HIPAA and Offsite Media Vaulting

Covered entities and their business associates — practices, clinics, billing companies, and the vendors that serve them.

• Physical safeguards over media containing protected health information.
• Accountability for the movement of media — who had it and when.
• Disposal that can be evidenced rather than asserted.
• Business associate relationships where a vendor handles PHI on your behalf.

• ◆A 9R vault with man-trap entry and armed monitoring — the physical safeguard layer.
• ◆Barcode chain of custody at every handoff, timestamped and signed.
• ◆Client-witnessed destruction with a certificate listing every serial.
• ◆A business associate agreement where we hold media containing PHI. Ask for it at contracting.

The most common misreading is that a vendor can be HIPAA compliant on your behalf. Compliance attaches to the covered entity and to its business associates through their agreements — a storage provider can be part of a compliant arrangement, and can sign a business associate agreement where appropriate, but no provider makes a practice compliant by storing its boxes. Treat any marketing that claims otherwise as a reason to look harder at everything else it says.

What gets asked for in practice is documentation rather than description. Where protected information sits, who can reach it, what agreement governs the party holding it, and what record exists of movement in and out. Our contribution to that file is narrow and specific: a custody record, an intake log, named authorized parties, and controlled physical access. The risk analysis, the policies and the training remain the practice's, and nothing we do substitutes for them.

We never access contents. We do not assess your program, we do not certify compliance, and we do not advise on retention periods. Anyone selling you "HIPAA compliant storage" as a finished product is overstating what storage can do.