Wiping Devices the HIPAA-Safe Way

R2v3 — the standard behind responsible electronics recycling — has a clear goal: reuse equipment whenever possible. HIPAA has a clear requirement: patient data must be rendered unreadable and unrecoverable before devices leave your control. So how do you reconcile the two? How do you put a device back into service and still guarantee the data is gone?

That’s exactly what NIST Special Publication 800-88, Guidelines for Media Sanitization, is for. Done to that standard — particularly with the Purge method — wiping makes reuse safe, and it’s how healthcare organizations satisfy HIPAA’s disposal requirements at the same time.

What HIPAA actually requires

HIPAA’s Security Rule (45 CFR 164.310(d)(2)) requires covered entities and business associates to have policies and procedures for the final disposition of electronic protected health information — and the hardware and media it lives on. Two implementation specs are required: Disposal, and Media Re-use.

In practice, that means you need a documented process showing ePHI is rendered unreadable and unrecoverable before devices leave your control — plus records proving it happened. HIPAA doesn’t name one specific wiping method, but federal guidance from HHS points to NIST Special Publication 800-88, Guidelines for Media Sanitization, as the accepted approach.

Clear, Purge, Destroy: the three levels

NIST 800-88 Rev. 2 — published in September 2025, replacing the 2014 revision — defines three sanitization levels:

• Clear overwrites the media so data can’t be recovered with standard software tools. Good for devices staying inside your organization.
• Purge goes deeper: firmware-level commands, cryptographic erase (destroying the encryption keys so the data becomes unrecoverable), or other advanced techniques. This is the level most health information calls for.
• Destroy physically destroys the media — shredding, crushing, or disintegration — so it can’t be used again. The right call when a device can’t be reliably purged or the data is too sensitive to risk.

Phones and tablets usually rely on cryptographic erase, a form of Purge. Modern phones and tablets encrypt everything stored on them, with the encryption keys kept in a dedicated secure chip. Cryptographic erase destroys those keys — a process that takes seconds — and without them, the encrypted data remaining on the device becomes unrecoverable gibberish. The device can then be safely reused.

Why Rev. 2 matters

The 2025 revision shifts the emphasis from just picking a technique to running a documented sanitization program: the method must match the data’s sensitivity, the media type, and what happens to the device next — and every step gets verified and recorded. That’s exactly what an auditor wants to see.

What this means for your organization

If you handle patient data, your IT refresh needs three things: a documented sanitization process aligned with NIST 800-88, a provider who follows it, and proof. Ask for a Certificate of Destruction for every batch — it’s the record your auditors and your business associate agreements expect.

We adhere to the NIST 800-88 standard. Our procedure is a 3-pass wipe — which goes beyond the standard’s Clear bar — or the Purge method (cryptographic erase and other advanced techniques) when the device supports it, so sanitized devices can be safely reused instead of destroyed. That’s also the goal of our R2v3 certification: reuse first, recycling second. Both methods satisfy HIPAA’s disposal requirements. Media that can’t be wiped or purged is physically destroyed. See our data sanitization process or schedule a free pickup to get started.