Patient data
The HIPAA Security Rule requires covered entities to have policies for the final disposal of electronic protected health information and the hardware it is stored on.
Hospitals and healthcare
ITAD for hospitals. Proof for every device.
K12 Computers provides secure IT asset disposition for hospitals, clinics and healthcare organizations. Retired laptops, workstations, tablets and servers are erased to NIST 800-88 guidelines with third-party verified software, every device gets a data deletion certificate by serial number, and equipment with resale value earns you a payout.
- R2v3 & ISO certified
- NIST 800-88 erasure
- Updated
Key facts
Hospitals & healthcare, at a glance.
- Relevant rule
- HIPAA Security Rule, 45 CFR 164.310(d)
- Erasure standard
- NIST SP 800-88
- Proof
- Data deletion certificate per serial number
- Certification
- R2v3
- Value recovery
- Payout on resellable devices
- Districts served
- 300+
- Devices processed
- 5 million+
- Paid out
- $80 million+
R2v3 · ISO 9001 · ISO 14001 · ISO 45001 · WISE Certified · Inc. 5000
What is at stake
Why disposition matters here.
Proof, device by device
A single letter for a whole pickup is weak evidence. Per-serial certificates tie each device to its erasure result.
Value left on the table
Shredding everything is secure but throws away resale value. Verified erasure keeps devices reusable.
01
What HIPAA requires when hospitals dispose of devices
The HIPAA Security Rule's device and media controls (45 CFR 164.310(d)) require covered entities to implement policies for the final disposition of electronic protected health information and the hardware or media it is stored on, and to remove ePHI before media is reused.
HHS guidance adds that covered entities must apply reasonable safeguards when disposing of PHI and train their workforce on disposal policies. HHS points to NIST SP 800-88 for sanitization methods.
02
Per-device proof instead of a single letter
When a privacy officer or auditor asks how a specific workstation was handled, a single certificate for a whole pickup is weak evidence. K12 records each device at pickup and issues a data deletion certificate tied to its serial number.
Hospitals receive receiving reports, serialized audit reports, data deletion certifications, shipment summaries, purchase orders and impact reports. Media your policy requires to be physically destroyed can be flagged before pickup.
03
Secure disposition that still returns value
Verified erasure leaves equipment reusable, so laptops, workstations and tablets with resale value can earn a payout instead of being shredded. Equipment without resale value is recycled through R2v3-certified processes.
What we take
Clinical and back-office IT, handled as if it holds patient data.
Workstations on wheels, nurse station PCs, physician laptops and servers often store patient information. K12 tracks each device from pickup to final disposition and documents its erasure, so your privacy and IT teams have a record for every asset.
- Workstations and laptopsNursing stations, offices and mobile carts
- Tablets and phonesiPads and other mobile devices
- Servers and storageData closet and on-premise equipment
- Peripherals and e-wasteMonitors, printers and accessories
Step by step
How a healthcare program runs.
Every step is recorded in the K12 portal. New to the terms? See the ITAD glossary.
- 01
Scope
Tell us what is retiring, from which sites, and any media your policy requires to be physically destroyed.
- 02
Collect
Scheduled pickup with a receiving report that matches what left each site.
- 03
Erase and audit
NIST 800-88 erasure, results recorded per serial number, on site or at our facility.
- 04
Document and pay
Data deletion certificates and audit reports for your records, plus payout on resellable devices.
Portal & app
Follow every device in the K12 app.
Your orders, devices, documents and payouts, in a portal that works as well on your phone as on your desk.
How should hospitals dispose of computers that stored patient data?
The HIPAA Security Rule requires covered entities to have policies for the final disposal of ePHI and the hardware it is on. A common approach is media sanitization to NIST 800-88 with a certificate for each device. K12 Computers provides NIST 800-88 erasure with per-serial data deletion certificates.
Can healthcare IT equipment still be resold after data destruction?
Yes. Verified software erasure leaves devices reusable, so equipment with resale value can earn a payout instead of being shredded. Your policy decides which media must be physically destroyed instead.
Is K12 Computers certified for secure data handling?
K12 Computers is R2v3 certified for responsible recycling and data security and certified to ISO 9001, ISO 14001 and ISO 45001.
Does K12 sign business associate agreements?
Ask K12 about your organization's vendor requirements during evaluation. K12's process is built on NIST SP 800-88 erasure, R2v3 certification and per-device documentation.
Which healthcare devices does K12 take?
Workstations, laptops, workstations on wheels, tablets, phones, servers and storage, plus monitors, printers and other e-waste.
References
Standards and guidance cited on this page.
Primary sources from regulators, standards bodies and platform vendors. Links checked November 2026.
- Electronic Code of Federal Regulations45 CFR 164.310, Physical safeguards (device and media controls)
- U.S. Department of Health and Human ServicesWhat does HIPAA require of covered entities when they dispose of information?
- NISTSP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025)
- SERI, Sustainable Electronics Recycling InternationalThe R2 Standard (R2v3)
Verify K12 Computers independently
SERI R2 DirectoryInc.Winston-Salem JournalTIPSChoice PartnersNC TECH AssociationLinkedIn
Keep exploring
Programs for this sector.
Tell us what you have.
Get an instant estimate by model, or request a pickup and our team takes it from there.