Copies of patient information may be disposed of in any garbage can in the facility.

Disposing of patient information in any garbage can is a HIPAA violation because it does not render the PHI unreadable and creates a foreseeable risk of unauthorized disclosure.

HIPAA requires that PHI be disposed of in a manner that renders the information unreadable, indecipherable, and unable to be reconstructed, such as shredding paper documents or placing them in designated locked shred bins. Placing patient information in a regular garbage can exposes PHI to unauthorized access, which constitutes a potential breach of unsecured PHI. Covered entities must have documented media disposal policies that comply with these requirements.