Surplus And Destruction Of Storage Devices

Overview

Devices storing sensitive information (i.e., protected health information (PHI), personally identifiable information (PII), and financial information) must be disposed of properly as older equipment and media is replaced.

Purpose

This standard identifies the requirements for the surplus and destruction of storage devices owned by the Medical Center.

Scope

This standard applies to UVA Medical Center employees and Departmental Affiliates that manage the surplus and destruction of computer and electronic equipment.

Description

The following Medical Center equipment (regardless of the working condition) must be surplused and all storage devices destroyed as outlined in the process below:

  • Cash Registers
  • Copiers
  • Desktop Computers
  • Digital cameras
  • Fax Machines
  • Handhelds (including cell phones, PDAs, Blackberry, iPad, etc.)
  • All Monitors
  • Magnetic and other storage media including hard drives, tapes, etc.
  • Mobile devices and computers including laptops, notebooks, tablets, smartphones, etc.
  • Peripherals (keyboards, mice, docking stations, speakers, etc.)
  • Printers
  • Scanners
  • Servers
  • Audio/Video Equipment
  • TV’s

Surplus and Destruction Process

  1. Health Information and Technology (HIT) provides surplus support year-round to avoid the need for individual departments to store surplus systems. See Surplus Request Procedures

  2. The HIT Storeroom labels the equipment with the date received and stores it in a secure location for three weeks. Still-functioning server and storage system media is retanled for sparing-out failed media and is placed immediately with spare inventory. Failed media or media ready for disposal will be stored in a secure location until processed for destruction and disposal.

  3. After three weeks, the failed storage device will be removed and destroyed and the equipment turned over to our surplus vendor, Creative Recycling Service (CRS).

  4. HIT employs a comprehensive device storage sanitization system that includes

    • Hard Disk Drives (HDDs): National Security Agency (NSA) approved storage media degausser & drive shredder destruction device
    • Solid State Media (SSDs): National Security Agency (NSA) Approved Solid State Media Disintegrator
    • Reel to Reel Tapes: Table top degausser
  5. HIT records all surplus equipment on a check list that is verified against the surplus vendor’s pick up list.

  6. HIT currently uses two surplus pick up sites. Other pick up sites may be enabled as the need arises for especially large quantities of surplus amaterial.  All sites are secure and the address of the pick up sites is provided to the vendor.

HIT regularly reviews surplus practices with HIT Security Administration, LAN, LSPs, HIT PC Support, and HIT Storeroom employees who support Medical Center Information Technology hardware.

Document Supporting Resources