Compliance · HIPAA
HIPAA and Offsite Media Vaulting
HIPAA is not a storage product you can buy. It is a programme, and physical custody of media is one component of it. What a vault contributes is evidence: where media was, who moved it, and proof it was destroyed when retention ended.
Bring your retention schedule. We will tell you what it actually costs to meet it.
Read this first. This page is general background on how physical custody supports a compliance programme. It isnot legal advice, it does not state retention periods, and it does not certify that any arrangement satisfies any rule. Requirements change and vary by firm. Get the answer from your own counsel or compliance officer, then tell us what you need us to do.
Scope
Who this applies to
Covered entities and their business associates — practices, clinics, billing companies, and the vendors that serve them.
The recurring themes
- Physical safeguards over media containing protected health information.
- Accountability for the movement of media — who had it and when.
- Disposal that can be evidenced rather than asserted.
- Business associate relationships where a vendor handles PHI on your behalf.
Our part
What custody actually contributes
- A 9R vault with man-trap entry and armed monitoring — the physical safeguard layer.
- Barcode chain of custody at every handoff, timestamped and signed.
- Client-witnessed destruction with a certificate listing every serial.
- A business associate agreement where we hold media containing PHI. Ask for it at contracting.
Said plainly
What we do not do
We never access contents. We do not assess your programme, we do not certify compliance, and we do not advise on retention periods. Anyone selling you "HIPAA compliant storage" as a finished product is overstating what storage can do.
Sectors this usually affects
Common questions
- Does using you make us HIPAA compliant?
- No. It supports the physical safeguard and disposal parts of your programme. Compliance is a programme, not a vendor.
- Will you sign a BAA?
- Yes, where we hold media containing PHI. Raise it at contracting.
- Do you access PHI?
- No. Media arrives sealed and stays sealed.
Bring your retention schedule.
We will tell you plainly what custody covers and what it does not. That is a more useful conversation than a compliance claim.