Privacy >> TUSDM Policy on Proper Receipt, Tracking, and Disposal of Equipment and Materials Containing PHI

TUSDM Policy on Proper Receipt, Tracking, and Disposal of Equipment and Materials Containing PHI

I. Purpose and Scope: 
  1. The Tufts University School of Dental Medicine (TUSDM) is committed to maintaining the security of patient health information, as it applies to compliance with HIPAA Privacy & Security Rules requirements pertaining to both the destruction of documents and other materials containing protected health information (PHI) and the receipt, tracking, and removal of hardware and electronic media that contain electronic protected health information (ePHI). This policy applies to all TUSDM Workforce Members.
II. Policy Statement: 
  1. TUSDM has a duty to protect the confidentiality and integrity of confidential medical information as required by law, professional ethics, and accreditation requirements. This policy defines the guidelines and procedures that must be followed when disposing of information containing PHI and ePHI. All supervisors are responsible for enforcing this policy. Individuals who violate this policy will be subject to the disciplinary process as outlined in the Sanctions for HIPAA and MGL Violations Policy for TUSDM. Departments shall follow all procedures in the Records Management Manual, which is maintained by the Records Management Office.
III. Definitions: 
Protected Health Information
IV. General Rules: 
  1. Destruction of paper copies and original documents (day-to-day disposal).
    1. Any printed material (e.g., faxes, printed emails, informal notes about patients, patient identification stickers) containing PHI must not be discarded in trash bins, unsecured recycle bins or other publicly accessible locations. This information must be personally shredded or placed in secured shredder bins.
    2. TUSDM Department Heads shall provide users with access to shredders for the disposal of documents/materials Containing PHI, or secured shredder bins for proper disposal of confidential printouts containing PHI.
    3. The user may elect to use either shredding or secured shredder bins if the destruction is in accordance with this policy. It is the individual’s responsibility to ensure that the document has been secured or destroyed. It is the supervisor’s responsibility to ensure that their Workforce Members are adhering to the policy.
    4. After documents have reached their retention period according to the State of Massachusetts Record Retention Schedule (20 years after the discharge or the final treatment of the patient to whom a retained medical record relates), all PHI must be securely destroyed.
    5. Paper materials that are professionally stored and managed by Iron Mountain will be securely destroyed according to their practices.
  2. Disposal of patient identification cards and wristbands. These items must be discarded in shredding bins ONLY.
  3. Destruction of X-ray film. Radiological film, scans or other image records are retained for a period of at least 20 years following the date of service, in accordance with state regulations. Any X-rays to be destroyed are managed by the Records Management Office and an outside firm does final destruction using secure methods.
  4. PHI disposal in regulated medical waste. Red Bag Waste must be placed in regulated medical waste bins. All regulated medical waste is incinerated using secure methods.
  5. Documentation of PHI disposal.
    1. To ensure that proper disposal, TUSDM Workforce Members or a bonded destruction service must conduct the destruction of PHI.
    2. If TUSDM Workforce Members undertake the destruction of the records, TUSDM Workforce Members must use the TUSDM Records Destruction Form, available from the Records Management Office.
    3. At least 30 days prior to proposed date of destruction, written notification to the Commonwealth of Massachusetts Department of Public Health will be sent generally indicating the type of records to be destroyed and the dates of services which exceed the applicable retention period, as specified in guidelines of the Department.
    4. If a bonded shredding company is utilized for the final destruction of the records, the company must provide TUSDM with a manifest of destruction that contains the following information:
      1. Date of destruction.
      2. Method of destruction.
      3. Description of the disposed records.
      4. Providing dates covered.
      5. A statement that the records have been destroyed in the normal course of business.
      6. The signatures of the individuals supervising and witnessing the destruction.
    5. The Records Management Office will maintain all destruction records in perpetuity. Upon request, the Records Management Office and the bonded shredding company must provide the TUSDM Security and Privacy Officer with the certificate of destruction.
    6. Hardware (biomedical & non-biomedical).
      1. All non-biomedical hardware (computer hardware and associated peripheral devices) shall always be controlled and accounted for through Tufts Technology Services (TTS). All hardware shall be assigned to an owner.
      2. There shall be a record of the movements of all hardware containing ePHI, the owner, and the designated individual(s) responsible for the movement.
      3. The movement of hardware shall be authorized and logged by the department manager prior to the hardware and electronic media entering or leaving a facility.
      4. The department manager shall be accountable for hardware while in transit anywhere within the TUSDM campus.
      5. Hardware shall be properly logged and disposed of when no longer used. ePHI shall be removed from hardware before it is made available for reuse. 
      6. A retrievable, exact copy of ePHI, (when needed or requested) shall be created before any movement of hardware.
      7. ePHI that has reached the end of the retention period will be deleted and removed from the TTS hardware inventory.
V. Policy Compliance Monitoring and Enforcement: 
  1. The Associate Dean of Clinical Affairs will annually update the Compliance Committee and will report annually to the Patient Care and Quality Assurance on the number of and reasons for retained, stored, disposed/destroyed medical records. 
VI. Potential Disciplinary Actions and Sanctions: 
  1. Members of the TUSDM Community who do not comply with this policy will be required to participate in additional training or referred to the appropriate Ethics, Professionalism, and Citizenship Committee, Human Resources or Department Chairs for potential disciplinary action.
VII. Related Policies, Procedures, Forms: 
Statement of Patient Rights & Responsibilities
TUSDM Policy on Sanctions for HIPAA and MGL Violations
VIII. Approval and Review Cycle: 
  1. This policy will be subject to annual review, revision, and approval by the TUSDM Patient Care and Quality Assurance Committee and, in the event of material changes, official adoption by the TUSDM Executive Faculty.