Retiring a device starts a federal compliance clock.
Every computer, server, and medical device in your storage room carries data and hazardous-material obligations the day it goes out of service — penalties accrue daily until properly disposed of.
These regulations apply regardless of practice size or patient volume. Violations are rarely discovered until after an audit — at which point the exposure is already significant.
EPA RCRA — 40 CFR 261.2 / 262
On-Site Device Storage
Once a device goes out of service and contains lead, mercury, or cadmium — and most electronics do — it is reclassified as hazardous waste. There is a short window to dispose of it through a licensed vendor before fines begin accruing daily.
Penalty: $37,500 per day, per violation
HIPAA — 45 CFR §164.310(d)(2)
Electronic PHI Disposal
Any device that has stored, processed, or transmitted patient data must be disposed of with a documented, certified destruction process. A Certificate of Data Destruction is required for every device — without it, there is no legal proof patient data wasn't compromised.
Penalty: Up to $117,500 per violation
RCRA — 42 U.S.C. §6928 + 40 CFR 262.17
Hazardous Material Handling
Electronic devices contain lead, mercury, and cadmium — regulated hazardous materials. Shredding-only disposal mixes material streams and allows non-recoverable materials into landfills. This does not satisfy EPA compliance regardless of transaction volume.
Penalty: $37,500 per day, per violation
What You Get
Built-in compliance. Nothing on your team's plate.
Our certified process covers every federal requirement from the moment devices leave your facility — your audit trail is always complete.
🛡️
NIST-Certified Data Destruction
Every device destroyed to NIST 800-88 — the benchmark HIPAA auditors reference. No factory-reset workarounds.
📋
Certificate of Destruction — every job
Issued automatically after every pickup, stored in your 24/7 client portal. Pull any certificate on demand.
🔢
Serial-Number-Level Certificates
Every certificate tied to the individual device's serial number — device-by-device proof, not a vague batch receipt.
📍
GPS-Tracked Chain of Custody
Every shipment GPS-tracked from your door to final disposition, with an EPA-compliant manifest on every job.
🏅
R2v3 Certified Recycling Network
Highest certification in responsible electronics recycling. Every downstream processor R2v3-certified. Nothing exported overseas.
💰
Material Recovery Offsets Cost
Devices dismantled — not shredded. Recovered materials offset your transportation and destruction costs.
🌿
Zero Waste to Landfill
Full dismantling by trained technicians. Non-recyclable materials handled via waste-to-energy — nothing landfilled.
🖥️
24/7 Client Portal
All destruction certificates and chain-of-custody records in one place. Audit-ready, always — without chasing paperwork.
Equipment Coverage
One vendor. Every device type.
Whether it's routine hardware, aging medical equipment, or a full site closure — all handled under a single compliant process.
💻
Computers and Workstations
Desktops, laptops, tablets, and all-in-ones.
🖥️
Servers and Storage
Racks, NAS, and data infrastructure.
🖨️
Printers, Copiers and Phones
Any networked device with a hard drive or flash storage.
🏥
Medical Devices
Dialysis machines, blood analyzers, X-ray equipment, and diagnostic devices.
📽️
AV and Peripheral Equipment
Projectors, smart boards, monitors, and communication devices.
🏢
Facility Refreshes and Closures
Renovations, hardware upgrades, full decommissions — any volume.
Our Process
How it works — start to finish
From the moment you schedule a pickup to your final certificate, every step is documented and EPA-compliant.
1
Schedule a free assessment
Tell us what's on-site — devices, quantity, location. We map your compliance exposure at no cost and no obligation.
2
Pickup and GPS-tracked transport
A certified technician picks up every device. Every shipment is GPS-tracked with an EPA-compliant manifest issued on the spot.
3
NIST-certified data destruction
Every data-bearing component is destroyed to NIST 800-88 standard by trained technicians — not just shredded or factory reset.
4
Responsible material recovery
Devices are fully dismantled and segregated by material type. Recoverable materials go to R2v3-certified downstream processors.
5
Certificate of Destruction issued
A serial-number-level Certificate of Data Destruction is issued for every device and stored in your 24/7 client portal — ready for any auditor, any time.
Common Objections
We hear these every day
The compliance exposure in device disposal is specific and commonly misunderstood. Here's how the most common assumptions hold up.
🏥
"We already have someone for that."
Can they produce a Certificate of Destruction for every disposal event, on demand? That is the first question in a HIPAA audit. MedPro Disposal issues a Certificate of Data Destruction after every job, stored in your portal, available any time.
💻
"IT handles our device disposal."
Do they provide a Certificate of Data Destruction and an EPA-compliant manifest every time? If not, the compliance liability stays with the practice — not IT. The obligation doesn't transfer with the device. MedPro Disposal closes that gap with documented chain-of-custody from pickup through final disposition.
📦
"We don't have that many devices."
It only takes one device without documentation to create one violation. If any device has been taken out of service without a documented disposal plan, EPA exposure under RCRA may already be running — $37,500 per day, per violation, regardless of quantity. Volume doesn't change the federal requirement.
💲
"We already have an affordable solution."
If you're not receiving a Certificate of Data Destruction and documented chain-of-custody on every pickup, the liability never transferred. Free or low-cost haulers are typically not R2-certified. Without certification there is no audit trail — that's not a cost saving, it's deferred exposure.
Frequently Asked Questions
Questions we get asked most
Clear answers on compliance, certifications, and how our process works.
Any device that has ever stored, processed, or transmitted electronic protected health information — including computers, workstations, tablets, phones, servers, and certain medical devices. If it touched patient data at any point, disposal must be documented with a certified destruction record.
No. A factory reset does not meet HIPAA's requirement for certified destruction of electronic PHI. NIST-certified data destruction — with a documented Certificate of Destruction — is required for legal defensibility. Devices that were only factory-reset before being donated, traded, or resold carry full HIPAA exposure.
Under EPA RCRA (40 CFR 261.2 / 261.3 / 262), once a device goes out of service and contains lead, mercury, or cadmium — most electronics do — it is reclassified as hazardous waste. Without a documented disposal plan, federal enforcement exposure runs up to $37,500 per day, per violation. The clock does not stop on its own.
MedPro Disposal is R2v3 certified — the highest standard in responsible electronics recycling — and holds ISO certifications covering quality, environmental, and health and safety management. All certifications apply across every service, not just select tiers. R2v3 certification requires annual third-party audits and unannounced quarterly spot checks.
The full range: computers, workstations, laptops, tablets, servers, printers, copiers, phones, and any networked device with a hard drive or flash storage. On the medical side: dialysis machines, blood analyzers, X-ray equipment, and other patient-facing equipment. AV and peripheral equipment — projectors, smart boards, and communication devices — are also covered.
Every device is logged and assigned a tracking ID, decontaminated, then dismantled by trained technicians — not just shredded. Components are segregated by material type, data-bearing parts destroyed to NIST standard, and recoverable materials routed to R2v3-certified downstream processors. You receive a Certificate of Data Destruction tied to the device's serial number, plus an EPA-compliant manifest, all stored in your portal. Nothing is landfilled and nothing is exported overseas.
No minimum. It only takes one device without documentation to create a violation — so we handle single-device pickups with the same compliant process as large facility decommissions. Volume doesn't change the federal requirement, and our process doesn't change either.
A single-vendor solution means one contract, one invoice, and one point of accountability across all device types and all locations. It eliminates gaps in documentation that occur when multiple vendors handle different device types — gaps that create audit exposure. Built-in backup capacity means no gaps in service across all 48 states.
Certifications
Certified at every level
These certifications are the documented proof that every device is handled to the standard a federal auditor would require.
🏅
R2v3 Certified
Highest standard in responsible electronics recycling. Annual third-party audits and quarterly spot checks.
🛡️
NIST 800-88
Data destruction benchmark HIPAA auditors reference. Applied to every job, every device, without exception.
🏆
ISO Certified
Quality, environmental, and health and safety management — independently verified across every service.
Pricing
All-inclusive pricing
One price covers everything from pickup to portal access. No hidden fees, no surprise charges.
Everything included — one invoice
Zero surprises. Full compliance.
A free device assessment tells you exactly what's on-site, where the compliance clock stands, and what it costs to close it — with no obligation.
