Part 2 post-retention final media sanitization

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.19(b)(1)(ii) and (b)(2)(v) require final destruction or sanitization as soon as practicable after the legally required retention period on the archive label ends. Paper and associated hard-copy media and the retained portable device or original-and-backup electronic media must be rendered non-retrievable under section 2.16 procedures. NIST SP 800-88 Rev. 2 is technical guidance rather than Part 2 authority.

Confirm the period really ended

The § 2.19 procedures tie final action to the required retention period. Recheck the governing authority, extensions, patient rights, complaints, audits, investigations, litigation holds, successor instructions, record type, and calculated end date before release.

Close every retained component

Inventory containers, paper, hard-copy production media, portable devices, original and backup electronic media, readers, removable storage, temporary recovery copies, logs, vendor holdings, and decryption tools. Assign a method and completion evidence to each component.

Validate the outcome

Use current technical guidance such as NIST SP 800-88 Rev. 2 when selecting and validating electronic-media treatment. Record authorization, chain of custody, operator or vendor, method, date, result, failures, retries, residual copies, certificate, and archive closure.

Reconfirm that disposition is legally clear

Retrieve the current statute, regulation, court order, or other retention authority and recalculate the end date. Check litigation, investigation, complaint, audit, payer, tax, research, regulatory, clinical, and patient-access holds. Record reviewer, sources, clearance, exceptions, and approval.

Do not destroy because the label date arrived if a valid extension or hold applies. Do not retain automatically because a former owner failed to act. Every delay needs a supported reason, responsible person, new review date, and protective controls.

Inventory the whole archive and its working copies

List paper containers, files, labels, printer and fax media, photographs, microforms, portable devices, original and backup media, readers, adapters, hardware tokens, decryption tools, key backups, test extracts, replacement media, logs, vendors, off-site storage, and temporary recovery copies. Reconcile container, seal, asset, and media identifiers.

Trace any migrations, repairs, access requests, exports, or incident copies created during retention. Assign each component a final method, custodian, date, verifier, and evidence requirement.

Select and control appropriate methods

Use section 2.16 policies and qualified records and security judgment. Choose shredding, pulping, pulverizing, clearing, purging, cryptographic erase, physical destruction, or another validated method appropriate to the paper, media, sensitivity, condition, and destination. Technical guidance can inform selection and verification.

Control staging, access, transport, vendor and subcontractor custody, failed devices, unreadable media, residue, and certificates. A missing or failed device may still hold recoverable information and requires incident and disposition review.

Verify non-retrievability and close evidence

Record authorization, authority and hold check, inventory, chain of custody, method, tool or provider, operator, date, result, witness or verifier, exception, retry, certificate, key retirement, account closure, and final reconciliation. Protect evidence without unnecessary patient detail.

Investigate incomplete, unproven, or failed sanitization. Contain material, preserve evidence, assess unauthorized access or breach duties, repeat with an appropriate method, and verify correction. Do not close the archive while any component remains unresolved.

Remove the archive's supporting access

Revoke responsible-person and vendor access, disable accounts and tokens, remove inventory crosswalks according to retention, retire keys and recovery materials, close storage and service contracts, and update records schedules. Preserve only the nonidentifying evidence required to prove disposition.

Review the full closure with privacy, security, records, legal, and accountable leadership. Capture lessons for future discontinued-program plans and section 2.16 procedures.

Track days from legal clearance to completed sanitization and explain material delay. The measure helps distinguish an unavoidable operational constraint from an archive that simply lost its owner.

Example

Fourteen archives reach their labeled end date. Eleven have renewed legal clearance, complete inventory, approved methods, custody, validation, certificates, and key retirement; three have unresolved holds. Final-action readiness is 11 of 14 archives.

Final-sanitization checklist

• recalculate the legal end date and clear every current hold and extension;
• inventory paper, hard-copy media, devices, original, backup, readers, keys, and copies;
• assign appropriate methods, custody, vendors, dates, verification, and evidence;
• contain and remediate missing, failed, unreadable, or unproven media;
• reconcile certificates, keys, accounts, crosswalks, vendors, and every component; and
• close with privacy, security, records, legal, and leadership review.

“As soon as practicable” requires an executable process after legal clearance. It is not permission for indefinite retention or hurried destruction without inventory and verification.