Retention and Destruction/Disposal of Private and Confidential Information: Difference between revisions

no edit summary
No edit summary
No edit summary
Line 37: Line 37:
Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access.  [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] outline considerations for the access control family of security controls.   
Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access.  [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule] outline considerations for the access control family of security controls.   
==Policy==
==Policy==
1#It is the policy of the UNMC/Nebraska Medicine and its affiliated entities to ensure the privacy and security of confidential information in the maintenance, retention and eventual destruction/disposal of such media. All destruction/disposal of confidential information media will be done in accordance with federal and state law and pursuant to the [http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule]. Records that have satisfied the period of retention will be destroyed/disposed of in an appropriate manner.  
#It is the policy of the UNMC/Nebraska Medicine and its affiliated entities to ensure the privacy and security of confidential information in the maintenance, retention and eventual destruction/disposal of such media. All destruction/disposal of confidential information media will be done in accordance with federal and state law and pursuant to the [http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule]. Records that have satisfied the period of retention will be destroyed/disposed of in an appropriate manner.  
#Records involved in any open investigation, audit or litigation should not be disposed of/destroyed. If a preservation notice is received the record retention schedule shall be suspended for these records until the preservation notice terminates.
#Records involved in any open investigation, audit or litigation should not be disposed of/destroyed. If a preservation notice is received the record retention schedule shall be suspended for these records until the preservation notice terminates.
#Records scheduled for destruction/disposal should be secured against unauthorized or inappropriate access until the destruction/disposal of the information is complete.
#Records scheduled for destruction/disposal should be secured against unauthorized or inappropriate access until the destruction/disposal of the information is complete.
Line 55: Line 55:
|'''Medium'''||'''Destruction Procedure(s)'''
|'''Medium'''||'''Destruction Procedure(s)'''
|-
|-
| Paper|| All paper should be disposed of in the desk-side recycling bins, the recycling carts or shredded in a shredding machine. All paper is considered confidential in the recycling process. Food waste and toiletry products are excluded and should not be placed in the recycling bins.
| Paper|| All paper should be disposed of in the desk-side recycling bins, the recycling carts or shredded in a shredding machine. All paper is considered confidential in the recycling process.  
Food waste and toiletry products are excluded and should not be placed in recycling bins.
|-
|-
| Audiotapes/Videotapes  || Tape over the information or forward the audio/videotape to Environmental Services (DOC 0647; zip 9030) in a sealed package for destruction. Place a "Please Destroy" label on the tape.
| Audiotapes/Videotapes  || Tape over the information or forward the audiotape/videotape to Environmental Services (DOC 0647; zip 9030) in a sealed package for destruction. Place a "Please Destroy" label on the tape.
|-
|-
| CD ROMs/DVDs || Cut in two and dispose of in trash.
| CD ROMs/DVDs || Cut in two and dispose of in trash.
-Large volumes of CDs may be forwarded to Environment Services.
Large volumes of CDs may be forwarded to Environment Services.
|-
|-
| Cell Phones || Cell phones which are no longer in use shall be returned to Information Technology who will dispose of the equipment.
| Cell Phones || Cell phones which are no longer in use shall be returned to Information Technology who will dispose of the equipment.
Line 70: Line 71:
Requestor will enter a Service Request containing the following information:<br />
Requestor will enter a Service Request containing the following information:<br />
1. Request to decommission a data/hard disk storage device<br />
1. Request to decommission a data/hard disk storage device<br />
2. A statement that records are being destroyed in the normal course of business pursuant to Nebraska Medicine Record Retention Policy<br />
2. A statement that records are being destroyed in the normal course of business pursuant to Nebraska Medicine Record Retention Policy ('''is there a policy number?''')/[http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule] <br />
3. Name of the department representative authorizing data destruction<br />
3. Name of the department representative authorizing data destruction<br />
4. Phone number of representative authorizing destruction<br />
4. Phone number of representative authorizing destruction<br />
Line 78: Line 79:
8. Questions regarding this process can be directed to PC Support Dispatch at 402-552-7777.<br />
8. Questions regarding this process can be directed to PC Support Dispatch at 402-552-7777.<br />
'''NOTE:'''  In the circumstances where a copier is being traded out, PC Support will ensure that the hard drive is secured by following their internal procedures.<br />   
'''NOTE:'''  In the circumstances where a copier is being traded out, PC Support will ensure that the hard drive is secured by following their internal procedures.<br />   
'''NOTE 2:'''  PC Support may, at its discretion, use data wiping tools to enable reuse of certain hard drives.  PC Support will follow NIST Special Publication 800-88 Guidelines for Media Sanitization which authorizes using the DOD certified standard 5022.22, 3X for wiping
'''NOTE 2:'''  PC Support may, at its discretion, use data wiping tools to enable reuse of certain hard drives.  PC Support will follow [https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization] which authorizes using the DOD certified standard 5022.22, 3X for wiping
|-
|-
| Cassette Tapes/Magnetic Media|| Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media.
| Cassette Tapes/Magnetic Media|| Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media.
Line 84: Line 85:
| Computer Diskettes/Floppy Disks || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media.
| Computer Diskettes/Floppy Disks || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media.
|-
|-
| Laser Disks|| Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media.
| Laser Disks|| Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the disks.
|-
|-
| Microfilm/Microfiche || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media.
| Microfilm/Microfiche || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the microfilm/microfiche.
|-
|-
| Photographs || Photographs should be shredded or cut in multiple pieces. Photographs should not be placed in recycling containers.
| Photographs || Photographs should be shredded or cut in multiple pieces. Photographs should not be placed in recycling containers.
Line 92: Line 93:
| Radiology Films || Refer to Radiology Dept. Policy, LR - 6.12, "Retention/Disposal of Radiology Images" '''is this a Nebraska Medicine or UNMC policy?'''
| Radiology Films || Refer to Radiology Dept. Policy, LR - 6.12, "Retention/Disposal of Radiology Images" '''is this a Nebraska Medicine or UNMC policy?'''
|-
|-
| Printer Ribbons || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the media.
| Printer Ribbons || Forward to Environmental Services (DOC 0647; zip 9030) in a sealed container for destruction. Place a "Please Destroy" label on the container.
|-
|-
| Other || Follow federal/state requirements; contact the Director, Environmental Services, at 402-559-6118, '''(do you have a better number for them?)''' or [mailto:debrbishop@nebraskamed.com Privacy Officer] for further information.
| Other || Follow federal/state requirements; contact the Director, Environmental Services, at 402-559-6118, '''(do you have a better number for them?)''' or [mailto:debrbishop@nebraskamed.com Privacy Officer] for further information.
Line 102: Line 103:
##Environmental Services will be responsible for issuing and logging the keys for unlocking these containers.
##Environmental Services will be responsible for issuing and logging the keys for unlocking these containers.
#Documentation of Secure Disposal
#Documentation of Secure Disposal
The Certificate of Destruction for all recycled UNMC/Nebraska Medicine confidential material will be kept on file in the Recycling Coordinator’s office.
The Certificate of Destruction for all recycled UNMC/Nebraska Medicine confidential material will be kept on file in the Recycling Coordinator’s office.
==Definitions==
==Definitions==
Line 114: Line 114:
*Contact the [mailto:infosecurity@unmc.edu Information Security Office]
*Contact the [mailto:infosecurity@unmc.edu Information Security Office]
*Contact Director, Environmental Services, at 402-559-6118, '''(do you have a better number for them?)'''  
*Contact Director, Environmental Services, at 402-559-6118, '''(do you have a better number for them?)'''  
**Contact Human Resources – Records at 402-559-8962 or Human Resources - Employee Relations  
*Contact Human Resources – Records at 402-559-8962 or Human Resources - Employee Relations  
*Contact [mailto:rboldt@unmc.edu Recycling Coordinator]
*Contact [mailto:rboldt@unmc.edu Recycling Coordinator]
*Contact [mailto:debrbishop@nebraskamed.com Privacy Officer]  
*Contact [mailto:debrbishop@nebraskamed.com Privacy Officer]  
*Contact PC Support Dispatch at 402-552-7777 ('''is there an email address for this dept?''')
*Procedure No. 6056, [https://info.unmc.edu/its-security/policies/procedures/destruction-confinfo.html Destruction of Private and Confidential Information]
*Procedure No. 6056, [https://info.unmc.edu/its-security/policies/procedures/destruction-confinfo.html Destruction of Private and Confidential Information]
*UNMC Policy No. 8009, [[Contracts]]
*UNMC Policy No. 8009, [[Contracts]]
*[http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule]
*[http://www.sos.ne.gov/records-management/schedule_170.html UNMC Record Retention Schedule]
*Nebraska Medicine Record Retention Policy ('''is there a policy number?''')
*Radiology Dept. Policy, LR - 6.12, Retention/Disposal of Radiology Images
*Radiology Dept. Policy, LR - 6.12, Retention/Disposal of Radiology Images
*“Contract Management Policy”)
*Contract Management Policy '''(policy number needed)'''
*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]
*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]
*[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule]  
*[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule]  
*[https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization]


This page maintained by [mailto:dpanowic@unmc.edu dkp].
This page maintained by [mailto:dpanowic@unmc.edu dkp].