University of Kansas Medical Center Operational Protocol:
Computer Equipment Disposal Policy

Principle

Computer and electronic equipment often contains heavy metals and other hazardous materials that adversely affect the environment is not disposed of in a proper manner.  Correct recycling reduces the environmental impact and allows non-profit organizations to obtain electronic equipment at a reduced cost.

In addition, this equipment may contain personal, confidential or legally-protected information that, if not properly erased or destroyed, could lead to inappropriate disclosure, identity theft, and liability to the equipment’s owner and KUMC.

Purpose

The purpose of this policy is to ensure that members of the University community dispose of KUMC-owned electronic equipment in both an environmentally responsible and secure manner.  This policy is required by Kansas state law (Department of Health and Environment) and federal guidelines including the Health Information Portability and Accountability Act of 1996 (HIPAA), the Gramm-Leach-Bliley Act (GLBA), and the Family Educational Rights and Privacy Act (FERPA).

Resources covered

This policy applies to any computer equipment or peripheral devices that are no longer needed in a department including, but not limited to the following:  personal computers, servers, hard drives, laptops, mainframes, personal digital assistant (PDA) devices (i.e., Palm, Visor) or handheld computers ( i.e., Windows Mobile or CE based devices), peripherals (i.e., keyboards, mice, speakers), printers, scanners, typewriters, compact and floppy discs, portable storage devices (i.e., USB drives), backup tapes, printed materials, and microfiche.

This policy includes equipment that may have been purchased with grant, faculty startup, or other outside funding. Equipment purchased with federal grant funds may have specific federal guidelines that will need to be observed by the department. It is the responsibility of the department to ensure any federal guidelines are coordinated with University staff involved with the disposal of surplus equipment.

Groups covered

KUMC faculty, staff, and students

Exemptions

 This policy applies to everyone at all campuses and sites of the University of Kansas Medical Center. There are no exemptions.

Procedures

KUMC requires the destruction of all data in computers or electronic storage devices prior to disposal.  The following procedures must be followed for the disposal of all computer equipment and storage devices to ensure secure removal of any information that may be on the device. 

• The department or owner of computer equipment or electronic devices must complete a computer equipment disposal form for each piece of equipment that is to be disposed of, located on the Environment, Health and Safety Office web site.
• The department or owner will deliver the obsolete equipment and associated Computer Equipment Disposal Form to the designated drop-off location.  The Environmental Health and Safety Office sponsors a drop-off for obsolete equipment each month and the date and time is announced in a Critical Information email to all staff.
• Departments with a large number of devices (more than 40) or cannot drop-off the equipment due to size or other reasons should contact the Environmental Health and Safety Office to request that the equipment be picked up.
• Information Resources staff will assess the equipment as to whether it will be retained for use as spares for other campus equipment or if the equipment is to be disposed of.
• For any equipment that is to be disposed of, Information Resources staff will follow procedures to ensure any information on the equipment has been permanently removed. For all storage devices, this is defined as using software that meets US Department of Defense Standard DoD 5220.22-M to overwrite the data so that old data cannot be recovered.   Simply erasing the data or reformatting the hard drive does not prevent data from being recovered by technical means.
• Information Resources staff will fully destroy and properly dispose of any electronic devices that cannot be cleaned sufficiently to guarantee that all data has been removed during the cleanup procedures.
• Once the equipment has been properly prepared, it will be disposed of through standard surplus handling procedures.
• The Environmental Health and Safety Office will maintain a record of all equipment sent for disposal and the method in which all information was removed (i.e., DoD overwriting or physical destruction) from each device.

Departments may dispose of computer media (i.e., floppy disk, tape media, zip media, CD media, DVD media, microfiche, USB storage devices) once it has been rendered unreadable. The preferred method is physical destruction and/or mutilation of the computer media that renders it unusable. This would include cutting of the floppy disk or tape media or physically breaking the CD or DVD media.

Enforcement

Suspected or known violations of this policy will be reported to the appropriate University officials, and may result in:

• Accountability for conduct under any applicable University or campus policies, procedures, or collective bargaining agreements, including disciplinary action.
• Prosecution under applicable statutes.

Suspected or known violations of University regulations and/or State and Federal law will be processed by the appropriate University authorities and/or law enforcement agencies.

Contact information

For information on this policy, please contact:
Sherry Callahan
Director of Information Security
Department of Information Resources
University of Kansas Medical Center
1020 Taylor, 3901 Rainbow Blvd
Kansas City, Kansas 66160
(913) 588-0966

Jim Bingham
Associate Vice Chancellor for Information Resources
Chief Information Officer
University of Kansas Medical Center
1014 Taylor, 3901 Rainbow Blvd
Kansas City, Kansas 66160
(913) 588-7300

Ryan Lickteig
Director of the Environment, Health and Safety Office
University of Kansas Medical Center
B320 KU Hospital, 3901 Rainbow Blvd
Kansas City, Kansas 66160
(913) 588-1081