers ask about HIPAA disposal before hiring help

How much effort does documenting HIPAA disposal take?

The effort depends on how many device types, storage locations and disposal routes your organization uses, and on how much of the work already exists in writing. The rule requires written policies and procedures for the final disposition of ePHI and the hardware or media it sits on, so the core document is a disposal procedure that names each asset class, the method used for it, who approves the disposal and where the record is kept. Teams with a current asset inventory and an existing vendor contract for destruction usually have less to write than teams starting from scratch. Ask any partner to show how the disposal procedure ties to your asset register and retention schedule before agreeing on scope.

Can our organization handle HIPAA disposal without outside help?

Yes, a covered entity or business associate can write and run its own disposal policy, and the Security Rule does not require outside help. The work that is hardest to do in-house is usually the evidence trail: keeping a current inventory of every laptop, server, drive and backup medium that may have held ePHI, and matching each one to a sanitization method and a disposal record. Organizations with a small, stable fleet often manage this with an internal owner. Organizations with many sites, cloud-hosted storage or frequent hardware refresh cycles tend to bring in help for the inventory and documentation. Whichever route you choose, the organization keeps responsibility for the outcome.

What would a partner do for disposal, and what stays with our team?

A partner can prepare the working parts of the program: mapping which systems and media hold ePHI, drafting the disposal procedure, setting up asset records in an inventory tool, and documenting how each sanitization method is applied and verified. Your team keeps the decisions and the accountability. That includes approving the disposal method for each media type, signing off on exceptions, choosing and managing any external destruction vendor, and retaining the records. Under DeployOpen's fixed-scope model, the split of tasks and deliverables is written into the agreed scope before work starts, so each side knows what it owns. A partner does not issue an audit report or certify your disposal.

Does a certificate of destruction satisfy the HIPAA disposal rule by itself?

No, a certificate of destruction is one piece of evidence, not the whole requirement. The rule asks for policies and procedures covering the final disposition of ePHI and its hardware or media. A vendor certificate can show that a specific drive was destroyed on a specific date, but it does not show that you identified the device as holding ePHI, chose a suitable method, tracked the item through custody, or updated the inventory. Auditors and OCR investigators typically look for the whole chain: the policy, the asset record, the method and the disposal evidence together. Ask your destruction vendor which sanitization standard it follows and what its certificate actually states.

How long does HIPAA disposal work take to complete?

The duration depends on the number of assets in scope, how many locations and storage types are involved, and whether the inventory and procedures already exist. Organizations with a large or scattered estate need more time to build the asset list and verify each item than organizations with a small, well-recorded fleet. Scope also changes timing, for example whether cloud storage, backup media and legacy systems are included. Duration should be agreed in a written scope before the work starts, with the asset count, locations and deliverables listed so both sides can measure progress against them.

Does HHS certify that our disposal process is compliant?

No, HHS does not certify compliance with the Security Rule, and it does not endorse or recognize private certifications. HHS has stated that no Security Rule standard requires an entity to certify its compliance and that such certifications do not prevent HHS from later finding a violation. For disposal, this means no HHS letter or badge exists that proves your process is adequate. What you can show is a written procedure, complete records and evidence that the procedure was followed. An independent assessor may test those records and report on them, but that report is an assessment result, not an HHS certification.

What changes for disposal if the proposed Security Rule is finalized?

The proposed revision of the Security Rule, published in January 2025, would make many current addressable specifications required, so an approach you treat as optional today could become mandatory. Disposal is already a required specification, so the core obligation to have written disposal procedures is unlikely to disappear. The practical change to watch is how much documentation and verification the revised text expects, including asset inventories and testing of controls. As of the latest information available, no final rule has been published, and the Unified Agenda shows final action projected for July 2027. Confirm the current status of the rulemaking on the Federal Register and reginfo.gov before you plan changes to your procedure.

Which sanitization method should our disposal procedure name?

The rule does not name one method, but HHS points covered entities to NIST SP 800-88, Guidelines for Media Sanitization, as informational guidance. NIST SP 800-66 Rev. 2 lists implementing methods for final disposal as a key activity of device and media controls. Your procedure should match each media type to a method, such as clearing, purging or physical destruction, and explain why that method suits the risk. Your engineers and destruction vendor should confirm that the chosen method fits each device type, including solid-state drives and cloud volumes, which may not respond to the same techniques as spinning disks. Record the method used for each item.

How DeployOpen scopes and prepares disposal evidence

DeployOpen plans, implements and documents the technical side of disposal for self-hosted systems inside your own infrastructure, so your disposal policy has inventory records and sanitization evidence behind it. The covered entity owns the policy and its decisions, and an independent assessor or auditor reviews the result.

How we scope

Agree in writing which systems, storage media and disposal paths fall under the disposal policy and procedures.
Inventory where ePHI is stored, including endpoints, servers, backup media and retired hardware awaiting disposition.
Confirm with your team which sanitization methods your policy adopts, citing NIST SP 800-88 as informational guidance.

How we build

Configure GLPI Assets to record each device and its disposal status, with records entered manually or pushed by the GLPI Agent.
Use Wazuh Syscollector inventory to confirm which endpoints still report and which have been removed from service.
Draft disposal procedures and checklists for hardware destruction, sanitization and certificate of disposal capture.

How we hand over

Deliver the disposal policy, procedures and sanitization records as documents your staff can operate and maintain.
Provide asset-status exports and inventory reports showing each item's disposal date, method and responsible person.
Walk your security official through the evidence so they can present it to an independent assessor or auditor.

How we support

Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
Ongoing support, upgrades and continuous testing are available as a retainer if disposal records need regular review.
Confirm with DeployOpen during scoping which assessment or audit evidence your organization requires before work begins.