Strictly Confidential – Responsible On-site Data Destruction

Friday, April 10, 2009

Kevin Watson, Quality, Health & Safety Manager, East Lancashire Hospitals Trust, explains how a contract with data destruction company, Shred-it, has given the participating departments peace of mind that their confidential waste is being disposed of responsibly.

The secure handling of identifiable data is never far from the news. In fact, a recent report by the Information Commissioner’s Office details the number of data breaches in the NHS this year at 75. The importance of securing confidential data does not stop at electronic information, however, but continues until its destruction.

East Lancashire Hospitals Trust has always had a policy on removing confidential waste. The unique nature of many departments within the Trust meant that, in many cases, this policy was unworkable. Pathology, in particular, found the logistics of meeting the policy very difficult – laboratory staff were required to collect confidential waste, bag it in green, non-transparent bags, manually move the bags about half a mile across site, open the bags and feed individual pieces of waste through a letter box into a skip.

Pathology is a large department and it does not take long for us to accumulate a large amount of waste. Disposing of it was therefore a heavy, time-consuming job – what’s more, the skips were situated outside, so the long process of moving waste from bag to skip took place in all weather. This was unpleasant for staff and not secure, especially in windy conditions. Policy also dictated that disposal should be supervised by biomedical staff, which necessitated releasing two or three people from laboratory work to spend a couple of hours each week disposing of the bags. The result of this was that nobody wanted the job of getting rid of the waste, so the storage point in the corridor became overcrowded with bags, creating a fire hazard.

Staff were frustrated, and as quality manager I felt that we were failing in our duty to get rid of waste responsibly – under the Trust’s policy, we are liable for this waste until it has been destroyed. There was no corporate message on how to dispose of confidential paperwork, no audit trail to determine where the waste ended up and the processes differed between sites, which confused staff.

The last straw was when confidential waste was found blowing around the car park. Fortunately the information was found while still on site, but it was still a serious breach of confidentiality and trust. We decided to use this incident to bring about change.

First, we conducted an audit of the confidential waste disposal process. It became clear that this was a Trust-wide issue; one department was even leaving waste in transparent bags in public thoroughfares, which is clearly bad practice. Next, we tried to get our governance department to change the policy, with no success. It was obvious that we would have to manage the issue as a department.

I began researching to find companies that specialised in disposing of confidential waste. The top three or four companies that I found were at a similar level as far as pricing was concerned. What attracted me to Shred-it, however, was that the waste is destroyed – shredded – on site, in a secure environment (locked onto the truck), Trust representatives can watch the process, and a certificate of destruction is issued. The company also arranges a set schedule to destroy and remove the waste – they were the only company that we spoke to that would do this.

We also found that Shred-it staff are security cleared. Our laboratories are secure environments, so knowing that Shred-it undertakes work with government departments and other highly secure areas was reassuring.

We felt that the time we would save and the risks to information that we would negate would justify the cost of the service.

Shred-it replaced our bag system with four lockable consoles. These look like office furniture and have a letterbox slot in the top to receive confidential data. All staff have to do is feed any waste into the consoles – Shred-it then collects the consoles and shreds the contents.

Prices are based on the number of consoles supplied and how often they are emptied. The service is tailored to our needs and is very flexible. Our consoles, which measure about 2ft x 2ft x 3ft, are emptied once a week. Key personnel are able to open the consoles, but must have a very good reason to do so – unauthorised entry is not possible. We benefit greatly from the contract with Shred-it. All departments using the company now have a complete waste audit trail – we have piece of mind that all information has been destroyed before it leaves site. This includes CDs, paperclips, disks and cassettes – before, we were limited to putting paper through our disposal system, but the Shred-it system can shred any normal office waste before recycling it.

Importantly, the contract has freed up our laboratory staff to do what they are paid to do – work in the laboratory. The corridors are tidier, there is no longer a fire risk from bags of waste and the waste is securely stored prior to responsible disposal. No-one wants to go back to the old system of standing in the rain feeding waste through a letter box.

The staff at Shred-it are courteous, helpful and run a very flexible service. If we need to change the collection day, or add extra items to the collection, all it takes is a phone call. Our agent regularly contacts us to check that everything is running smoothly and I would emphatically recommend the service to other Trusts suffering from the same information disposal issues.

The contract, which started as a trial, is now being run across both Pathology sites. We have put together a good business plan for using the service and, with Shred-it, are now negotiating for this to be rolled out Trustwide having proven that the service fulfils a real need.

Shred-it provides a unique service. We have a responsibility to ensure that confidential waste remains confidential. Using a skip may be cheaper than outsourcing to a secure disposal firm, but I have to wonder if Trusts would still use a skip if they audited the process and found out where the confidential waste actually went


The contract, which started as a trial, is now being run across both Pathology sites.

All departments using the company now have a complete waste audit trail – we have piece of mind that all information has been destroyed before it leaves site. This includes CDs, paperclips, disks and cassettes.

Shred-it works in close consultation with clients such as East Lancashire Hospitals Trust to analyse their current processes. This period of consultation enables us to identify what elements of the current process work and those areas which may be improved. From this we are able to jointly develop a bespoke service which will maximize security while remaining cost efficient. Our mission is to provide our clients with peace of mind by delivering unparalleled security for the information our clients value.