What disposal practices satisfy the Disposal Rule for physical and electronic records?

• A. Overwriting electronic data only.
• B. Storing records indefinitely.
• C. Deleting files from a personal device without shredding.
• D. Secure destruction methods such as shredding physical documents and overwriting or securely erasing electronic data.

Answer: (B)

The Disposal Rule requires that records be disposed of in a way that renders the information unrecoverable, protecting against identity theft and unauthorized access. For physical documents, this means secure destruction such as shredding, burning, or pulping—any method that makes the information irretrievable. For electronic data, it means securely erasing or overwriting the data using approved methods so it cannot be reconstructed or recovered, which can include proper data-wipe processes or decommissioning devices appropriately.

Why this is the best fit: disposing of both physical and electronic records through secure destruction directly satisfies the requirement to make data unrecoverable. Merely overwriting electronic data without addressing physical records, or storing records indefinitely, or deleting files from a device without ensuring complete destruction, all leave room for data remnants or recovery and thus do not meet the rule. Using secure destruction for both types covers all bases and aligns with the intent of the Disposal Rule.