The link to the IT Security Awareness Quiz is at the end of the article. Complete the quiz for an entry in a drawing for 1 of 6 $50 Amazon gift cards.

Secure disposal is the process of rendering data, whether paper or electronic, unreadable by any means. This includes data, i.e., any UCSF Institutional Data, in all formats on any media (mobile devices, databases, servers, laptops, etc.)  Although data breaches caused by improper disposal of information have been trending down in recent years, according to the HIPAA Journal, improper disposal still caused three significant breaches in healthcare organizations in 2024 and continues to impact the higher education sector.

At home, office & clinical locations, we are responsible for properly disposing of all forms of UCSF data at the end of its useful life or according to data retention policies.

This is a necessary practice in staying compliant with applicable state, federal, and global data privacy regulations, including the California Privacy Rights Act (CPRA), which has adopted data minimization requirements in effect since January 1, 2023.

Here is some helpful information to ensure you securely dispose of UCSF and your personal data.

Secure disposal of paper media

• Use secure disposal bins. If you do not have a bin, your department manager can order one from the vendor, Shred-It, by contacting their customer service at 1-800-MYSHRED (1-800-697-4733) or [email protected] and creating a requisition in BearBuy.
• If you cannot access a secure disposal bin, use a cross-cut shredder from a reputable company. They are available at most office supply stores. Documents shredded in cheap shredders can often be reconstructed. If you are working from home, you may need to ask your supervisor about purchasing one for home use.

Secure disposal of electronic media

• Request help from the IT Service Desk or call 415-514-4100. IT will collect and arrange for the destruction of any electronic media (hard drives, CDs, tapes, etc.) that contain sensitive or restricted data, including PII (personally identifiable information) and PHI (patient health information). This service is free.

Improper disposal of paper and electronic media

It can have severe consequences. These include:

• Security breaches
• Significant fines and penalties for UCSF
• Harm to UCSF's reputation
• Personal liability for a security breach

Additional tips

Here are some additional tips to ensure you securely dispose of media:

• Never try to destroy your electronic media or devices yourself, as your method may not do so properly or render your data unrecoverable. 
• Never dispose of paper with sensitive or restricted data (e.g., patient information, personal information, HR data, financial data) into regular trash or recycle bins.
• Always use secure disposal bins for paper media, including sensitive or restricted information.
• Use the UCSF IT secure disposal service for electronic data and devices.

Take the quiz on this article. Everyone who passes is entered to win one of six $50 Amazon Gift Cards.

Additional Information

For additional information, please visit:

• UCSF Drive, Tape & Data Destruction
• HIPAA Healthcare Data Breach Report
• California Privacy Rights Act (CPRA)
• UCSF Policy 650-16 Addendum F, UCSF Data Classification Standard
• Exploring Best Practices for IT Asset Disposal in Higher Ed