A device can leave the building with a clean hard drive and still carry patient data in a service log, a compact flash card or a cloud account. Decommissioning is not a single delete command. It is a documented process that shows what was removed, how it was removed and who verified the result.

Where Data Actually Lives on a Device

Data lives in more places than the main storage drive: embedded memory, service logs, configuration files, image archives, network shares, cloud accounts and the service laptop used to maintain the unit.

A used imaging system may hold patient images in a local archive and a copy in a vendor cloud. A laboratory analyzer may store results, quality-control records and operator IDs. A pump may keep usage logs and error history. Each location needs to be identified before the wipe begins.

The device\’s own documentation should identify the data-bearing components and the manufacturer\’s decommissioning procedure. A service laptop or USB drive used during maintenance can hold logs, configuration backups and patient images. The decommissioning scope should include those tools, not only the device. If the seller\’s technician keeps a copy for support, the copy is still data and must be addressed. If the documentation is missing, the organization should ask the manufacturer or treat the device as containing unknown storage. The regulatory context varies by market, from FDA rules and the EU Medical Device Regulation 2017/745 to MHRA, TGA and PMDA requirements, while WHO guidance frames the shared principles; the wipe record should reflect the privacy rules of the market.

Storage Types You Will Encounter

Storage types include hard disk drives, solid-state drives, compact flash, SD cards, USB devices, embedded flash and optical media. Each behaves differently under deletion and each needs a removal method that fits the technology.

A solid-state drive may retain data in spare blocks even after a standard overwrite, and wear-leveling can leave copies outside the logical address range. A hard drive can be overwritten or degaussed; flash media may need cryptographic erase or destruction. The method should match the media, not a generic checklist. The storage map should be specific to the model and software version. A service manual may list the main drive but not the flash on a controller board. The manufacturer\’s decommissioning instructions are the best source, and the service record should confirm which components were accessed. The record should note the firmware version, because the storage layout can change between releases.

Removal Versus Destruction

Removal deletes or sanitizes the data so it cannot be recovered; destruction physically eliminates the media. The choice depends on the media, the sensitivity of the data and whether the device will be reused or sold.

A device that will be resold needs a sanitization method that preserves its function. A device that will be scrapped can have its storage destroyed. A device with embedded storage that cannot be sanitized may need the board replaced or the unit destroyed.

The organization should document the decision, not only the action. A record that says \”drive wiped\” without the method, the tool and the verification is not evidence of sanitization. A sanitization method is not automatically adequate because it is certified for one media type. An overwrite tool designed for a hard drive may not sanitize a solid-state drive, and a factory reset may not touch the embedded log. The method should be matched to the media and documented. Where destruction is chosen, the organization should record the destruction method, the vendor and the witness. A destruction certificate should identify the media, not only the device.

Vendor-Assisted Wipe and Its Documentation

A vendor-assisted wipe uses the manufacturer\’s service procedure or tool to remove data and reset the device to a defined state. It is often the safest route for complex devices, but it still needs documentation.

The vendor should provide a work order or certificate that identifies the device, the serial number, the software version, the procedure used and the result. The record should also state whether the device was returned to a clinical configuration or to a factory state, because the next owner needs to know.

The vendor\’s certificate should also confirm that the device was tested after the wipe. A device returned to a clinical configuration needs a functional check, and a device returned to a factory state needs a documented baseline. The record should say which state the buyer is receiving. A vendor wipe does not automatically cover data held outside the device, such as a cloud account or a service laptop. Those locations need separate confirmation and, where applicable, deletion.

Verification and Certificates

Verification confirms that the sanitization was performed and, where possible, that the data is no longer recoverable. The certificate should identify the media, the method, the standard or procedure, the date and the person who verified it.

The verification may be a successful completion report from the sanitization tool, a physical inspection, a sample read or a witness statement. The level of evidence should match the sensitivity of the data and the risk of the device being reused.

A certificate without a device identifier is difficult to tie to the unit. The record should link the certificate to the asset register, the serial number and the disposal or transfer document. The verification should be performed by someone who did not perform the wipe where practicable. A second person or a tool-generated report reduces the risk of a false confirmation. The record should identify the verifier and the evidence used.

Patient Data and Privacy Obligations

Patient data on a medical device is subject to the privacy rules of the jurisdiction, and decommissioning is part of the organization\’s obligation to protect it. The organization should confirm the retention requirements before deleting anything.

Some records must be retained for a defined period even after the device is retired. The decommissioning plan should distinguish the data that must be destroyed from the data that must be archived. Deleting the wrong record can create a compliance problem as serious as leaving patient data on the device.

The organization should also consider data in backups, email, ticketing systems and vendor support portals. A device wipe does not remove a copy held by the service provider, and the contract should say how those copies are handled. The privacy office should be consulted before the wipe, not after, because retention requirements may prohibit deletion. Where a breach occurs during decommissioning, the organization should follow its incident response and notification process. The decommissioning record should be preserved as part of the investigation.

Records to Keep After Disposal

The disposal file should allow the organization to answer an audit question years later: what device, what data, what method, who verified it and where it went. The file should be retained for the period required by the organization\’s records policy and the applicable privacy rules. A disposal record that is destroyed too early cannot support an audit or a breach investigation. In practice, the record should also state whether the device was transferred, recycled or destroyed, and the full name of the receiving organization and the date.

What Buyers Should Ask a Seller

A buyer should ask for the wipe evidence before the unit ships, and it should verify that the evidence matches the device. A certificate for a different serial number is not evidence for this unit.

The buyer should also ask whether the device has cloud accounts, vendor portals or service subscriptions that remain linked to the previous owner. Those accounts can retain data and can be a route back into the device if they are not transferred or closed. The buyer should also ask whether the seller can provide the manufacturer\’s decommissioning procedure and the identity of the technician who performed the work. A certificate without a procedure is harder to assess.

The clinical waste guide covers the disposal side, and the Knowledge section has related records and decommissioning guides. If you are selling or buying a used unit and want the data evidence reviewed, send the records to the HHG team.

{ \”@context\”: \”https://schema.org\”, \”@type\”: \”FAQPage\”, \”mainEntity\”: [ {\”@type\”: \”Question\”, \”name\”: \”How do I ensure patient data is removed before selling a device?\”, \”acceptedAnswer\”: {\”@type\”: \”Answer\”, \”text\”: \”Identify every storage location, including embedded memory, logs, archives and cloud accounts. Use a sanitization method that fits the media, follow the manufacturer\’s procedure where available, and obtain a certificate that identifies the device and the result. Verify the evidence before transfer.\”}}, {\”@type\”: \”Question\”, \”name\”: \”Can deleted data be recovered from medical equipment?\”, \”acceptedAnswer\”: {\”@type\”: \”Answer\”, \”text\”: \”It can, depending on the media and the deletion method. A simple file delete or format may leave recoverable data, and solid-state drives can retain copies in spare blocks. A proper sanitization method and verification reduce the risk, but the evidence should match the media.\”}}, {\”@type\”: \”Question\”, \”name\”: \”What proof of data destruction should I keep?\”, \”acceptedAnswer\”: {\”@type\”: \”Answer\”, \”text\”: \”Keep the asset and serial number, the data inventory, the sanitization method, the verification result, the certificate or work order, the chain of custody and the disposal or transfer record. The file should let an auditor link the evidence to the specific device.\”}}, {\”@type\”: \”Question\”, \”name\”: \”Does a factory reset wipe a medical device?\”, \”acceptedAnswer\”: {\”@type\”: \”Answer\”, \”text\”: \”Not necessarily. A factory reset may restore settings without sanitizing the storage, and it may not touch logs, archives or embedded memory. The manufacturer\’s decommissioning procedure and a verification step are needed to establish that data was removed.\”}} ] }