UTMB HANDBOOK OF OPERATING PROCEDURES

Section 6 Compliance Policies Subject 6.2 Privacy Related Policy 6.2.12 Disposal of PHI

04/11/03- Originated 07/06/07 - Reviewed w/ changes - Reviewed w/o changes Compliance Office - Author

Disposal of PHI

Policy	UTMB has a duty to protect the confidentiality and integrity of confidential medical information as required by law, professional ethics, and accreditation requirements. Protected Health Information (PHI)may only be disposed of by means that assure that it will not be accidentally released to an outside party. Managers must assure that appropriate means of disposal are reasonably available and operational. This policy defines the guidelines and procedures that must be followed when disposing of information containing PHI. Violation of this policy may further result in disciplinary action up to and including termination for employees; a termination of employment relationship in the case of contractors or consultants; or suspension or expulsion in the case of a student. Additionally, individuals may be subject to loss of access privileges and civil and/or criminal prosecution.
Summary of Disposal Policy	All personnel must strictly observe the following standards relating to disposal of hardcopy and electronic copies of PHI: § PHI must not be discarded in trash bins, unsecured recycle bags or other publicly-accessible locations. Instead this information must be shredded or placed in a secured recycling bag. § Printed material and electronic data containing PHI shall be disposed of in a manner that ensures confidentiality. It is the individual’s responsibility to ensure that the document has been secured or destroyed. It is the supervisor’s responsibility to ensure that their employees are adhering to the policy. For some official UTMB records, documentation of destruction may be required. The Records Management Department must be contacted prior to destruction.
Destruction of Convenience Copies and Original Documents (Day-to-Day Destruction)	UTMB Department Heads shall provide users with access to shredders or secured recycling bags for proper disposal of confidential printouts containing PHI. The user may elect to use either shredding or secure recycle bags for the destruction of convenience copies, as long as the destruction is in accordance with this policy. In addition to this policy, original documents shall be destroyed in accordance with IHOP Policy 9.2.14 Medical Record Retention Policy and IHOP Policy 2.13.5, Records and Information Management and Retention Policy.

Electronic Copies	Secure methods will be used to dispose of electronic data and output. The Information Services Security Group (IS) department is responsible for the destruction of electronic copies containing PHI. However, employees may dispose of the electronic data themselves using the following methods: a. Deleting on-line data using the appropriate utilities; b. “Degaussing” {removing or neutralizing the magnetic field} computer tapes to prevent recovery of data; c. Removing PHI from mainframe disk drives being sold or replaced, using the appropriate initialization utilities; d. Erasing diskettes to be re-used using a special utility to prevent recovery of data; or e. Destroying discarded diskettes.
Hard Copy (Bulk Destruction)	Secure methods will be used to dispose of hardcopy data and output. • PHI printed material shall be shredded by an employee of UTMB authorized to handle and personally shred the PHI or by a UTMB approved firm specializing in the disposal of confidential records . • Microfilm or microfiche must be cut into pieces or chemically destroyed. • After documents have reached their retention period, all PHI must be securely destroyed using the UTMB record retention process governing destruction of records. • If hardcopy PHI (paper, microfilm, microfiche, etc.) cannot be shredded, it must be incinerated or destroyed in another method as approved by the Office of Institutional Compliance. Please contact the Office of Institutional Compliance for further guidance.
Secured Recycling Bags	The recycle bags on campus are considered protected property of UTMB and are not to be tampered with. The contents of the recycle bags contain confidential information and were disposed of with the expectation of privacy and non-removal. Any UTMB personnel or other individuals removing items from the secured recycle bags will be subject to disciplinary action. All instances of tampering with secured recycle bags must be reported to the Office of Institutional Compliance or the Fraud, Abuse and Privacy Hotline.