← All Resources

Where Can I Go to Shred Documents? HIPAA-Compliant Options

Last reviewed: August 17, 2026

Healthcare facilities generate enormous volumes of paper documents containing protected health information (PHI): patient records, insurance forms, prescription records, lab results, billing statements, and internal correspondence. When these documents reach the end of their retention period, they cannot simply be tossed in a recycling bin. HIPAA requires that PHI be rendered unreadable and indecipherable before disposal, and the most reliable way to achieve that is professional document shredding.

Why Healthcare Needs Professional Shredding

HIPAA's Privacy Rule (45 CFR 164.530) requires covered entities to implement reasonable safeguards to protect PHI, and that includes proper disposal. The HIPAA Security Rule adds requirements for electronic media, but paper records remain a significant vulnerability.

Simply tearing up documents or using a small office shredder is not sufficient for compliance. Office shredders produce strip-cut output that can be reassembled, they cannot handle staples, binders, and large volumes efficiently, and they place the burden on staff to shred every document individually. Professional shredding services use industrial cross-cut or micro-cut shredders that render documents completely unrecoverable.

A HIPAA breach caused by improperly disposed paper records can result in fines ranging from $100 to $50,000 per violation (with a maximum of $1.5 million per year for identical violations), plus the reputational damage and notification costs associated with a breach.

On-Site Shredding

On-site (also called mobile) shredding means a shredding truck comes to your facility and destroys documents in the parking lot while you watch. The process:

1. Locked collection bins are placed throughout your facility for staff to deposit documents.
2. On the scheduled date, a technician collects the bins and feeds the contents into an industrial shredder mounted inside a truck.
3. The shredding happens at your location, and you can observe the process if desired.
4. The technician provides a Certificate of Destruction documenting the date, method, and quantity of material destroyed.
5. Shredded material is transported to a recycling facility.

Best for: Facilities that require maximum control over PHI and want to witness the destruction. Common for hospitals, large practices, and facilities with high-security requirements.

Off-Site Shredding

Off-site shredding means documents are collected from your facility and transported to a secure shredding plant for destruction. The process:

1. Locked collection bins are placed at your facility.
2. A bonded, background-checked driver picks up the bins on a scheduled basis.
3. Documents are transported in a secure, locked vehicle to the shredding facility.
4. Documents are destroyed at the plant, and you receive a Certificate of Destruction.

Best for: Facilities that generate large volumes of documents and want the cost efficiency of plant-based shredding. Off-site shredding is typically less expensive per pound than on-site service because the plant equipment is more efficient than a mobile unit.

Certificates of Destruction

A Certificate of Destruction is the key compliance document in any shredding program. It proves that your facility properly disposed of PHI-containing documents. The certificate should include:

• Date and time of destruction
• Method of destruction (cross-cut shredding, pulping, etc.)
• Description of materials destroyed (weight or volume)
• Name of the shredding company and the technician who performed the work
• Statement that materials were destroyed in compliance with HIPAA requirements

Retain Certificates of Destruction for a minimum of six years (HIPAA's documentation retention requirement). Some facilities retain them longer as a best practice.

What to Look for in a Shredding Provider

Not all shredding companies are equal, especially when PHI is involved. Evaluate providers on:

• HIPAA compliance understanding: The provider should have a Business Associate Agreement (BAA) ready to sign. Under HIPAA, any entity that handles PHI on your behalf must execute a BAA. If a shredding company does not offer one, they may not understand their HIPAA obligations.
• Employee screening: All personnel who handle your documents should be background-checked and bonded.
• Chain of custody: From the locked bin to the shredder, there should be no point at which documents are accessible to unauthorized individuals.
• Shred size: Cross-cut and micro-cut shredding produce particles that are effectively impossible to reconstruct. Strip-cut shredding is not considered adequate for HIPAA compliance.
• Certificates of Destruction: The provider must supply these for every service visit. No certificate, no proof of compliance.
• Insurance: The provider should carry liability insurance that covers data breach incidents.

Bundling Document Shredding with Medical Waste

Many healthcare facilities find it efficient to use a single provider for both medical waste and document shredding. The advantages include:

• One vendor relationship and one invoice to manage
• Coordinated pickup schedules (medical waste and shredding on the same visit)
• Simplified compliance documentation from a single source
• Potential cost savings through bundled service pricing

If your current medical waste provider offers HIPAA-compliant document destruction, bundling the services may reduce both your administrative burden and your total cost.