Which practice best ensures compliance with the Disposal Rule for physical records?

• A. Secure destruction such as shredding or pulverizing; ensure reconstruction is not possible.
• B. Simply moving records to offsite storage.
• C. Destroy only electronic backups; leave physical records.
• D. Recycling without shredding is sufficient.

Answer: (A)

Disposal of records with personal information must render the data unreadable and non-reconstructable to prevent future misuse. Secure destruction methods like shredding or pulverizing achieve this by completely destroying the contents so they cannot be rebuilt or read, which is exactly what the Disposal Rule requires.

Moving records offsite does not destroy them; it simply relocates them, leaving the information potentially accessible. Destroying only electronic backups while leaving physical records still exposes sensitive data in paper form. Recycling without shredding likewise fails to guarantee destruction, since data can often be recovered from recycled materials.

Therefore, secure destruction that prevents reconstruction is the best approach to ensure compliance.