Fact Check: Does HIPAA Specify a Shred Size for Document Destruction?

In Brian Hampton’s 2014 stage play GOSSIP, a charming but sinister character named Gossip infiltrates a group of high school students, manipulating the truth to be believed by others. This mirrors what happens in many healthcare organizations when facts about regulations like HIPAA become twisted by assumptions, opinions, or incomplete information. Misinformation can spread quickly, leading to misunderstandings about critical regulations like HIPAA.

One common question that healthcare providers and businesses ask is: Does HIPAA specify a shred size for document destruction? Most people assume it does. This misconception can cause confusion and lead to improper handling of sensitive information. Let’s clear up some of these misunderstandings surrounding HIPAA and document destruction.

Misconception #1: Advertising Is Always Accurate

Many believe that advertising claims about shredders and HIPAA compliance are entirely accurate. However, the primary goal of advertising is to sell a product, not necessarily to provide textbook-level accuracy. For example, a website selling shredders might claim that a “P-3 shred satisfies not only FACTA but also HIPAA.” While this might be somewhat true, it leads many to believe that HIPAA specifically mentions shred size, which is not the case.

HIPAA does not specify or recommend any particular shred size, security level, or even mention a “P” number shred standard. Advertisements often imply that a specific shredder will meet HIPAA requirements, but the law itself does not define shred size. It’s essential to distinguish between marketing messages and actual regulatory requirements.

Misconception #2: Health Information Must Be Shredded

Another misconception is that HIPAA mandates all sensitive health information be shredded. However, HIPAA Security Rules do not state that Protected Health Information (PHI) must be shredded. Instead, shredding is just one of several methods available for proper destruction of information.

HIPAA outlines a variety of acceptable destruction methods, including disintegration, pulverization, melting, and incinerating. The key requirement is that PHI must be destroyed in a way that ensures the information is “unreadable, indecipherable, and cannot be reconstructed.” While shredding is a common method, it’s not the only option, nor is it mandatory under HIPAA. What is essential is that you use a method that guarantees destruction of the data.

Misconception #3: Shredding Must Be a Specific Size

A particularly common myth is that HIPAA regulations specify a shred size or security level, such as a particular width of the shredded material. In truth, HIPAA never specifies a minimum shred size or P-number to follow.

What HIPAA does emphasize is that any method used for destroying PHI must ensure the data is “essentially unreadable, indecipherable, and cannot be reconstructed.” This is where subjectivity comes into play, as what is “unreadable” for one company might differ from another’s standards. Ultimately, healthcare organizations and their partners must ensure that the destruction process is thorough enough to prevent data breaches.

For businesses that opt for shredding, it is wise to avoid using personal office shredders, which may not meet the necessary security standards. Instead, partnering with a reputable shredding company that understands HIPAA requirements can ensure compliance and mitigate risk.

Misconception #4: All Shredding Companies Are HIPAA Compliant

Another major misconception is that all shredding companies are HIPAA compliant simply by offering shredding services. This is far from the truth. Not all shredding companies understand or adhere to HIPAA’s privacy and security regulations, which can put sensitive information at risk.

When choosing a shredding company, it’s critical to confirm that they comply with all applicable laws, including HIPAA. One way to ensure this is by selecting a company that is NAID AAA Certified. NAID (National Association for Information Destruction) certification ensures that the shredding company has undergone rigorous, independent audits to confirm that they meet the highest standards of data protection and HIPAA compliance.

By partnering with a certified shredding company, healthcare providers can rest assured that their PHI will be destroyed properly and securely. This is an essential step in maintaining compliance with HIPAA and avoiding costly penalties for improper document destruction.

How ShredPro Secure Ensures HIPAA Compliance

At ShredPro Secure, we provide HIPAA-compliant shredding services to healthcare organizations and other businesses in East Tennessee and Southwest Virginia. Our shredding methods meet all privacy laws, including HIPAA. We understand the importance of secure document destruction and offer on-site shredding for added peace of mind.

ShredPro Secure is NAID AAA Certified, meaning we meet the highest standards in the industry for secure destruction. Our on-site paper shredding and medical x-ray destruction services ensure that your sensitive information is destroyed properly, and we provide a Certificate of Destruction to confirm compliance with HIPAA and other privacy regulations.

If you’re concerned about compliance or have questions about secure document destruction, contact us at 865-986-5444 or complete the form on this page to get started.