In short
HIPAA-compliant data destruction, R2v3 recycling, and asset remarketing for health systems — one engagement, one BAA, serialized certificates.
Prefer to read it?
Full transcript · Healthcare ITAD: HIPAA Compliance
Every retired hospital device is three things at once: a data risk, e-waste, and value — so the goal is to destroy the data without shredding away the value. Health systems retire tens of thousands of devices a year, each one a HIPAA obligation and often recoverable value.
First, the part you can't get wrong: the HIPAA disposal checklist. Render ePHI unreadable and unreconstructable — deletion and reformatting don't qualify under 45 CFR §164.310(d)(2); map each media type to a NIST 800-88 level, with Purge the practical minimum for PHI-bearing media; sign a BAA before anything is picked up, since any vendor handling PHI is a Business Associate; issue serialized certificates of destruction with make, model, serial, method, date, and technician; and keep an unbroken chain of custody from dock to destruction. OCR data shows most disposal violations are documentation failures, not the method — CyberCrunch checks every box.
One partner delivers three outcomes: certified data destruction under NAID AAA and NIST 800-88 with a signed BAA, documented to the serial; responsible R2v3 recycling with documented downstream and up to 99% landfill diversion; and asset remarketing that returns proceeds through value-share to fund your next refresh. Health systems across the country rely on CyberCrunch as a single certified partner for all three — one engagement, one BAA, one paper trail.
In an illustrative example, a multi-hospital system retiring 20,000–30,000+ assets a year destroys or wipes every data-bearing device to NIST 800-88, routes functional non-risk assets to remarketing instead of the shredder, and commonly tops $1M+ a year in recovered value paid back to fund the next refresh. Actual recovery varies, and data-bearing or high-risk media is always destroyed, never resold.
Read next: the proposed HIPAA Security Rule update would require a technology asset inventory reviewed at least annually — the asset inventory brief explains why that inventory is where disposal begins and ends.
CyberCrunch Shorts · 3 × 30 seconds
How a health system earns back $500,000+ a year
A health system with over 40,000 employees across four states uses CyberCrunch Value-Share: monthly endpoint collection, HIPAA and NIST compliant data destruction, serialized reporting and certificates, then remarketing that pays back more than $500,000 a year.
Read the 30-second script
How does a health system earn back over half a million a year with CyberCrunch? Over 40,000 employees, across four states. Meet Value-Share, for healthcare. Every month, we collect their endpoints. With HIPAA and NIST compliant data destruction. Plus serialized reporting and certificates of destruction. Then we remarket the devices. More than $500,000 paid back, every year. Retired devices. Real revenue.
Retired lab PCs still hold research data
Retired lab PCs can still hold research data. CyberCrunch scans every asset by serial number, seals and tracks it in transit, destroys the data on site or at its facility, and reports on every device in compliance with NIST 800-88.
Read the 30-second script
Retired lab PCs can still hold research data. One lost drive can expose years of research. Meet CyberCrunch, for pharma and life sciences. We scan every asset by serial number. Then we seal and track it in transit. We destroy the data on site or at our facility. With serialized reports for every audit. All in compliance with NIST 800-88. Retire the hardware. Protect the research.
How hospitals keep IT staging areas clear
Hospital IT staging areas keep shrinking. CyberCrunch signs a BAA under HIPAA, picks up on schedule at every site, seals and GPS-tracks every load, and reports on every drive by serial number.
Read the 30-second script
At hospitals, space is always tight, and the IT area gets smaller and smaller. So how do you keep your staging areas clear? Meet CyberCrunch, for healthcare. First, we sign a BAA under HIPAA. Then we pick up on schedule at every site. Sealed and tracked by GPS. With serialized reporting on every drive. $10 million in cyber insurance coverage. Staging areas clear. Patient data protected.
Disclaimer. Figures, projections, statistics, and examples shown in this video are for illustrative purposes only and do not constitute a guarantee or offer. Actual results vary based on factors specific to each engagement. Regulatory references (such as HIPAA, GLBA, PCI DSS, SOX, FERPA, NIST SP 800-88, and state EPR laws) are provided for general information and should be validated by your own legal, compliance, and procurement teams. Program terms, pricing, and service levels are governed by CyberCrunch Terms of Service, and our Privacy Policy applies. All rights reserved. Visit ccrcyber.com for more information.