What should you do with hard drives containing PHI before selling the computers?

When selling computers that contain protected health information (PHI), it is essential to handle the hard drives with utmost care to ensure that sensitive data is not compromised. The best course of action is to erase and remove the hard drives from the computers before selling them.

By removing the hard drives, you eliminate any risk of unauthorized access to the information that was previously stored on them. Simply formatting the hard drives may not be sufficient, as this process can often be reversed by sophisticated data recovery techniques. Therefore, just formatting does not fully protect PHI.

Erasing the drives, on the other hand, typically involves overwriting the data multiple times to ensure that it cannot be recovered, but the additional step of physically removing them adds an extra layer of security. This guarantees that even if the new owner attempted to retrieve data from the drives, they would be unsuccessful since the drives are no longer part of the computer being sold.

Storing the hard drives for future use poses a risk of data exposure if they are not properly secured or eventually fall into the wrong hands. Incinerating hard drives is an extreme measure and might not be practical, as it destroys the hardware completely rather than allowing for potential reuse while ensuring data protection through erasure.

Overall, er