2,654
edits
Retention and Destruction/Disposal of Private and Confidential Information: Difference between revisions
Retention and Destruction/Disposal of Private and Confidential Information (view source)
Revision as of 10:16, August 30, 2022
, August 30, 2022no edit summary
No edit summary |
No edit summary |
||
| Line 37: | Line 37: | ||
Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] outline considerations for the access control family of security controls. | Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] outline considerations for the access control family of security controls. | ||
==Policy== | ==Policy== | ||
#It is the policy of the UNMC/Nebraska Medicine and its affiliated entities to ensure the privacy and security of confidential information in the maintenance, retention and eventual destruction/disposal of such media. All destruction/disposal of confidential information media will be done in accordance with federal and state law and pursuant to the [http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule]. Records that have satisfied the period of retention will be destroyed/disposed of in an appropriate manner. | |||
#Records involved in any open investigation, audit or litigation should not be disposed of/destroyed. If a preservation notice is received the record retention schedule shall be suspended for these records until the preservation notice terminates. | #Records involved in any open investigation, audit or litigation should not be disposed of/destroyed. If a preservation notice is received the record retention schedule shall be suspended for these records until the preservation notice terminates. | ||
#Records scheduled for destruction/disposal should be secured against unauthorized or inappropriate access until the destruction/disposal of the information is complete. | #Records scheduled for destruction/disposal should be secured against unauthorized or inappropriate access until the destruction/disposal of the information is complete. | ||
| Line 55: | Line 55: | ||
|'''Medium'''||'''Destruction Procedure(s)''' | |'''Medium'''||'''Destruction Procedure(s)''' | ||
|- | |- | ||
| Paper|| All paper should be disposed of in the desk-side recycling bins, the recycling carts or shredded in a shredding machine. All paper is considered confidential in the recycling process. Food waste and toiletry products are excluded and should not be placed in | | Paper|| All paper should be disposed of in the desk-side recycling bins, the recycling carts or shredded in a shredding machine. All paper is considered confidential in the recycling process. | ||
Food waste and toiletry products are excluded and should not be placed in recycling bins. | |||
|- | |- | ||
| Audiotapes/Videotapes || Tape over the information or forward the | | Audiotapes/Videotapes || Tape over the information or forward the audiotape/videotape to Environmental Services (DOC 0647; zip 9030) in a sealed package for destruction. Place a "Please Destroy" label on the tape. | ||
|- | |- | ||
| CD ROMs/DVDs || Cut in two and dispose of in trash. | | CD ROMs/DVDs || Cut in two and dispose of in trash. | ||
Large volumes of CDs may be forwarded to Environment Services. | |||
|- | |- | ||
| Cell Phones || Cell phones which are no longer in use shall be returned to Information Technology who will dispose of the equipment. | | Cell Phones || Cell phones which are no longer in use shall be returned to Information Technology who will dispose of the equipment. | ||
| Line 70: | Line 71: | ||
Requestor will enter a Service Request containing the following information:<br /> | Requestor will enter a Service Request containing the following information:<br /> | ||
1. Request to decommission a data/hard disk storage device<br /> | 1. Request to decommission a data/hard disk storage device<br /> | ||
2. A statement that records are being destroyed in the normal course of business pursuant to Nebraska Medicine Record Retention Policy<br /> | 2. A statement that records are being destroyed in the normal course of business pursuant to Nebraska Medicine Record Retention Policy ('''is there a policy number?''')/[http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule] <br /> | ||
3. Name of the department representative authorizing data destruction<br /> | 3. Name of the department representative authorizing data destruction<br /> | ||
4. Phone number of representative authorizing destruction<br /> | 4. Phone number of representative authorizing destruction<br /> | ||
| Line 78: | Line 79: | ||
8. Questions regarding this process can be directed to PC Support Dispatch at 402-552-7777.<br /> | 8. Questions regarding this process can be directed to PC Support Dispatch at 402-552-7777.<br /> | ||
'''NOTE:''' In the circumstances where a copier is being traded out, PC Support will ensure that the hard drive is secured by following their internal procedures.<br /> | '''NOTE:''' In the circumstances where a copier is being traded out, PC Support will ensure that the hard drive is secured by following their internal procedures.<br /> | ||
'''NOTE 2:''' PC Support may, at its discretion, use data wiping tools to enable reuse of certain hard drives. PC Support will follow NIST Special Publication 800-88 Guidelines for Media Sanitization which authorizes using the DOD certified standard 5022.22, 3X for wiping | '''NOTE 2:''' PC Support may, at its discretion, use data wiping tools to enable reuse of certain hard drives. PC Support will follow [https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization] which authorizes using the DOD certified standard 5022.22, 3X for wiping | ||
|- | |- | ||
| Cassette Tapes/Magnetic Media|| Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media. | | Cassette Tapes/Magnetic Media|| Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media. | ||
| Line 84: | Line 85: | ||
| Computer Diskettes/Floppy Disks || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media. | | Computer Diskettes/Floppy Disks || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media. | ||
|- | |- | ||
| Laser Disks|| Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the | | Laser Disks|| Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the disks. | ||
|- | |- | ||
| Microfilm/Microfiche || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the | | Microfilm/Microfiche || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the microfilm/microfiche. | ||
|- | |- | ||
| Photographs || Photographs should be shredded or cut in multiple pieces. Photographs should not be placed in recycling containers. | | Photographs || Photographs should be shredded or cut in multiple pieces. Photographs should not be placed in recycling containers. | ||
| Line 92: | Line 93: | ||
| Radiology Films || Refer to Radiology Dept. Policy, LR - 6.12, "Retention/Disposal of Radiology Images" '''is this a Nebraska Medicine or UNMC policy?''' | | Radiology Films || Refer to Radiology Dept. Policy, LR - 6.12, "Retention/Disposal of Radiology Images" '''is this a Nebraska Medicine or UNMC policy?''' | ||
|- | |- | ||
| Printer Ribbons || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the | | Printer Ribbons || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the container. | ||
|- | |- | ||
| Other || Follow federal/state requirements; contact the Director, Environmental Services, at 402-559-6118, '''(do you have a better number for them?)''' or [mailto:debrbishop@nebraskamed.com Privacy Officer] for further information. | | Other || Follow federal/state requirements; contact the Director, Environmental Services, at 402-559-6118, '''(do you have a better number for them?)''' or [mailto:debrbishop@nebraskamed.com Privacy Officer] for further information. | ||
| Line 102: | Line 103: | ||
##Environmental Services will be responsible for issuing and logging the keys for unlocking these containers. | ##Environmental Services will be responsible for issuing and logging the keys for unlocking these containers. | ||
#Documentation of Secure Disposal | #Documentation of Secure Disposal | ||
The Certificate of Destruction for all recycled UNMC/Nebraska Medicine confidential material will be kept on file in the Recycling Coordinator’s office. | The Certificate of Destruction for all recycled UNMC/Nebraska Medicine confidential material will be kept on file in the Recycling Coordinator’s office. | ||
==Definitions== | ==Definitions== | ||
| Line 114: | Line 114: | ||
*Contact the [mailto:infosecurity@unmc.edu Information Security Office] | *Contact the [mailto:infosecurity@unmc.edu Information Security Office] | ||
*Contact Director, Environmental Services, at 402-559-6118, '''(do you have a better number for them?)''' | *Contact Director, Environmental Services, at 402-559-6118, '''(do you have a better number for them?)''' | ||
*Contact Human Resources – Records at 402-559-8962 or Human Resources - Employee Relations | |||
*Contact [mailto:rboldt@unmc.edu Recycling Coordinator] | *Contact [mailto:rboldt@unmc.edu Recycling Coordinator] | ||
*Contact [mailto:debrbishop@nebraskamed.com Privacy Officer] | *Contact [mailto:debrbishop@nebraskamed.com Privacy Officer] | ||
*Contact PC Support Dispatch at 402-552-7777 ('''is there an email address for this dept?''') | |||
*Procedure No. 6056, [https://info.unmc.edu/its-security/policies/procedures/destruction-confinfo.html Destruction of Private and Confidential Information] | *Procedure No. 6056, [https://info.unmc.edu/its-security/policies/procedures/destruction-confinfo.html Destruction of Private and Confidential Information] | ||
*UNMC Policy No. 8009, [[Contracts]] | *UNMC Policy No. 8009, [[Contracts]] | ||
*[http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule] | *[http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule] | ||
*Nebraska Medicine Record Retention Policy ('''is there a policy number?''') | |||
*Radiology Dept. Policy, LR - 6.12, Retention/Disposal of Radiology Images | *Radiology Dept. Policy, LR - 6.12, Retention/Disposal of Radiology Images | ||
* | *Contract Management Policy '''(policy number needed)''' | ||
*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] | *[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] | ||
*[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] | *[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] | ||
*[https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization] | |||
This page maintained by [mailto:dpanowic@unmc.edu dkp]. | This page maintained by [mailto:dpanowic@unmc.edu dkp]. | ||