HIPAA Help: Shred It, Burn It — But Do It Right

You handle millions of scraps of paper every day, enough for a whole forest. And inevitably you have to get rid of lots of them. But there are a few things you need to be aware of when destroying documents with PHI on them. That’s regulatory jargon for "personal health information."

Don’t destroy them halfway. You could run into huge patient-privacy problems if a few scraps of paper remain hanging around after you’re supposed to have eradicated them. So don’t just rip a paper in half, and then toss it into the recycling bin. Shred it completely, or ask your office manager if there’s a preferred method for disposing of documents.

Stick to the schedule. If your practice has a policy on how long to keep documents before getting rid of them, don’t jump the gun. You could be creating huge legal problems if you destroy documents early. HIPAA requires practices to keep some documents for six years, and other federal laws require certain documents to remain intact for 10 to 30 years. But other documents you can toss after a few months, based on your office’s own policy.

Make a record. For some types of documents, you may have to write down somewhere that you destroyed them. If you’re culling out patient files and consigning some old records to the ashes, ask your manager if you need to create more paperwork to account for the paperwork you’ve rid the world of.

About the Author

Reed Tinsley CPA

This article is written by Reed Tinsley, a Houston, TX-based CPA with over 30 years of experience advising physicians and medical practices across Texas and the United States. Reed holds certifications as a Certified Valuation Analyst (CVA), Certified Healthcare Business Consultant (CHBC), and Certified Financial Planner (CFP), specializing exclusively in the healthcare sector. He is a published author, nationally recognized speaker, and trusted advisor to physicians on accounting & tax, practice management, and financial planning. Schedule a Free Consultation.