/policies/,/policies/administrative/,/policies/administrative/uwhc/,/policies/administrative/uwhc/department-specific/,/policies/administrative/uwhc/department-specific/radiology/,

/policies/administrative/uwhc/department-specific/radiology/103.policy

201410281

page

100

UWHC,

Policies,Administrative,UWHC,Department Specific,Radiology

Removal of Data from Decommissioned Storage Devices (1.03)

Removal of Data from Decommissioned Storage Devices (1.03) - Policies, Administrative, UWHC, Department Specific, Radiology

1.03

Removal of Data from Decommissioned Storage Devices





Effective Date:
12/26/2012

Administrative Manual
 Nursing Manual
 Other _______________

Policy #:


 Original
 Revision

Page 1
Of

Title: University of Wisconsin Hospital and
Clinics Removal of Data from
Decommissioned Storage Devices



I. PURPOSE
To establish a policy and procedure detailing the criteria by which qualified UW
Enterprise Imaging employees clear, erase, and remove all data and software from
computers, servers and disk subsystems prior to decommissioning.

II. DEFINITIONS
Term Definition
Decommission
The process of removing sensitive and/or confidential programs
or data files on computer storage media devices (e.g., hard
drives, file server, disk subsystem, Tape, USB drive) in a
manner that gives assurance that the information cannot be
recovered by keyboard or laboratory efforts.
Overwriting
The process of erasing, or “wiping,” the contents of an
electronic file or disk space. Overwriting of data means
replacing previously stored data on a storage media device with
a predetermined pattern of meaningless information. This
effectively renders the data unrecoverable. It is virtually
impossible to restore data on storage media that has been
properly “wiped.”
Physical Destruction
The physical destruction of storage media device is a process
whereby the physical storage media is rendered useless and
inaccessible. The end result is that individual “platters” of the
storage media are completely destroyed or each platter has a
minimum of three holes drilled through them.
Degaussing
Degaussing magnetically erases data from magnetic media and
hard drives. Before attempting any degaussing process, please
consult an information technology professional. Degaussing
may damage information technology electronics, making them
unusable.
Proof of Destruction
A certified statement and/or a detailed log completed and
signed by the person who supervised the destruction of the
storage media device.

Removal of Data from Decommissioned Storage Devices





Effective Date:
12/26/2012

Administrative Manual
 Nursing Manual
 Other _______________

Policy #:


 Original
 Revision

Page 2
Of

Title: University of Wisconsin Hospital and
Clinics Removal of Data from
Decommissioned Storage Devices



Term Definition
Transfer
For the purposes of this policy, transfer means the physical
removal or change of ownership of information technology
equipment from UW Enterprise Imaging to another entity.


III. POLICY
Data and Software Removed
All storage media that are supported, maintained, owned, or administered by the UW
Enterprise Imaging group shall have all residing data and software removed prior to the
equipment’s transfer or removal from UW Health.

Removal of Evidence of Ownership
Any evidence of ownership or use of the equipment must be removed to ensure that no
data of any type is left on the equipment.

Overwriting
The disk may be completely overwritten with data so that the old data cannot be
recovered. The number of times data must be overwritten depends upon the sensitivity of
the data. The U.S. Department of Defense has defined a clearing and sanitizing standard
(DoD 5220.22-M) that is used to meet their requirements. There are a number of free and
commercial products that can be used to sani ti ze the di sks, i ncluding those that meet DoD
standards.

Degaussi ng
Degaussing magnetically erases data from magnetic media and hard drives. Before
attempting any degaussing process, please consult an information technology
professional. Degaussing may damage information technology electronics, making them
unusable.

Physical Destructi on
As a last resort, information technology equipment can be "totally destroyed". For UW
Enterprise Imaging information technology equipment, the degaussing or overwriting

Removal of Data from Decommissioned Storage Devices





Effective Date:
12/26/2012

Administrative Manual
 Nursing Manual
 Other _______________

Policy #:


 Original
 Revision

Page 3
Of

Title: University of Wisconsin Hospital and
Clinics Removal of Data from
Decommissioned Storage Devices



processes are likely sufficient, but when the level of data sensitivity calls for it, total
destruction of the equipment can be undertaken if there is no longer any use for the
equipment or if the equipment no longer has any value. The National Industrial Security
Program Operating Manual used by national security agencies defines "destroy" as "to
disintegrate, incinerate, pulverize, shred or melt the equipment."


IV. COORDINATION

Author: Enterprise Imaging Manager, Radiology
Reviewers: Enterprise Imaging Supervisor, Radiology