Updated November 2026 · Southern New Hampshire
HIPAA document shredding: a workflow and policy for small practices
Good HIPAA document shredding follows patient paper from the front desk to the shredder and shows who touches it at each step. It ends with a one-page disposal policy you can copy, fill in and hand to your team this week.
99¢ per pound at our Tewksbury drop-off. Certificate of Destruction on every job.
- 99¢ per pound
- Since 2007
- BBB A+ rated
- HIPAA BAA on request
Quick answer
HIPAA document shredding for a small practice comes down to a written routine: a locked bin wherever paper PHI is created, one named person who empties the bins on a set day, a locked closet and a log for sealed boxes, destruction so the paper cannot be read or reconstructed, and a certificate filed with your policy. HHS says paper PHI may be shredded, burned, pulped or pulverized, and that a disposal vendor can act as your business associate. New Hampshire Document Shredding runs that last step as a medical shredding service for NH practices at 99 cents per pound plus $34.90 per job, with a Business Associate Agreement on request.
Where HIPAA document shredding starts: mapping your paper
Most practices think about shredding when a closet is full. Start instead with a walk through the office and a notepad. Every printer, fax tray and clipboard that touches a patient name needs a short path to a locked bin.
The legal frame is short. Paper falls under the Privacy Rule safeguard duty at 45 CFR 164.530(c), which says a covered entity “must reasonably safeguard protected health information from any intentional or unintentional use or disclosure” that breaks the rules. The Security Rule disposal standard at 45 CFR 164.310(d)(2)(i) covers electronic PHI and the media it sits on, not paper. If you want the rules laid out one by one, our checklist of HIPAA shredding requirements does that. This guide is about the daily routine.
| Area | Paper it produces | Where the bin goes | Who empties it |
|---|---|---|---|
| Front desk and check-in | Sign-in sheets, intake forms, copies of insurance cards and IDs, daily schedules, phone message slips | Under the counter, out of reach of the waiting room | Front desk lead |
| Exam rooms and clinical stations | Printed visit summaries, lab printouts, referral drafts, medication lists, sticky notes with names | One shared bin per hallway or nursing station | Clinical lead or medical assistant |
| Billing office | Superbills, claim forms, EOBs, remittance advice, statements, collection letters | Beside the billing printer | Billing manager |
| Records room | Charts past their retention period, pulled in batches | Sealed boxes, never an open bin | Privacy officer approves each batch |
Billing paper is easy to underestimate. An explanation of benefits carries a diagnosis code, a policy number and a date of service on one sheet. Our post on EOB and patient billing retention covers how long those need to stay on file before they join the shred pile.
Locked bins in every room that makes PHI
The single habit that prevents most paper incidents is a locked bin within arm’s reach of the person printing. If staff have to walk a sheet across the office, it ends up in the recycling basket under the desk. Proximity beats any memo.
Use any lockable container you trust: a locking bin with a slot, a lockable file box or a locked cabinet drawer with a slot cut in the top. We do not sell or rent consoles, and you do not need a branded one. What matters is that the lid stays locked, the slot is too narrow for a hand, and only one or two people hold keys.
HHS gives a hint in its disposal FAQ, which mentions keeping PHI “in opaque bags in a secure area.” Once paper leaves the bin, it goes into a closed box or opaque bag, never a clear trash liner.
- Keep the key off the bin. A key on a hook beside the lock is not a lock.
- Remove open “to shred” boxes from desks and break rooms. They invite reading.
- Tell the cleaning crew in writing that locked bins are not trash and are never emptied by them.
- Keep x-ray film, imaging CDs, USB sticks and old drives out of paper bins. They go in a separate labeled bag.
Who does what in a five to fifteen person office
Small practices rarely have a compliance department. Give each task one owner and one backup, and write those names into the policy.
Privacy officer
Owns the policy and the log. Approves records-room batches against the retention schedule, signs the BAA and files each certificate.
Front desk lead
Empties the front desk and fax bins on the set day, seals the box, labels it with the date and area, and carries it straight to the locked closet.
Clinical lead
Does the same for exam rooms and nursing stations. A printed summary left in a room is PHI, even half a page.
Billing manager
Empties the billing bin and flags batches of old claims for the privacy officer, so retention is checked first.
Specialty offices add a wrinkle or two. Therapy practices keep notes that call for tighter handling, which our page on mental health records shredding covers. Dental offices mix charts, insurance forms and film, and our guide to dental office shredding walks through that mix.
The HIPAA document shredding workflow, front desk to certificate
This routine takes about fifteen minutes a week once it is set up, and it leaves a paper trail an auditor can follow from the bin to the certificate.
- Drop it in the nearest locked binAny sheet with a patient name, date of birth, account number or clinical detail goes in the bin the moment it is no longer needed.
- Empty on a fixed dayThe named owner opens the bin on the same day each week, pours the paper into a box or opaque bag and closes it on the spot. Staples and folders can stay in.
- Seal, label and logTape the box, write the date and area on it, and add one line to the log: date, area, number of boxes, initials. That line is your chain of custody inside the building.
- Store in a locked closetBoxes wait behind a locked door with the log, never in a hallway or a staff car. Our post on chain of custody shredding explains why this is where most leaks happen.
- Send it for destruction on scheduleDrive the boxes to our Tewksbury counter or book a pickup. Either way the paper is cross-cut shredded at 1215 Main Street, Unit 115, and the shred is recycled.
- File the certificate with the logStaple or scan the Certificate of Destruction to the matching log page. The box count on the certificate should match the count you wrote down.
How often to send boxes out, and what each rhythm costs
The trip to the shredder is a separate decision from the weekly emptying, and the per-job fees make it a money question. Every job carries a $14.95 HIPAA filing fee for the certificate paperwork and a $19.95 environmental fee for recycling, $34.90 in all, however many boxes you bring.
Take a practice that fills twelve banker’s boxes a year. The chart shows that paper sent out on four rhythms at drop-off prices.
| Rhythm | Boxes per job | Price per job | Jobs per year | Yearly total |
|---|---|---|---|---|
| Monthly | 1 (about 30 lb) | $29.70 + $34.90 = $64.60 | 12 | $775.20 |
| Quarterly | 3 (about 90 lb) | $89.10 + $34.90 = $124.00 | 4 | $496.00 |
| Twice a year | 6 (about 180 lb) | $178.20 + $34.90 = $213.10 | 2 | $426.20 |
| Once a year | 12 (flat $20 each) | $240.00 + $34.90 = $274.90 | 1 | $274.90 |
Once a year is cheapest, but it means a year of patient files in a closet. Our view: quarterly suits most small offices. The closet never holds more than a few boxes and you pay the per-job fees four times instead of twelve. If a pickup suits you better, add the zone fee to each job: $129.95 in Zone 1, $159.95 in Zone 2 or $199.95 in Zone 3. Our post on what medical shredding costs per month runs more examples.
Getting the boxes shredded: drop-off, pickup or witnessed
HHS lists “using a disposal vendor as a business associate to pick up and shred or otherwise destroy the PHI” as one example of proper disposal. If you use one, the contract rules sit at 45 CFR 164.504(e). New Hampshire Document Shredding signs a Business Associate Agreement on request. Get it signed before the first box leaves your closet.
Drop-off
Bring sealed boxes to 1215 Main Street, Unit 115, Tewksbury, on a weekday between 10 a.m. and 5 p.m. No appointment. Paper is shredded the same business day. See drop-off shredding for parking and unloading.
Pickup
Book a time and our driver collects the boxes from your closet. Same shredding rate plus a zone fee, and the paper is shredded at our office after it arrives. Details are on our off-site shredding page.
Witnessed
Watch the boxes go through the shredder in Tewksbury and take the signed certificate home. $1.99 per pound with a $100 minimum, plus $34.90. Useful for a closing practice or very sensitive files. See witnessed shredding.
From the Salem or Pelham line the drive is about 15 minutes down I-93 or Route 38. Greater Nashua and Manchester are usually Zone 2, and the Seacoast Zone 3. The zone is confirmed when you book. Before a pickup, our shredding pickup checklist covers access, box counts and what the driver needs.
Training the team in fifteen minutes
Training is where small practices most often have a paperwork gap. HHS says covered entities “must ensure that their workforce members receive training on and follow the disposal policies and procedures,” and that anyone who disposes of PHI or supervises people who do “must receive training on disposal. This includes any volunteers.”
The Privacy Rule training standard at 45 CFR 164.530(b) asks you to train each new workforce member “within a reasonable period of time after the person joins,” and again when a material change in policy affects their job. A short session at a staff meeting, with a sign-off sheet, covers it for most offices.
What to cover
- What counts as PHI on paper, with three real examples from your own office.
- Where each bin is, who holds the keys and the emptying day.
- Media goes in a separate bag, never in a paper bin.
- What to do if PHI turns up in a trash can or recycling bin.
How to record it
Keep a one-page sign-in sheet with the date, the topic and each person’s signature. File it with your policy. Under 45 CFR 164.530(j)(2), required HIPAA documentation must be kept “for six years from the date of its creation or the date when it last was in effect, whichever is later.”
A one-page paper PHI disposal policy you can copy
The Privacy Rule at 45 CFR 164.530(i) asks for policies “reasonably designed, taking into account the size and the type of activities” of the practice. For a small office, one page is enough. Copy the template, fill in the brackets, have the owner sign it and train everyone on it. Review it once a year.
[Practice name] paper PHI disposal policy
Effective date: [date] · Approved by: [owner or administrator] · Next review: [date one year out]
1. Scope
This policy covers the disposal of protected health information on paper at [practice name], [street address, town], NH. Electronic media such as drives, phones, USB sticks, imaging CDs and film follow our separate media disposal policy under 45 CFR 164.310(d)(2)(i).
2. Responsibility
- Privacy officer: [name]. Backup: [name].
- Bin owners: front desk [name], clinical areas [name], billing [name].
3. Collection
- Paper with a patient name, date of birth, account or insurance number, or any clinical detail goes into a locked bin. It never goes into trash or recycling.
- Locked bins are kept at: [front desk], [exam hallway], [billing office], [fax and print area].
- Keys are held by the bin owners and the privacy officer only.
4. Emptying and storage
- Bin owners empty their bins every [day of week] into a box or opaque bag, seal it and label it with the date and area.
- Sealed boxes are stored in [locked room or closet] until they leave the building.
- Each box is recorded in the disposal log with the date, area, box count and initials.
5. Retention check
Records from the records room are boxed only after the privacy officer confirms the retention period in [retention schedule name] has passed and no legal hold applies.
6. Destruction
- Vendor: [vendor name and address]. Business Associate Agreement signed on [date].
- Method: cross-cut shredding so PHI cannot be read or reconstructed.
- Rhythm: every [quarter], or sooner when the closet holds [number] boxes.
7. Proof
Each Certificate of Destruction is filed with the matching log page in [binder or folder] and kept at least six years.
8. Training and incidents
- All workforce members, including volunteers, are trained at hire and when this policy changes. Sign-off sheets are kept with this policy.
- Anyone who finds PHI in trash, recycling or any open area reports it to the privacy officer the same day.
Signed: ______________________ Date: __________
The log and the certificate should agree. If the log says eleven boxes left in March and the certificate says nine, sort it out that week. Our page on the certificate of destruction shows what each field records and how to match it to your log.
We do not give legal advice and cannot tell you when a particular record may be destroyed. Retention periods for charts come from your licensing board, payers and malpractice carrier. Confirm them before you set the schedule in section 5.
Frequently asked questions
Does HIPAA require shredding, or just safe disposal?
HIPAA does not name one method. HHS says the rules “do not require a particular disposal method,” but covered entities may not dump PHI in containers the public can reach. For paper, HHS lists shredding, burning, pulping or pulverizing so PHI cannot be read or reconstructed. Cross-cut shredding is the method most small practices choose because it is simple to document.
Which HIPAA rule covers paper records?
Paper falls under the Privacy Rule safeguard duty at 45 CFR 164.530(c), which requires appropriate administrative, technical and physical safeguards for PHI. The Security Rule disposal standard at 45 CFR 164.310(d)(2)(i) covers electronic PHI and the hardware or media it is stored on. Your policy can cover paper on one page and point to a separate media policy for drives and devices.
Do we need a locked shredding console from a vendor?
No. What matters is that paper PHI sits in a container that is locked, close to where it is printed, and emptied by a named person. A locking bin with a slot, a lockable file box or a locked drawer all work. We do not sell or rent consoles. You bring the sealed boxes to us or book a pickup.
How often should a small practice shred?
Empty the bins weekly inside the office, then send boxes out on a fixed rhythm. Quarterly suits most small practices. Twelve boxes a year sent quarterly cost $496.00 at drop-off, against $775.20 if you go monthly, because the $34.90 per-job fee is charged once per job. Annual is cheaper still, but it leaves a year of PHI in a closet.
Do staff need to remove staples and folders?
No. You do not need to remove staples, paper clips, binder clips, rubber bands or file folders. Do remove three-ring binder hardware, hanging-folder frames and anything that is not paper. Less sorting also means fewer people reading patient pages before they go in the box. Media goes in a separate bag and is quoted per item.
Will you sign a Business Associate Agreement?
Yes. New Hampshire Document Shredding signs a Business Associate Agreement on request for covered entities and business associates. Ask when you book online or call (978) 636-0301, and have it signed before the first boxes leave your office. HHS names a disposal vendor acting as a business associate as one example of proper disposal of PHI.
How long should we keep the Certificate of Destruction?
Keep it with your disposal log and policy. HIPAA requires covered entities to keep required documentation for six years from creation or from the date it was last in effect, under 45 CFR 164.530(j)(2). Filing certificates on the same six-year clock is a sensible habit, and it lets you prove which boxes were destroyed and when.
Do volunteers and part-time staff need disposal training?
Yes. HHS says anyone who disposes of PHI or supervises people who do must be trained on disposal, and it states that this includes volunteers. Train new people within a reasonable time after they start, retrain when the policy changes, and keep a signed sign-in sheet with the policy so you can show who was trained and when.
Sources
- HHS: What do the HIPAA Privacy and Security Rules require of covered entities when they dispose of protected health information? (checked November 2026)
- GovInfo: 45 CFR 164.530, paragraphs (b) training, (c) safeguards, (i) policies and (j) documentation (checked November 2026)
- GovInfo: 45 CFR 164.310, paragraph (d) device and media controls (checked November 2026)
- GovInfo: 45 CFR 164.504, paragraph (e) business associate contracts (checked November 2026)
Put your practice’s shredding on a schedule
Set up the bins, write the policy, then pick a rhythm. Drive sealed boxes to Tewksbury on any weekday or book a pickup by zone, ask for our Business Associate Agreement, and file the Certificate of Destruction with your log.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
Three ways to shred: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.