The Health Insurance Portability and Accountability Act (HIPAA) of 1996 applies to patients’ protected health information. HIPAA protects the confidentiality of medical records and personal health information, maintains security, and standardizes transactions. It also creates a lot of headaches, not the least of which is trash. From a waste perspective, HIPAA has created a new waste stream—and a potentially expensive one. How can we ensure proper security and destruction of HIPAA-protected paperwork, while maintaining cost and environmental commitments?

Let’s start with the basics. Protected Health Information (PHI) includes any materials containing: patient name and/or address, names of relatives, names of employer(s), birth date, telephone and fax numbers, email address, web URL, internet protocol address, social security number, medical record number, health plan, beneficiary number, account number, certificate and/or license number, vehicle or device serial numbers, finger or voice print, photographic images, and any other unique identifying number, characteristic or code.

Source Reduction

Instead of starting at the back door, where the trash goes out, we should start at the front door, where it begins. What can we do to reduce the amount of PHI we generate? Before thinking about what to do with PHI waste, think about how you can reduce it. Reports could be viewed on the computer, rather than on hard copy, or one copy could be circulated rather than providing a set to each staff person. Train staff to only print relevant portions of information rather than entire documents. Electronic medical records can also eliminate waste paper.

To Shred or Not to Shred?

Shredding is an acceptable method of destroying confidential information in small practices, and it is fully compatible with recycling programs. It is also a cost-effective means of ensuring compliance. But in large facilities, it becomes a time, space, and maintenance issue. If you opt to shred, buy a machine that will meet your needs. High volume users should make sure the shredder can handle frequent use. If your practice generates a lot of PHI, shredding may not be the answer. Some large practices have to hire additional personnel just to handle the shredding.

Confidential Paper Haulers

There are plenty of vendors offering services for collection, removal and destruction of confidential paper waste. They will provide small, medium or large locked receptacles and exchange them as needed. Place bins in convenient areas where confidential information is generated, to ensure ease of access and compliance. Locked bins are helpful because people are not able to throw food and other wastes in with the PHI (just make sure an ordinary waste bin is located next to the locked bin). There is also less chance of your cleaning staff inadvertently dumping confidential information in with general waste.

Some vendors provide shredding onsite, through a mobile shredder. Others transport the material to a site where it is shredded and destroyed. This can be an excellent, compliant means of destruction. But be careful—it comes with a price. Some vendors charge as much as for Regulated Medical Waste, and the cost can be high. Pricing can be by the pound or by the receptacle. Additional costs such as transport fees are common. You can reduce cost by getting extra containers and exchanging them as needed. Store filled containers onsite to reduce visits by the vendor. You can also take the bins to the pick up location yourself to reduce the hauler’s time, saving you money.

Make sure the paper is recycled! Some vendors incinerate collected material, telling you this is the best means of destruction. However, paper is a commodity and can be pulverized in the papermaking process. Most vendors will recycle, just insist that they do. Check with professional societies or local hospitals for confidential paper vendors in your region. If you are affiliated with a hospital network, you may be able to piggyback on their program. Make sure to have certificates of destruction on file to demonstrate compliance.

Compliance

While HIPAA is a lot to deal with, it can be used to enhance weak or non-existent paper recycling programs. Recycling is more than the “right thing to do.” It is now a federal mandate with federal “super-sized” fines along with it. Avoidance of these fines will certainly justify the cost of collection bins and service needs.

As with any new initiative, training is key. Posters, formal in-service training and reminders should go to all staff, clearly laying out your expectations and commitment to patient confidentiality and the environment. Conduct regular rounds, looking into waste receptacles to make sure PHI is not discarded into the regular waste stream. Any incidents should be documented and brought to the staff’s attention. Always reward good performance.

To learn more about HIPAA and to find numerous tools to assist with compliance, refer to these websites.

For the entire HIPAA rule, go to the Office for Civil Rights Homepage—www.hhs.gov/ocr/hipaa/finalreg.html

The American Medical Association: Search the site for HIPAA for guidance documents and a free compliance brochure—www.ama-assn.org

The Medical Group Management Association: This website has many tools for HIPAA compliance—www.mgma.com

Hospitals for a Healthy Environment has information including a HIPAA overview, sample policies, sample certificate of destruction and more—www.h2e-online.org/tools/waste.htm

As usual, should you have any questions, please contact me at jhbrown@bethisraelny.org

Janet Brown is the medical Waste Manager for Beth Israel Medical Center, New York City. Beth Israel is firmly committed to reducing the volume and toxicity of its waste stream. Many of the strategies that work for Beth Israel can also work for you.