Before sending unneeded computer equipment containing EPHI away for surplus or resale, you should:

• A. Delete files containing EPHI from the computer simply using the delete function of the operating system.
• B. Change the passwords of all users accessing the system, preventing access to all EPHI.
• C. Remove the hard drives from the computer equipment for destruction, or perform a secure deletion of all data using special methods that ensures data on magnetic media is completely unreadable.
• D. Make sure that whoever acquires the computer equipment agrees not to hold you liable for any EPHI contained on the equipment.

Answer: (C)

The action being tested is ensuring that electronic health information is not recoverable before disposing of or transferring hardware. Deleting files with the operating system ignores the reality that data can still reside in unallocated space, on backups, or in remnants on the drive that specialized recovery tools can retrieve. Simply changing passwords does not remove or obscure the data already stored on the device. The only reliable way to protect ePHI when equipment leaves your control is to either remove the hard drives and destroy them, or perform a secure data sanitization process that renders the data completely unreadable by any practical method. This aligns with established guidance on media sanitization, ensuring that sensitive information cannot be recovered by the next owner. Documenting the sanitization step is often part of the compliance process as well.