Patient Records Need More Than a Recycling Bin
The Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act require covered entities and their Business Associates to dispose of Protected Health Information (PHI) in a way that renders it unreadable, indecipherable and unable to be reconstructed. Tossing patient charts in a recycling bin, leaving them in a dumpster, or running them through a small office shredder does not meet that standard. Department of Health and Human Services Office of Civil Rights (OCR) audit findings consistently show improper PHI disposal as one of the most common HIPAA violations resulting in fines.
Our HIPAA shredding service for metro Boston medical practices is built around three things that every covered entity needs. First, a Business Associate Agreement (BAA) signed before any documents change hands. Second, a documented chain of custody from your office to our certified facility. Third, a HIPAA Certificate of Destruction signed and dated for every job, archived for audit retrieval. HHS guidance on PHI disposal.
Our medical clients include independent primary care offices, dental practices, behavioral health providers, physical therapy practices, dermatology and specialty clinics, urgent care centers, medical billing companies, dialysis centers and hospital outpatient departments. We also serve school nurses’ offices, university health services and any other organization that handles PHI in the course of providing or supporting healthcare. Whether you generate one box per quarter or 50 boxes monthly, our service scales to your volume.
You can choose drop-off at our Tewksbury facility, on-site pickup at your practice, or a recurring scheduled plan with locked consoles. The right choice depends on your practice’s volume and frequency of PHI generation. Call (978) 636-0301 for a recommendation tailored to your specific operation.
Pick the Plan That Fits Your Practice
All three plans include the BAA, HIPAA Certificate of Destruction, and certified chain of custody. The right choice depends on your practice’s volume and how often you need PHI destroyed.
Drop-Off Service
Bring your boxes to our Tewksbury facility. Witnessed shredding available so your HIPAA officer can verify destruction in person. Best for small practices with quarterly volumes.
From 99¢/lb · No minimum.
Off-Site Pickup
We come to your practice, load your boxes, transport under documented chain of custody, and shred at our facility. Best for mid-size practices doing annual or semi-annual purges.
99¢/lb + transportation fee.
Scheduled Plan
Locked consoles installed at your practice. Recurring pickup on a schedule that matches your volume. Best for high-volume practices generating PHI weekly. BAA included by default.
Flat monthly contract.
Your BAA Is Signed Before Your First Pickup
If you are a HIPAA covered entity and we will handle PHI on your behalf, we are your Business Associate under HIPAA. The BAA documents that relationship and our obligations.
What Our BAA Covers
Our standard BAA is reviewed annually with healthcare counsel and meets the HHS-required terms for a HIPAA Business Associate Agreement. The agreement defines:
- The permitted uses and disclosures of PHI we may make in performing destruction services
- Our obligation to safeguard PHI from creation through destruction
- Our obligation to report any breach or unauthorized disclosure within 24 hours of discovery
- Our use of subcontractors (we do not subcontract; the BAA reflects this)
- Your right to audit our compliance with the BAA at any time
- The destruction methods we will use (cross-cut shredding rendering PHI unreadable)
- The terms governing return or destruction of PHI at the end of our relationship
- Indemnification, liability and breach-notification cost allocation
We are happy to review your custom BAA if your organization requires specific language. Most of our medical clients sign our standard BAA without modification. HHS guidance on BAAs.
Six Healthcare Operation Types in Our Portfolio
Our portfolio includes hundreds of metro Boston medical practices across these categories. The compliance regime is the same; the volume and frequency vary.
Primary Care & Internal Medicine
Patient charts, billing files, lab orders, prescription pads, EOBs. Most practices destroy 10 to 30 boxes annually after retention windows close.
Dental and Orthodontic
Dental charts, X-ray paper, treatment plans, insurance forms, billing records. Often combined with X-ray film disposal.
Behavioral and Mental Health
Therapy notes, intake forms, treatment plans, insurance authorizations. Especially sensitive PHI requiring strict chain of custody and witnessed destruction options.
Specialty Clinics
Dermatology, ophthalmology, cardiology, oncology, physical therapy, sports medicine, chiropractic. Specialty-specific records destroyed under standard HIPAA processes.
Medical Billing & RCM
Billing companies and revenue cycle management firms handling PHI on behalf of practices. We sign downstream BAAs for these intermediary relationships.
Hospital Outpatient and Urgent Care
Higher-volume operations with steady weekly PHI flow. Scheduled service with locked consoles is standard. BAA is non-negotiable for these clients.
Documents and Media Categories Covered Under HIPAA
Protected Health Information lives in many forms. Our service covers any paper-based PHI plus digital storage media via our hard drive destruction service. Common items in our medical client portfolio include:
Patient documentation. Patient charts, intake forms, history and physical exams, lab orders, lab results, imaging reports, treatment plans, progress notes, discharge summaries, prescription pads and refill authorizations, allergy records, immunization records and family medical histories.
Billing and insurance. Explanation of Benefits (EOBs), insurance claim forms, prior authorization paperwork, denied claims, billing statements, appeal correspondence, copay receipts and superbills with patient-identifying information.
Imaging and diagnostics. X-ray film and X-ray jackets, MRI and CT scan films, ultrasound printouts, EKG strips, pathology reports and any film-based diagnostic imaging that contains patient identifiers.
Operational records. Sign-in sheets with patient names, appointment schedules, phone messages with PHI, fax cover sheets, post-it notes referencing patients, and any operational paper that traveled through your office with PHI on it.
Digital media. Old EMR servers, retired workstations, backup tapes, USB drives, laptops with patient data and any storage media that held PHI. We destroy these via our separate hard drive destruction service with NIST 800-88 compliant methods.
Our cross-cut shredders handle paperwork without preparation. You do not need to remove staples, paper clips, prescription stickers, hanging folder tabs or any binder accessories. Just pack the boxes and we handle everything from there.
Every Regulation Your Practice Faces, Documented
Our HIPAA shredding service is built to satisfy the multiple overlapping regulatory regimes that apply to PHI disposal for any medical practice operating in Massachusetts. The Certificate of Destruction we issue is the documented proof your audit will require.
HIPAA Privacy and Security Rules
The HIPAA Privacy Rule requires covered entities to apply appropriate administrative, technical and physical safeguards to protect PHI from improper use or disclosure, including during disposal. The Security Rule extends those requirements to electronic PHI. Our cross-cut shredding meets the standard, our Certificate documents the compliance, and our BAA establishes the legal relationship that allows us to handle your PHI.
HITECH Act
The Health Information Technology for Economic and Clinical Health Act expanded HIPAA requirements with stronger breach notification rules and direct liability for Business Associates. Our BAA explicitly addresses HITECH-required breach notification timelines and your audit rights.
Massachusetts 201 CMR 17.00
Massachusetts data privacy law requires every business that owns or licenses personal information about a Massachusetts resident to develop a Written Information Security Program (WISP) covering disposal procedures. Our certificates document the date, volume, method and chain of custody, satisfying this state-specific paperwork requirement for any MA medical practice.
FACTA Disposal Rule
The FTC’s Disposal Rule applies broadly to any business handling consumer information, including medical billing operations that touch payment data. Our process satisfies the FACTA disposal standard alongside the HIPAA standard.
HIPAA Shredding FAQ
Office Shredders Do Not Produce HIPAA Documentation
Many practices start with an office shredder and migrate to professional service after their first compliance scare. The reasons are predictable. Office shredders produce no Certificate of Destruction, so an OCR audit asking “how did you dispose of these records?” has no documented answer. Office shredders also cannot keep up with practice volume, leading to backlogs of unshredded paper sitting in unsecured offices for weeks at a time. And the staff time spent feeding documents into a slow desktop shredder is paid time that could be billed for patient care or revenue work instead.
Professional HIPAA shredding solves all three problems at once. The Certificate documents compliance for any auditor. The bulk processing capacity handles weeks of accumulated paper in one visit. And your medical assistants get back the time they would have spent feeding paper, hours that translate directly to additional patient throughput. Most practices that switch from office shredders to professional service calculate that the change pays for itself within 90 days from staff-time savings alone, before factoring in the compliance documentation value.
When Patient Records Become Eligible for Destruction
HIPAA does not set a single federal retention period for medical records. Massachusetts sets the floor at 7 years from the last patient encounter or until a minor patient turns 25, whichever is longer. Most practices add a buffer year or two for malpractice exposure. Your destruction schedule should reflect three layers of rules at once: state minimums, your specialty board guidance and your own malpractice carrier requirements.
Different document categories also age out at different speeds. Active patient charts stay in your system through the retention window. Billing and claims records often run a parallel 7-year clock under FACTA and tax rules. Lab results and imaging may follow the same window as the parent chart or roll on a separate schedule depending on your EHR setup. We help you build a destruction calendar that pulls eligible boxes from storage every quarter or every year, with chain of custody documented from your storage room to our shredder.
The goal is to destroy records as soon as they age out of retention. Records held past their required retention period become a liability rather than an asset. Old charts in basements and attics are still subject to subpoena and breach reporting if a flood, fire or theft exposes them. Quarterly or annual scheduled pickups are the practical way to keep your record inventory tight and your liability footprint small.
Common Retention Windows for Massachusetts Practices
Adult patient medical records run a 7-year minimum from last encounter under Massachusetts regulation. Pediatric records run until age 25 or 7 years past last encounter, whichever is later. HIPAA documentation including BAAs, training logs and breach assessments follow a separate 6-year retention window from the date of creation or last effective date. Billing and claims records usually run 7 years for tax and FACTA purposes. Employee files including I-9s and benefit elections follow yet another schedule under FLSA and ERISA. Your destruction calendar should account for each window separately rather than treating all paper as one bucket.
Three Common HIPAA Disposal Situations We Solve Weekly
Closing a Practice or Retiring a Provider
When a provider retires or a practice closes, retention obligations do not end with the lights. Massachusetts requires that records remain available for the full retention window even after the practice dissolves. Most retiring providers either transfer charts to a successor practice or store them in a HIPAA-compliant facility for the remaining retention period, then destroy with documentation. We handle the destruction phase with a single bulk pickup, full chain of custody and a Certificate of Destruction that the retiring provider keeps as personal protection against any future records request.
EHR Migration With Paper Cleanout
Practices migrating to a new EHR often discover years of duplicate paper records that were scanned but never destroyed. Once the new EHR is validated and backups confirmed, the paper originals become liability with no operational value. We schedule a one-time bulk pickup, often 50 to 200 banker’s boxes, and document destruction so the migration project closes cleanly. The Certificate of Destruction becomes part of your migration audit trail.
Annual Compliance Cleanout
Practices on an annual destruction cycle pull boxes that aged out during the year, plus expired BAAs, prior-year insurance documents and HR files past their retention windows. One scheduled pickup in January or July clears the year’s eligible material. Compliance officers like the predictability and the documentation. We provide the same Certificate format every year, making multi-year audit preparation a folder pull rather than an investigation.
Get Your BAA Signed and Your First Pickup Scheduled This Week.
Same rates and documentation across all 14 metro Boston cities. Most new HIPAA clients are onboarded within 7 to 10 business days from first contact to first pickup with BAA on file.
