Effective: 10-07-21
Supersedes: NA
Overview
Brewster Ambulance Service regularly stores sensitive information on computer hard drives and other forms of electronic media. As new equipment is obtained and older equipment and media reach end of life, sensitive information on surplus equipment and media must be properly destroyed and otherwise made unreadable to protect Confidential Information or Protected Health Information.
Policy
The transfer or disposition of data processing equipment, such as computers and related media, shall be controlled and managed by Information Technology staff. Data remains present on any type of storage device (whether fixed or removable) even after a disc is “formatted”, power is removed, and the device is decommissioned. Simply deleting the data and formatting the disk does not prevent individuals from restoring data. Sanitization of the media removes information in such a way that data recovery using common techniques or analysis is greatly reduced or prevented.
Data Disposal Procedures
1. Paper and hard copy records shall be disposed of in a secure manner by shredding with cross-cut shredders. Disposal may also be accomplished by placing confidential records in locked recycling bins located in administrative offices and removed by a licensed and bonded contractor.
2. Electronic Media (physical disks, tape cartridge, CDs, flash drives, printer and copier hard-drives, etc.) shall be disposed of by one of the methods:
2.1. Overwriting Magnetic Media - Overwriting uses a program to write binary data sector by sector onto the media that requires sanitization
2.2. Degaussing - Degaussing consists of using strong magnets or electric degaussing equipment to magnetically scramble the data on a hard drive into an unrecoverable state
2.3. Physical Destruction – implies complete destruction of media by means of crushing or disassembling the asset and ensuring no data can be extracted or recreated. Any hard drive that is no longer needed and may contain sensitive information will be physically destroyed by drilling into the hard drive to destroy the data plates or flash chips.