Yes. Enter your email and we will send the full resource to your inbox.

How long do we have to keep the disposal log?

Retain the log for at least six years from the date of creation or last effective date, matching the documentation retention requirement in 45 CFR 164.530(j)(2).

Do we need a BAA with our shredding vendor?

Yes. A vendor that handles PHI for destruction is a business associate. Get a signed BAA before turning over any containers.

PHI Disposal & Destruction Tracking Log

A printable and digital tracking log clinics use to record every PHI destruction event with witness signatures and method details.

Short answer

A clinic-ready disposal log template that captures every PHI destruction event with the fields surveyors and OCR investigators expect.

What is inside

Required log fields aligned to 45 CFR 164.310(d)(2)(i)-(ii) media disposal
Acceptable destruction methods for paper and electronic media (NIST SP 800-88 references)
Witness and destroyer signature columns with date and item description
Vendor BAA tracking for outsourced shredding and certified destruction services
Six-year retention guidance for the log itself per 45 CFR 164.530(j)(2)
Sample completed entries showing how to fill out paper, hard drive, and mobile device rows

We publish the same practical templates and decision tools that clinics use to structure recurring HIPAA work. No enterprise gate. No resource-library gimmicks. Just practical material delivered quickly.

Editorial details

Written by: Angel Campa

Reviewed by: PHIGuard Compliance Research

Updated: April 28, 2026

Best next step: Open the matching product path

Sources

45 CFR 164.310 Physical safeguards | U.S. Government Publishing Office
45 CFR 164.308 Administrative safeguards | U.S. Government Publishing Office
HIPAA for Professionals | U.S. Department of Health and Human Services

Document every PHI destruction event so audits and OCR inquiries do not stall

Enter your email and we will send the PDF.