Updated November 2026 · Southern New Hampshire
Medical shredding service for New Hampshire practices
HIPAA-ready shredding for NH medical, dental and therapy offices, home health agencies and pharmacies, with a Business Associate Agreement on request and a Certificate of Destruction on every job. Drive your boxes to Tewksbury, book a pickup by zone, or watch the shredding yourself.
99¢ per pound at our Tewksbury drop-off. Certificate of Destruction on every job.
- 99¢ per pound
- Since 2007
- BBB A+ rated
- HIPAA BAA on request
Quick answer
New Hampshire Document Shredding runs a medical shredding service for NH practices from its office at 1215 Main Street, Unit 115, Tewksbury, MA: 99 cents per pound at drop-off, or the same rate plus a $129.95 to $199.95 pickup fee by zone, with $34.90 in per-job fees and a Certificate of Destruction on every job. HIPAA does not name one disposal method, but HHS says paper PHI must be shredded, burned, pulped or pulverized so it cannot be read or reconstructed, and a Business Associate Agreement is available on request. It is the same document shredding process every NH customer gets, with the paperwork a covered entity needs.
What HIPAA actually requires for paper PHI
Most practice managers have heard that HIPAA “requires shredding.” It does not say that in so many words. The rules set a duty to protect patient information, and HHS guidance then explains what a reasonable disposal method looks like. Knowing the actual text helps you write a policy you can defend if anyone asks.
The Privacy Rule safeguard duty
The disposal duty for paper starts at 45 CFR 164.530(c). Paragraph (c)(1) reads: “A covered entity must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.”
Paragraph (c)(2)(i) adds that a covered entity “must reasonably safeguard protected health information from any intentional or unintentional use or disclosure” that breaks the rules. A box of old charts in an open recycling tote is an unintentional disclosure waiting to happen.
The Security Rule media standard
The second section people quote, 45 CFR 164.310(d)(2)(i), covers electronic records. It tells you to “Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.”
So 164.310 is about drives, disks and devices, not paper. Your written disposal policy should cover both: paper under the Privacy Rule, and media under the Security Rule.
HHS ties the two together in its FAQ on disposal. For paper records, it lists “shredding, burning, pulping, or pulverizing the records so that PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed.” Cross-cut shredding, which is what we run in Tewksbury, fits that description.
The same FAQ draws a clear line on what is not allowed. Covered entities “are not permitted to simply abandon PHI or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons.” It also says the rules “do not require a particular disposal method,” so each practice decides what is reasonable for its own size and risk.
HHS also expects training. The FAQ says any workforce member who disposes of PHI, or supervises people who do, must be trained on your disposal procedures, and that includes volunteers. A one-page policy and a five-minute talk at a staff meeting covers it for most small offices. Our post on HIPAA shredding requirements turns these rules into a checklist.
The Business Associate Agreement
When an outside company handles your PHI, HIPAA generally expects a written contract. HHS describes a business associate as a person or entity outside your workforce that performs services for you involving access to protected health information. A shredding vendor that picks up or receives patient files fits.
The HHS disposal FAQ uses this exact example. One of its listed methods is “using a disposal vendor as a business associate to pick up and shred or otherwise destroy the PHI.” The contract rules sit at 45 CFR 164.502(e) and 164.504(e).
What the contract has to do
According to the HHS sample provisions, the agreement sets the permitted uses of the PHI, bars any other use, requires appropriate safeguards and requires the vendor to report any use or disclosure not allowed by the contract. A shredding BAA is short because the only permitted use is destruction.
How to get ours
New Hampshire Document Shredding signs a Business Associate Agreement on request for covered entities and business associates. Ask for it when you book or call (978) 636-0301 before your first job. Keep the signed copy with your HIPAA policies, not in a desk drawer.
- Sign the BAA before the first box leaves your office, not after.
- File it with your other business associate contracts so you can find it in an audit.
- Note the vendor’s address on your disposal policy. Ours is 1215 Main Street, Unit 115, Tewksbury, MA 01876.
- If you use a billing company or a records storage firm, check whether they also send PHI for shredding and under whose agreement.
Which paper counts as PHI in a medical office
Protected health information is any health detail tied to a person. On paper, that is far more than the chart. Front desks, billing rooms and back offices all produce it, and most of it ends up in a “to shred” box under a desk.
A good rule for staff: if a sheet carries a patient name, date of birth, account number or any clinical detail, it goes in the locked shred box, never the recycling bin. When in doubt, shred it. Paper costs 99 cents a pound to destroy, which is less than the time it takes to argue about one page.
Specialty offices have their own twists. Therapy practices hold notes that need extra care, which our page on mental health records shredding covers, and dental offices juggle charts, films and insurance forms, covered in our guide to dental office shredding.
Clinical records
Charts past their retention period, progress notes, lab results, referral letters, consult reports, printed portal messages and faxed records from other providers.
Billing and insurance
Superbills, claim forms, EOBs, remittance advice, copies of insurance cards, collection letters and payment plans. These carry policy numbers as well as diagnoses.
Front desk paper
Sign-in sheets, intake forms, daily schedules, appointment reminders, prescription refill requests and phone message slips with a name and a reason for calling.
Pharmacy and home health
Prescription labels, pharmacy printouts, visit notes, care plans and medication lists carried in a nurse’s bag. HHS names labeled prescription bottles as PHI to keep in opaque bags in a secure area.
X-ray film, CDs of imaging, USB sticks, old hard drives and phones are not paper. Put them in a separate bag and tell us when you book. They are physically destroyed and quoted per item. See our page on hard drive destruction for drives and devices, and our post on whether to shred medical x-rays for film.
Drop-off, pickup or witnessed: which fits your practice
All three services end in the same place: cross-cut shredding at our Tewksbury office, a Certificate of Destruction and recycling of the shred. The difference is who moves the boxes and who watches. Pick based on volume, staff time and how close you are to the state line.
| Service | Price | Best for | What you do |
|---|---|---|---|
| Drop-off | 99¢ per lb, or $15 small / $20 banker’s box at 10+ boxes, plus $34.90 per job | Practices in Salem, Pelham, Windham, Hudson or Nashua with a few boxes a quarter | Drive to Tewksbury on a weekday, 10 a.m. to 5 p.m. Staff help you unload. |
| Off-site pickup | Same shredding rate plus $129.95 (Zone 1), $159.95 (Zone 2) or $199.95 (Zone 3), plus $34.90 per job | Larger purges, offices with no staff to spare, Seacoast practices and points farther north | Book an appointment. We collect and shred at the Tewksbury office. |
| Witnessed | $1.99 per lb, $100 minimum, plus $34.90 per job | Psychotherapy notes, sensitive legal holds, a practice owner who wants to see it done | Book a time, bring the boxes and watch them go through the shredder. |
Our honest take
For two or three boxes, drive. The drive from the Salem or Pelham line is about 15 minutes down I-93 or Route 38, and you skip the transport fee entirely. For a practice in Portsmouth or Dover with thirty boxes in a basement, book the pickup and keep your staff at the front desk.
Our drop-off shredding page has the parking and unloading details, and the off-site shredding page explains how a pickup is scheduled.
When witnessing is worth it
Witnessed sessions cost about twice as much per pound. They make sense for a small amount of very sensitive paper, or when an owner closing a practice wants to sign off in person. You watch the paper go into the shredder, and the certificate is signed in front of you.
Read more on our witnessed shredding page. If you are unsure which zone your town is in, our post on pickup zones and distance walks through it, and we confirm the zone when you book.
What medical shredding costs a small or medium practice
Prices are simple, so the math is too. A banker’s box of paper weighs about 30 pounds. Every job carries $34.90 in per-job fees: a $14.95 HIPAA filing fee for the Certificate of Destruction paperwork and a $19.95 environmental fee for recycling. Pickups add a transport fee by zone.
The examples below assume one job per quarter. That rhythm suits most small offices: often enough that boxes do not pile up in a hallway, rarely enough that the per-job fees stay low. At 10 boxes or more, the flat banker’s box rate of $20 applies.
| Boxes per quarter | Drop-off per job | Zone 1 pickup | Zone 2 pickup | Zone 3 pickup |
|---|---|---|---|---|
| 2 boxes (about 60 lb) | $94.30 | $224.25 | $254.25 | $294.25 |
| 5 boxes (about 150 lb) | $183.40 | $313.35 | $343.35 | $383.35 |
| 10 boxes (flat $20 each) | $234.90 | $364.85 | $394.85 | $434.85 |
Two things stand out. First, the transport fee matters more than the paper for a small office. Two boxes cost about $31 a month if you drive them down and about $75 to $98 a month by pickup. Second, the gap narrows as volume grows, because the pickup fee is spread over more paper.
The cheapest habit is batching. Four small drop-offs a year cost less than eight, because the $34.90 is charged once per job. Our post on what medical shredding costs per month runs more examples, and the full price list is on our shredding rates page.
Chain of custody from your office to the shredder
Chain of custody is the record of who had your paper and when. For PHI it is the part of the job you can actually show an auditor. Ours is short: your paper goes from your hands to our Tewksbury office, and that is where it is shredded.
- Seal at the practicePack charts in boxes, tape them shut and keep them in a locked room or closet until they leave. Do not stage them in a hallway or by the back door.
- Hand over in personAt drop-off, you hand the boxes to staff at our Tewksbury counter. For a pickup, our driver collects them at your door by appointment.
- Weigh and logYour boxes are weighed and recorded on the job. The weight sets the price.
- Cross-cut shred in TewksburyDrop-off paper is shredded the same business day. Pickup material is shredded after it arrives at the office.
- Recycle the shredAll of the shredded paper is baled and recycled. Nothing goes to a dumpster.
- Issue the certificateYou receive a Certificate of Destruction for the job. File it with your HIPAA records.
The weak link is almost always inside the practice, before we ever see the paper. An open “to shred” box in a staff kitchen does more damage than any vendor. Our post on chain of custody shredding covers the questions to ask any vendor, ours included.
The certificate and your HIPAA paperwork
Every job comes with a Certificate of Destruction at no extra charge beyond the $14.95 HIPAA filing fee. It is the document that turns “we shredded it” into something you can prove.
HIPAA has its own record-keeping rule. Under 45 CFR 164.530(j)(2), a covered entity must keep required HIPAA documentation “for six years from the date of its creation or the date when it last was in effect, whichever is later.” Filing each certificate in the same binder or folder as your disposal policy keeps it on the same six-year clock.
What to file
The certificate, the signed BAA, your written disposal policy and a short log of what went out: date, number of boxes and which date range of records.
Where to file it
With your HIPAA policies and training records, in one place your privacy officer controls. A shared drive folder with a scanned copy works if the original is kept too.
Why it matters
If a patient complains or a payer audits you, the log shows which records were destroyed, when and by whom. Without it, you are relying on memory.
Want to see what the document covers line by line? Our page on the certificate of destruction walks through each field and how long to keep it.
Keep records long enough before you shred them
Shredding too early is a bigger risk than shredding too late. HIPAA itself does not set a retention period for medical records. The six-year rule above covers HIPAA paperwork such as policies and agreements, not the charts. Retention periods for charts come from state rules, licensing boards, payers and your malpractice carrier.
For physicians licensed by the New Hampshire Board of Medicine, the board’s rule Med 501.02(f)(8) says the licensee “shall retain a complete copy of all patient medical records for at least 7 years from the date of the patient’s last contact with the licensee.” The clock runs from the last contact, not the first visit. An early transfer at the patient’s request is the one exception the rule names.
| Who you are | What to check | Where the rule lives |
|---|---|---|
| Physician practice licensed by the NH Board of Medicine | At least 7 years from the patient’s last contact | Med 501.02(f)(8), NH administrative rules |
| Dental office, therapy practice, chiropractor, optometrist, pharmacy, home health agency | Each has its own board or licensing rules. Minors and special record types may run longer. | Confirm with your licensing board and your malpractice carrier before you shred |
| Any covered entity | HIPAA policies, BAAs and other required documentation | 45 CFR 164.530(j)(2): six years from creation or last effective date |
| Any practice billing Medicare, Medicaid or commercial payers | Payer contracts can require longer retention for audits | Your payer agreements |
Our advice: write your retention periods into the same policy as your disposal method, then shred on a calendar. Pull the records whose clock has run out once a quarter, box them, log the date range and bring them in. Our document retention guide covers the business side, and our post on EOB and patient billing retention covers the billing paper.
We do not give legal advice and cannot tell you when a particular record is safe to destroy. If your rule is unclear, ask your licensing board or your malpractice carrier first. Shredding is permanent, and the certificate proves you did it.
Closing, selling or merging a practice
A closing is when most practices discover how much paper they really have. It is also when mistakes happen, because the building has a lease end date and everyone is in a hurry. Plan the records before you plan the movers.
The Board of Medicine rule spells out a physician’s duty. Under Med 501.02(f)(9), a licensee who “retires, moves from the area or decides to stop treating a patient or group of patients” must notify active patients, make sure records can be transferred to another provider at the patient’s request, and give notice at least 30 days ahead whenever possible. HHS adds that a covered entity winding down “may wish to consider giving patients the opportunity to pick up their records” before disposal.
- Decide who keeps the active chartsIn a sale or merger, the buyer usually takes the records. In a closing, name a custodian who will answer copy requests for the rest of the retention period.
- Notify patientsSend notice early, at least 30 days ahead where the board rule applies, with instructions for getting copies or transferring records.
- Sort by retention dateSeparate charts still inside their retention period from those that are past it. Only the second pile is ready to shred.
- Bag the media separatelyX-ray film, imaging CDs, old computers and phones go in their own bag for destruction and a per-item quote.
- Book one large jobA single pickup or one witnessed session keeps the per-job fees to one $34.90 and gives you one certificate covering the whole purge.
- Keep the certificateFile it with the closing paperwork and the custodian’s contact details.
Our medical practice records purge plan lays out an illustrative schedule for a small office, and our post on how to dispose of old medical records covers the retention check in more detail.
Frequently asked questions
Does HIPAA require a medical office to use a shredding company?
No. HIPAA requires reasonable safeguards for PHI under 45 CFR 164.530(c), and HHS says the rules do not require a particular disposal method. For paper, HHS lists shredding, burning, pulping or pulverizing so PHI cannot be read or reconstructed. You can shred in house if you train staff and document it, but most small practices find a vendor with a Business Associate Agreement and a certificate easier to defend.
Will you sign a Business Associate Agreement?
Yes. New Hampshire Document Shredding signs a Business Associate Agreement on request for covered entities and business associates. Ask for it when you book online or call (978) 636-0301, and have it signed before the first boxes leave your office. HHS uses a disposal vendor acting as a business associate as one of its own examples of proper PHI disposal.
How much does medical shredding cost for a small practice?
Drop-off is 99 cents per pound, and a banker’s box of paper weighs about 30 pounds. Every job adds $34.90 in per-job fees, which cover the certificate paperwork and recycling. Two boxes dropped off once a quarter come to $94.30 per job, or about $31 a month. A Zone 1 pickup adds $129.95 per job, Zone 2 adds $159.95 and Zone 3 adds $199.95.
Do you shred at our New Hampshire office?
No. All shredding happens at our office at 1215 Main Street, Unit 115, Tewksbury, Massachusetts, about 15 minutes south of the NH line. You can drive your boxes down on a weekday, book a pickup by zone, or book a witnessed session and watch your material go through the shredder in Tewksbury. Nothing is shredded at the curb, and we have no drop box in New Hampshire.
Can you destroy x-ray film and old computers?
Yes, but not with the paper. X-ray film, imaging CDs, USB sticks, hard drives and phones are physically destroyed and quoted per item. Put them in a separate bag, list them when you book, and we will price them before the job. HIPAA’s Security Rule at 45 CFR 164.310(d)(2)(i) requires a written policy for the final disposition of electronic PHI and the media it sits on.
Do we need to remove staples and folders first?
No. You do not need to remove staples, paper clips, binder clips, rubber bands or file folders. Do remove three-ring binder hardware, hanging-folder frames and anything that is not paper. Keeping staff away from sorting saves time and keeps fewer eyes on patient records. Tape each box shut and keep it in a locked room until it leaves.
How long must a New Hampshire practice keep medical records before shredding?
It depends on your license. The NH Board of Medicine rule Med 501.02(f)(8) says physicians must keep a complete copy of patient records for at least 7 years from the patient’s last contact. Dentists, therapists, pharmacies and other providers have their own boards and rules. Confirm your period with your licensing board and your malpractice carrier before you destroy anything.
What proof do we get after the shredding?
Every job includes a Certificate of Destruction, covered by the $14.95 HIPAA filing fee. File it with your disposal policy, BAA and a short log of the boxes and date ranges you sent. HIPAA asks covered entities to keep required documentation for six years under 45 CFR 164.530(j)(2), so keeping the certificate on the same schedule is a sensible habit.
Sources
- eCFR: 45 CFR 164.530, administrative requirements, paragraphs (c) safeguards and (j) documentation (checked November 2026)
- eCFR: 45 CFR 164.310, physical safeguards, paragraph (d) device and media controls (checked November 2026)
- HHS: What do the HIPAA Privacy and Security Rules require of covered entities when they dispose of protected health information? (checked November 2026)
- HHS: Business Associate Contracts, sample provisions (checked November 2026)
- New Hampshire General Court: Board of Medicine rules, Med 501.02 standards of conduct (checked November 2026)
Clear out your patient files this quarter
Book a pickup, schedule a witnessed session or drive your boxes to Tewksbury on any weekday. Ask for our Business Associate Agreement when you book, and file the Certificate of Destruction with your HIPAA records when the job is done.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
Three ways to shred: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.