Part 2 paper-record destruction and sanitization

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.16(a)(1)(i)(B) requires formal policies and procedures for destroying paper records, including sanitizing hard-copy media associated with paper printouts, so patient-identifying information is non-retrievable. The broader paragraph requires reasonable protection throughout the process. NIST SP 800-88 Rev. 2 provides current federal media-sanitization guidance, while the HHS fact sheet identifies February 16, 2026 as the Part 2 compliance date.

Retention and holds come first

The current paper-destruction rule addresses the destruction outcome. Before disposal, verify record type, owner, retention schedule, service date, minor or deceased-patient rules, payer and state requirements, complaint, audit, litigation hold, investigation, and approved destruction date.

Method must match the media

Paper, labels, carbon copies, photographs, microforms, thermal printouts, fax ribbons, printer memory, packaging, notebooks, and mixed media may need different treatment. Use a documented method that prevents reconstruction or retrieval.

Vendor custody remains governed

Verify contract, Part 2 and HIPAA roles where applicable, containers, pickup, transport, facility, subcontractors, destruction method, timing, certificate, audit rights, incident reporting, and failed or partial destruction handling.

Authorize disposition before destroying anything

Map record type to legal, regulatory, contractual, clinical, payer, research, litigation-hold, complaint, investigation, audit, and organizational retention requirements. Identify the authoritative copy, duplicates, convenience prints, working notes, indexes, labels, and media. Place and test holds before scheduled destruction.

Create a disposition list with record class, date range, patient scope, volume, location, owner, retention source, hold check, method, vendor, approver, scheduled date, and certificate requirement. Use a second review for bulk, unusual, disputed, or high-risk destruction.

Select a method that makes information non-retrievable

Choose an appropriate method for the paper and associated media, such as secure cross-cut shredding, pulping, pulverizing, or another validated process. Address labels, carbon copies, thermal paper, microforms, printer ribbons, fax films, badges, wristbands, photographs, notebooks, and other hard-copy media that can retain information.

Locked collection bins are temporary storage, not completed destruction. Control bin location, access, fullness, liner removal, staging, transport, vendor handoff, processing, and residue. Do not place protected material in ordinary trash, recycling, or an unsecured shred pile.

Control vendor and on-site destruction

Verify vendor role, contract, workforce controls, facility, transport, subcontractors, destruction method, timing, incident notice, proof, and audit rights. Reconcile container identifiers and custody at pickup and processing. For on-site equipment, define authorized operators, maintenance, jams, residue, cleaning, and witness requirements.

The certificate should identify organization, date, method, location or facility, containers or record batch, vendor, witness or operator, exceptions, and attestation. Preserve it with the disposition authorization without listing unnecessary patient detail.

Handle mistakes and verify the process

If records are found after certification, bins are lost, a vendor cannot prove processing, or material remains readable, preserve evidence, stop affected destruction, contain records, notify privacy and security, assess exposure and breach duties, and correct the process.

Sample bins, handoffs, certificates, vendor evidence, access, residue, and retention-to-disposition mapping. Test restoration or retrieval assumptions for associated media when relevant. Track exceptions and corrective-action closure.

Include equipment that creates or retains print images

Printers, copiers, multifunction devices, fax machines, scanners, print servers, and maintenance parts may retain jobs, address books, cached images, logs, storage media, or consumables. Inventory the devices, configure retention and access, secure service, and require sanitization or destruction before return, resale, replacement, or disposal.

Document device identifier, owner, data capability, sanitization method, verifier, date, disposition, vendor, and exception. Remove labels, stored credentials, and network configuration as appropriate. A vendor's statement that a machine was “reset” should be checked against the device and method.

Reviewers can ask which records and media were authorized, which hold check occurred, how non-retrievability was achieved, who controlled custody, what evidence proves completion, and whether equipment retained another copy. Resolve every gap before closing the disposition batch.

Example

Twelve destruction batches are reviewed. Ten have retention release, hold check, inventory, approved method, custody, witness or vendor evidence, and certificate; two lack media detail. Readiness is 10 of 12 batches.

Paper-destruction checklist

• verify retention, holds, authoritative copy, duplicates, and disposition approval;
• inventory paper, labels, ribbons, films, microforms, photographs, and related media;
• choose and validate a method that renders information non-retrievable;
• secure bins, staging, transport, vendor custody, processing, and residue;
• preserve certificates, exceptions, witnesses, and batch reconciliation; and
• investigate unproven or incomplete destruction and test corrective action.

Deletion from an index or placement in a locked bin is not destruction. The end state must make the patient-identifying information non-retrievable.