Updated November 2026 · Southern New Hampshire
HIPAA shredding requirements: a checklist built from the rule text
HIPAA shredding requirements are spread across several sections of the federal rules, and none of them uses the word shred. This checklist puts the exact text in one place, then shows what counts as PHI on paper, what your Business Associate Agreement must cover, and how to document every disposal.
99¢ per pound at our Tewksbury drop-off. Certificate of Destruction on every job.
- 99¢ per pound
- Since 2007
- BBB A+ rated
- HIPAA BAA on request
Quick answer
HIPAA shredding requirements come from 45 CFR 164.530(c), which requires safeguards for PHI in any form, 164.310(d)(2)(i) for electronic media, 164.502(e) and 164.504(e), which require a Business Associate Agreement with an outside disposal vendor, and 164.530(j), which keeps your policies and records for six years. HHS guidance says paper is secured once it is “shredded or destroyed such that the PHI cannot be read or otherwise cannot be reconstructed,” and redaction does not count. New Hampshire Document Shredding meets those terms through its medical shredding service: cross-cut shredding at its Tewksbury office, a BAA on request and a Certificate of Destruction on every job.
The rule text behind HIPAA shredding requirements
Ask five practice managers where HIPAA says to shred, and you will get five answers. The honest one is that it never does. The rules set duties, and the disposal method follows from them. Here are the sections that matter for paper and media, with the words that do the work.
| Section | What it says | What it means for disposal |
|---|---|---|
| 45 CFR 164.530(c)(1) | “appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information” | Paper PHI needs protection until it is destroyed, including in the to-shred box |
| 45 CFR 164.530(c)(2)(i) | “reasonably safeguard protected health information from any intentional or unintentional use or disclosure” | A box of charts in an open recycling tote is an unintentional disclosure |
| 45 CFR 164.530(b)(1) | “train all members of its workforce on the policies and procedures” | Everyone who handles the shred bin needs training, and (b)(2)(ii) says to document it |
| 45 CFR 164.310(d)(2)(i) | “address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored” | Drives, phones and USB sticks need a written disposal policy of their own |
| 45 CFR 164.502(e)(1)(i) | “satisfactory assurance that the business associate will appropriately safeguard the information” | A shredding vendor who receives your PHI signs a BAA first |
| 45 CFR 164.530(j)(2) | “six years from the date of its creation or the date when it last was in effect, whichever is later” | Keep policies, training records and the BAA for six years |
| 45 CFR 164.402 | Unsecured PHI is PHI “not rendered unusable, unreadable, or indecipherable to unauthorized persons” | Properly shredded paper is no longer unsecured PHI |
None of these sections names a machine, a particle size or a vendor. That is deliberate. Each covered entity decides what is reasonable for its own size, and then has to be able to show that its choice protects the information. A small practice that shreds cross-cut, through a vendor under a BAA, with a certificate on file, has an easy answer when anyone asks.
Who these rules reach, from health plans to the billing company down the road, is a separate question. Our post on HIPAA compliance in NH covers covered entities and business associates in plain terms.
What counts as PHI on paper
The definition at 45 CFR 160.103 is broader than most people expect. Protected health information is individually identifiable health information that is transmitted or maintained by electronic media “or maintained in any other form or medium.” Paper is that other medium.
Two tests sit inside the definition. The information has to relate to “the past, present, or future physical or mental health or condition of an individual,” the care given, or “payment for the provision of health care.” And it has to identify the person, or give “a reasonable basis to believe the information can be used to identify the individual.”
A few things fall outside. The definition excludes employment records a covered entity holds in its role as employer, education records covered by FERPA, and information about a person who has been deceased for more than 50 years. Your own staff files are still sensitive, though, and belong in the same locked bin.
Clinical paper
Charts, progress notes, lab and imaging reports, referral letters, consult notes, discharge summaries and printed portal messages.
Billing paper
Superbills, claim forms, EOBs, remittance advice, ledgers, statements, payment plans and copies of insurance cards.
Front desk paper
Sign-in sheets, intake and history forms, daily schedules, appointment reminders and phone message slips with a reason for the call.
Paper people forget
Fax cover sheets, misprinted labels, specimen requisitions, sticky notes on a monitor and a printout left in a shared tray.
The de-identification rule at 45 CFR 164.514(b)(2) is the clearest list of what makes paper identifiable. It names 18 kinds of identifiers that must be removed before information counts as de-identified under that method. If a sheet carries any of them next to health or payment details, treat it as PHI.
- Names
- Geographic units smaller than a state, including street address, city and ZIP code
- All elements of dates except the year, such as birth, admission and discharge dates, and ages over 89
- Telephone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate and license numbers
- Vehicle identifiers, including license plates
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers such as finger and voice prints
- Full face photos and comparable images
- Any other unique identifying number, characteristic or code
Shredded means secured: the breach guidance
HIPAA’s breach rules are built around unsecured PHI. The definition at 45 CFR 164.402 points to guidance from the Secretary of HHS on how to make PHI “unusable, unreadable, or indecipherable to unauthorized persons.” For paper, that guidance is short and specific.
Published in the Federal Register in August 2009, it says PHI is secured when “Paper, film, or other hard copy media have been shredded or destroyed such that the PHI cannot be read or otherwise cannot be reconstructed.” For electronic media, it points to clearing, purging or destroying the media consistent with NIST Special Publication 800-88.
The same guidance adds one sentence every office should know: “Redaction is specifically excluded as a means of data destruction.” A black marker over a patient’s name on a page that then goes into recycling does not secure anything. Shred the page.
This is why the shred method matters. A strip-cut desk shredder leaves long ribbons that can be lined back up, which is hard to square with “cannot be reconstructed.” Cross-cut shredding, which is what we run at our Tewksbury office, cuts each sheet in two directions into small pieces.
Film follows the paper rule, since the guidance names it with hard copy media. Electronic devices follow the NIST path. We physically destroy drives, phones, tapes and USB sticks and quote them per item. Our page on hard drive destruction explains what that covers.
The Business Associate Agreement requirements
A shredding company that picks up or receives your patient files creates, receives or maintains PHI on your behalf. Under 45 CFR 164.502(e)(1)(i), you may let it do that only if you obtain satisfactory assurance that it will safeguard the information. Section 164.504(e) says what the written contract must contain.
Permitted uses
The contract must “Establish the permitted and required uses and disclosures” of PHI. For shredding, the only permitted use is destruction, which keeps the agreement short.
Safeguards and reporting
Your vendor agrees not to use or disclose PHI beyond the contract, to use appropriate safeguards, and to report any use or disclosure the contract does not allow, including breaches.
Subcontractors
Any subcontractor that handles the PHI must agree to the same restrictions. Ask your vendor whether anyone else touches your paper before it is shredded.
Return or destroy
At termination, the vendor must “if feasible, return or destroy all protected health information” it still holds. For a shredding vendor, destruction is the whole job.
Access for HHS
The vendor makes its practices, books and records on PHI available to the Secretary of HHS for compliance reviews.
Termination
You must be able to end the contract if the vendor breaks a material term. Put the BAA in your files before the first box leaves.
New Hampshire Document Shredding signs a Business Associate Agreement on request for covered entities and business associates. Ask for it when you book. Keep it for six years from the date it was last in effect, per 164.530(j)(2), which means the clock keeps running after you stop using a vendor.
HIPAA shredding requirements checklist
Print this, hand it to your privacy officer, and check each line once a year. It follows the rule text above in the order a small office usually tackles it.
- A written disposal policy covers paper (164.530(c)) and electronic media (164.310(d)(2)(i)).
- The policy names the shred method: cross-cut shredding or an equivalent that leaves PHI unreadable and impossible to reconstruct.
- Locked bins sit where paper piles up: front desk, billing, exam room hallways, the printer and fax area.
- Full bins or boxes are sealed and kept behind a lock until they leave.
- Staff never redact and recycle. Pages with PHI are shredded whole.
- Every workforce member is trained on the bin and the policy, and the training is documented (164.530(b)).
- A signed BAA is on file with every vendor that receives PHI for destruction (164.504(e)).
- Records are checked against their retention period before they go in a shred box.
- Drives, film and devices are bagged apart from paper and destroyed under the media policy.
- Each disposal job is logged: date, box count, record type and date range.
- Each Certificate of Destruction is filed with the log and the policy.
- Policies, training records, BAAs and logs are kept six years (164.530(j)(2)).
Need a policy to start from? Our HIPAA document shredding guide includes a one-page policy for small practices, and our records destruction policy page covers the business-wide version.
Documenting disposal: what to write down
HIPAA does not hand you a disposal log form. What it does require is that you keep your written policies, keep records of any action the rules require you to document, and keep both for six years. Section 164.530(j)(1)(iii) puts it this way: “If an action, activity, or designation is required by this subpart to be documented, maintain a written or electronic record.” A simple disposal log is the cheapest way to show the policy was followed.
| Log field | Example entry | Why it helps |
|---|---|---|
| Date the boxes left | The drop-off or pickup date | Starts the custody record |
| Box count and weight | Four banker’s boxes, weight from the invoice | Matches the vendor’s record of the job |
| Record type and date range | Billing paper, a range of service years | Shows the retention check happened first |
| Who packed and sealed | Initials of the staff member | Names who handled PHI inside the office |
| Vendor and BAA date | Vendor name, address, BAA signing date | Ties the job to a contract on file |
| Certificate received | Certificate filed with this entry | Closes the loop with proof of destruction |
- Check retentionConfirm each record is past its required period before it goes in a box. Pull anything with an open claim, audit or legal hold.
- Pack and sealLeave staples, clips and folders in. Remove binder rings and hanging-folder frames. Tape each box shut and keep it locked up.
- Log the jobWrite the log entry before the boxes leave, while you still know what is in them.
- Hand over in personAt drop-off, staff at our Tewksbury counter take the boxes from you. For a pickup, our driver collects them at your door by appointment.
- Receive the certificateEvery job comes with a Certificate of Destruction, covered by the $14.95 HIPAA filing fee.
- File it for six yearsKeep the certificate with the log entry, the BAA and the policy, in one place your privacy officer controls.
Our page on the certificate of destruction walks through each field on the form, and our post on chain of custody shredding covers the questions to ask about any vendor’s handling, ours included.
Retention comes before destruction
The six-year period in 164.530(j)(2) covers HIPAA’s own paperwork: policies, training records, agreements and logs. It is not a retention period for medical charts. Those come from state law, licensing boards, payer contracts and your malpractice carrier.
In New Hampshire, physicians follow Board of Medicine rule Med 501.02(f)(8), which says the licensee “shall retain a complete copy of all patient medical records for at least 7 years from the date of the patient’s last contact with the licensee.” Dentists follow RSA 317-A:27-a: at least 7 years from the last treatment, and for minors at least 7 years past the age of majority, covering paper, electronic and radiographic records.
Other providers have their own boards. If your rule is unclear, ask your licensing board or carrier before you shred. A record destroyed too early is a bigger problem than a box stored one more year. Dental offices can find more detail in our guide to dental office shredding, and our post on how to dispose of old medical records covers the retention check step by step.
Meeting the requirements with an outside vendor
You can shred in house if you train staff, use cross-cut machines and document it. Most small practices find a vendor easier, because the BAA, the certificate and the custody record come built in. Here is how our three services line up against the checklist.
| Service | Price | Custody | Good fit |
|---|---|---|---|
| Drop-off | 99¢ per lb, or $20 per banker’s box at 10+, plus $34.90 per job | You hand sealed boxes to staff at our Tewksbury counter | Offices near the line with a few boxes a quarter |
| Off-site pickup | Same rate plus $129.95 (Zone 1), $159.95 (Zone 2) or $199.95 (Zone 3), plus $34.90 | Our driver collects at your door by appointment, shredded at our office | Larger purges and practices with no staff to spare |
| Witnessed | $1.99 per lb, $100 minimum, plus $34.90 per job | You watch the paper go into the shredder, certificate signed in front of you | Very sensitive files or an owner signing off at a closing |
Zone 1 covers the border towns such as Salem, Pelham, Windham and Plaistow, Zone 2 covers greater Nashua and Manchester, and Zone 3 covers the Seacoast and farther north. Other towns get their zone confirmed when you book. The yearly math is in our post on medical shredding cost, and the session details are on our witnessed shredding page.
Frequently asked questions
Does HIPAA actually require shredding?
Not by name. 45 CFR 164.530(c) requires safeguards to protect PHI, and HHS breach guidance treats paper as secured when it is shredded or destroyed so the PHI cannot be read or reconstructed. Shredding is the practical way most offices meet that standard. Other destruction can qualify if the result cannot be read or reconstructed, but recycling whole pages does not.
Is cross-cut shredding required for HIPAA?
The rules do not name a shred type. The 2009 HHS guidance requires that paper PHI cannot be read or otherwise reconstructed. Strip-cut ribbons can be lined back up, so they are hard to defend against that test. Cross-cut shredding cuts each page into small pieces in two directions, which fits the guidance better. Write your chosen method into your disposal policy.
Can we black out patient names and recycle the paper?
No. The HHS guidance on securing PHI says redaction is specifically excluded as a means of data destruction. A page with a name crossed out can still hold dates, account numbers or other identifiers from the 18 listed in 45 CFR 164.514(b)(2). Shred the whole page instead, and keep it in a locked bin until then.
Do we need a Business Associate Agreement with our shredding company?
Yes, if the company receives or holds your PHI before it is destroyed. 45 CFR 164.502(e) lets you share PHI with a business associate only with satisfactory assurances, and 164.504(e) sets what the contract must say. New Hampshire Document Shredding signs a BAA on request. Call (978) 636-0301 or ask when you book online.
How long do we keep Certificates of Destruction?
Keep them with your other HIPAA documentation for six years, the period in 45 CFR 164.530(j)(2) for documentation the Privacy Rule requires. The certificate, your disposal log and the BAA together show that your written policy was followed. File them in one place your privacy officer controls, with a scanned copy if you like.
Is a paper sign-in sheet PHI?
Usually, yes. A sign-in sheet at a medical office ties a name to the fact that the person came for care, and often lists a time or a reason for the visit. That links an identifier to the provision of health care, which fits the PHI definition in 45 CFR 160.103. Shred old sheets with the rest of your patient paper.
What about x-ray film and old computers?
The HHS guidance groups film with paper as hard copy media that must be shredded or destroyed so it cannot be read. Computers and drives fall under 45 CFR 164.310(d)(2)(i), which requires a policy for the final disposition of electronic PHI and its hardware. We physically destroy film and devices and quote them per item, apart from the paper.
Does HIPAA say how long to keep medical charts before shredding?
No. The six-year rule covers HIPAA documentation, not charts. In New Hampshire, physicians keep records at least 7 years from the patient’s last contact under Med 501.02(f)(8), and dentists at least 7 years from the last treatment under RSA 317-A:27-a, longer for minors. Check your own board and carrier before you shred.
Sources
- eCFR: 45 CFR 160.103, definitions of health information and protected health information (checked November 2026)
- eCFR: 45 CFR 164.514, de-identification identifiers (checked November 2026)
- eCFR: 45 CFR 164.530, training, safeguards and documentation (checked November 2026)
- Federal Register, 74 FR 42740 (2009): HHS guidance on rendering PHI unusable, unreadable or indecipherable (checked November 2026)
- New Hampshire General Court: Board of Medicine rules, Med 501.02 (checked November 2026)
- New Hampshire RSA 317-A:27-a, Dental Records (checked November 2026)
Check every line of the list in one job
Book a drop-off, a pickup or a witnessed session, ask for our Business Associate Agreement, and file the Certificate of Destruction with your disposal log. That covers the vendor half of the checklist in a single appointment.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
Three ways to shred: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.