Health and care records are special category data under Article 9 of the UK GDPR. The bar for handling them sits higher than for ordinary personal data, and it does not drop the moment a machine is switched off for the last time.
A retired desktop from a consulting room still holds patient data until the drive has been sanitised and that sanitisation has been evidenced. Until then it is a breach waiting for someone to plug it back in.
What the DSPT asks you to show
The Data Security and Protection Toolkit expects you to evidence that end-of-life equipment was disposed of securely. An invoice from a recycler does not show that.
We give you the paperwork instead:
- An itemised manifest, signed before the van leaves.
- A Certificate of Data Erasure for every drive, referenced to the drive serial and to the serial of the machine it came out of.
- A record of physical destruction for any drive that could not be sanitised.
File it against your DSPT submission, or put it in front of your Caldicott Guardian, your DPO or the ICO. We hold no NHS approval and we are not on any framework: the assertion is yours to make, and our documentation supports the evidence behind it rather than satisfying the Toolkit.
Need-to-know access under the Caldicott principles counts for nothing if a drive leaves the building readable.
How the data is destroyed
Drives are sanitised to NIST SP 800-88 Rev. 1, and to HMG Infosec Standard 5 Enhanced on request; the method is set out under certified data destruction. These are the standards we work to, not certifications we hold.
We never open, index or inventory what is on a drive.
Equipment that has been in service a decade
Hardware stays in service as long as it works. The tower under the reception desk may have held demographics, scanned correspondence, referral letters and clinical system caches since before most of the current staff arrived.
Age makes erasure harder, not easier. Failed drives, machines that will not boot, laptops nobody has the BIOS password for. Bring them out with the rest. A spinning disk takes hours to work through where a modern SSD takes minutes, so tell us what is in the pile.
Clinical systems and licensed software
Tell us before collection if a workstation still carries a clinical system client, practice management software or imaging applications. Some of it needs deauthorising, or sits on a support contract you will want to close cleanly. Erasure takes the software with everything else, so anything you need has to come off first.
When it is nobody's job
If the practice has no IT function, disposal lands on the practice manager, between the rota and the CQC paperwork. We log it, take it away, sanitise it and document it, the same as any other IT asset recovery collection.
A care home is the same problem with less to work with: a few office PCs, an old server running the care planning system, a drawer of eMAR tablets nobody returned to the supplier.
Collection
We cover Oxfordshire, Buckinghamshire, Berkshire, Northamptonshire and Warwickshire, work around surgery hours, and can collect from a store room or corridor without going near a clinical area.
Collection is free where the resale value in the load covers the trip, and that value is credited back to you; otherwise we quote the cost first.
Send a rough list of what you have to oliver@kiverefresh.com, or get a quote, and we will tell you what happens to each item.