Every retired hospital device is three things:
data risk, e-waste, and value.
Don’t shred away the value.

Prefer to read it?

Full transcript · Healthcare ITAD: HIPAA Compliance

Every retired hospital device is three things at once: a data risk, e-waste, and value — so the goal is to destroy the data without shredding away the value. Health systems retire tens of thousands of devices a year, each one a HIPAA obligation and often recoverable value.

First, the part you can't get wrong: the HIPAA disposal checklist. Render ePHI unreadable and unreconstructable — deletion and reformatting don't qualify under 45 CFR §164.310(d)(2); map each media type to a NIST 800-88 level, with Purge the practical minimum for PHI-bearing media; sign a BAA before anything is picked up, since any vendor handling PHI is a Business Associate; issue serialized certificates of destruction with make, model, serial, method, date, and technician; and keep an unbroken chain of custody from dock to destruction. OCR data shows most disposal violations are documentation failures, not the method — CyberCrunch checks every box.

One partner delivers three outcomes: certified data destruction under NAID AAA and NIST 800-88 with a signed BAA, documented to the serial; responsible R2v3 recycling with documented downstream and up to 99% landfill diversion; and asset remarketing that returns proceeds through value-share to fund your next refresh. Health systems across the country rely on CyberCrunch as a single certified partner for all three — one engagement, one BAA, one paper trail.

In an illustrative example, a multi-hospital system retiring 20,000–30,000+ assets a year destroys or wipes every data-bearing device to NIST 800-88, routes functional non-risk assets to remarketing instead of the shredder, and commonly tops $1M+ a year in recovered value paid back to fund the next refresh. Actual recovery varies, and data-bearing or high-risk media is always destroyed, never resold.