Businesses spend a lot of time protecting confidential information while they are using it. Passwords, locked filing cabinets, cybersecurity systems and employee policies are all designed to keep sensitive information from getting into the wrong hands.
But what happens when those records are no longer needed?
Protecting confidential information doesn’t end when a document is placed in the trash or recycling bin. Proper disposal is an important part of information security, and organizations need to make reasonable decisions about how sensitive records are destroyed and who they trust to destroy them.
This is where due diligence comes into the picture.
What Does Due Diligence Mean When Hiring a Shredding Company?
The term “due diligence clause” is sometimes used broadly when discussing privacy and information-destruction requirements. One particularly important federal requirement is the FTC Disposal Rule, which applies to businesses and individuals that possess certain consumer report information for a business purpose.
The FTC explains that covered organizations must take reasonable measures to protect against unauthorized access to or use of this information when it is disposed of. One example the FTC specifically provides is conducting due diligence when hiring a document destruction contractor.
In simple terms:
You shouldn’t hand confidential information to just anyone and assume your responsibility is over.
Your organization should take reasonable steps to determine whether the company being trusted with sensitive documents has appropriate security procedures and destruction practices.
What Does the FTC Consider Due Diligence?
The FTC provides several examples of steps an organization could take when evaluating a document destruction company.
Due diligence may include:
- Reviewing an independent audit of the destruction company’s operations or compliance.
- Obtaining information about the company from references.
- Requiring the destruction company to be certified by a recognized trade association.
- Reviewing and evaluating the company’s information-security policies and procedures.
These examples make an important point: price shouldn’t be the only consideration when selecting a shredding provider.
You are potentially giving that company access to documents containing names, addresses, Social Security numbers, financial information, employment information and other confidential data. Knowing who will handle those records and how they will be destroyed should be part of the decision.
Why Professional Document Destruction Matters
The FTC Disposal Rule identifies shredding, burning and pulverizing paper containing covered consumer report information as examples of disposal methods that can make the information unreadable and unable to be reconstructed.
That is very different from simply placing confidential documents into an ordinary dumpster or recycling container.
Once sensitive documents leave your control without appropriate safeguards, there is a potential opportunity for unauthorized access.
A professional shredding program helps establish a controlled process for taking confidential documents from your office or home and securely destroying them.
What About HIPAA?
Healthcare organizations have additional responsibilities when disposing of Protected Health Information, or PHI.
The U.S. Department of Health and Human Services explains that HIPAA-covered entities must apply appropriate administrative, technical and physical safeguards to protect PHI, including during disposal. For paper PHI, HHS identifies methods such as shredding, burning, pulping or pulverizing records so the information is essentially unreadable, indecipherable and cannot otherwise be reconstructed.
HHS also confirms that a covered entity may hire an outside business associate to dispose of PHI. When it does, the appropriate agreement must require the business associate to safeguard the PHI through the disposal process.
This is another reason businesses should carefully evaluate the company they select to handle confidential records.
Due Diligence Doesn’t Have to Be Complicated
If you are responsible for selecting a shredding company, ask questions.
How will our documents be handled?
Where will they be destroyed?
Who will have access to them?
Can we witness the destruction?
What security procedures are in place?
Does the company hold recognized industry certification?
Will we receive documentation showing that the shredding was completed?
These are reasonable questions when you’re turning over confidential information belonging to your customers, patients, employees or business.
FileShred Makes Secure Document Destruction Easy
At FileShred, we believe protecting confidential information should be straightforward.
We provide professional on-site document shredding for businesses, organizations and residents throughout Connecticut and the Springfield, Massachusetts area. Our mobile shredding equipment comes directly to your location so your documents can be destroyed before our truck leaves.
FileShred is NAID AAA Certified, providing customers with an independently audited approach to secure information destruction. We offer both one-time shredding and ongoing scheduled shredding programs, so you can select the service that works best for your organization.
With FileShred, you can:
- Have documents shredded at your location.
- Witness the shredding process.
- Receive a Certificate of Destruction.
- Choose one-time or ongoing shredding service.
- Schedule service Monday through Saturday.
- Have our team do the heavy lifting.
- Avoid unnecessary preparation—staples, paper clips and folders can remain with your documents.
- Receive straightforward pricing without surprise surcharges.
Don’t Just Hire a Shredding Company—Do Your Due Diligence
Choosing a document destruction provider shouldn’t simply be about finding someone willing to haul away old paper.
When those documents contain confidential information, the security practices and qualifications of the company destroying them matter.
Privacy and information-security requirements are designed to protect people from unauthorized access, fraud and identity theft. Taking reasonable steps to evaluate your document destruction provider can be an important part of your organization’s overall information-security program.
Have confidential documents that need to be destroyed?
Call FileShred at 860-261-9595. We can explain how our shredding service works, provide pricing and help you select a convenient service date.
FileShred — Secure Shredding. Done at Your Location.
