MDS Alert

Published on Mon Feb 04, 2019 PDF

Question: Our facility is purchasing new smartphones for some key employees, including some of the business administration staff. How do we safely dispose of the old devices?

Maryland Subscriber

Answer: The U.S. Department of Health and Human Services Office of Civil Rights (OCR) points to mobile device disposal as a key point for risk analysis for anyone whose devices — mobile or otherwise— access protected health information. In their July Cybersecurity newsletter, the OCR recommends performing a full risk analysis and points out how much time and money such a step could save by preventing a breach. Your facility may have already anticipated the costs of services like legal counsel or even a public relations firm, and if you haven’t, now is a good time to really think about the afterlife of your devices.

“Devices or media that need to be replaced should be decommissioned and disposed of securely to ensure that either the devices or media are destroyed or any confidential or sensitive information stored on such devices or media has been removed,” the OCR says.

The OCR continues: “Decommissioning is the process of taking hardware or media out of service prior to the final disposition of such hardware or media. Steps organizations can consider as part of its decommissioning process include:

• “Ensuring devices and media are securely erased and then either securely destroyed or recycled;
• “Ensuring that inventories are accurately updated to reflect the current status of decommissioned devices and media or devices and media slated to be decommissioned; and
• “Ensuring that data privacy is protected via proper migration to another system or total destruction of the data.”