Healthcare IT Asset Disposition & HIPAA Data Destruction
When a hospital or clinic retires a device that held patient data, the question that matters later is simple: can you prove what happened to it? BoxQ gives you a documented chain of custody, serial-number records, and Certificates of Destruction that support your HIPAA obligations.
Proof Your Compliance Team Can File
Retired equipment from a healthcare facility carries risk until its data is destroyed and the paperwork is in your hands. Our process is built around the records an auditor or privacy officer will ask for.
A documented chain of custody
From the moment your equipment is unplugged, it stays with BoxQ employees, not subcontractors. Our trained crew removes and palletizes it, and it travels to our Georgetown facility on a GPS-tracked truck.
Serial-number records
Each device can be logged by make, model, serial number, and asset tag, so your records show exactly which workstation, laptop, or drive left your building.
Certificates of Destruction
A Certificate of Destruction ties each data-bearing device to how its data was destroyed, giving your privacy and compliance teams a record they can file.
How Patient Data Is Destroyed
Removable hard drives are physically shredded on our own hard drive shredder at our facility in Georgetown, after GPS-tracked transport by our own employees. Devices with non-removable storage, or equipment that still has resale value, are wiped to NIST 800-88 standards.
Either way, each device is tied to the method used, so your records show not just that data was destroyed but how.
Equipment We Handle
Your team unplugs it. Our own trained employees take it from there: removal, palletizing, GPS-tracked transport, inventory, and documentation.
- Workstations, laptops, and nursing station PCs
- Servers, storage arrays, and backup drives
- Loose and pulled hard drives and SSDs
- Tablets and phones used for patient care
- Printers, copiers, and scanners with internal storage
- Networking equipment and other IT hardware
Documentation built for the standards your auditors work under
Serialized inventories and Certificates of Destruction give your team the records these frameworks ask for.
Cybersecurity standards
- ISO/IEC 27001
- SOC 1
- SOC 2
- PCI-DSS
- NIST 800-53
- NIST 800-171
- TISAX
- CMMC
- ISO/IEC 22301
Policy standards
- GDPR
- HIPAA
- CCPA
- ISO/IEC 27701
- APEC
- HDS
We operate in full alignment with industry-leading disposition standards. To ensure fully auditable responsible recycling, we partner with Colt Recycling—an R2v3 and ISO 9001/14001/45001 certified facility—for all downstream processing.
Questions Healthcare Buyers Ask
- What should a Certificate of Destruction include for devices that held patient data?
- It should identify your organization, the lot or job it covers, the date, how the data was destroyed, and who certifies it. Paired with a serialized inventory, it lets you show which specific devices were destroyed, not just how many.
- Does HIPAA require hard drives to be destroyed?
- HIPAA requires covered entities to dispose of electronic protected health information so it cannot be recovered. Physical shredding or a verified wipe both meet that goal; what matters is that you can document it. BoxQ provides the records; your compliance team decides how they fit your policies.
- Where are our hard drives destroyed?
- BoxQ does not shred on site. Once your equipment is unplugged, our own employees remove it and transport it on a GPS-tracked truck to our facility in Georgetown, MA, where each drive is logged by serial number and shredded on our own hard drive shredder. Your Certificate of Destruction records which drives were destroyed.
From a New England Hospital
“It went very well and we were very pleased with the outcome! Your guys took everything we had without question and did a great job!”
BoxQ has served New England organizations for more than 25 years from our base in Georgetown, Massachusetts, with pickups across Massachusetts, New Hampshire, Maine, and Rhode Island.
Retiring Equipment That Held Patient Data?
Tell us what you are retiring and we will reply with a custom quote within one business day. Once it is unplugged, we handle everything after.