The Law

There are several laws that require businesses to destroy rather than simply discard information. These have been established in an effort to protect the privacy of patients and consumers. At the same time they serve to protect the businesses that serve them.

California:
Bill 2246 went into effect in January of 2001 with the following mandate:

"A business shall take all reasonable steps to destroy or arrange for the destruction of a customer's records within its custody or control containing personal information which is no longer to be retained by the business...".

Federal:
The Health Insurance Portability and Accountability Act (HIPAA) identifies protected health information and sets rules for the security and privacy of this information.

The Gramm-Leach-Bliley Act places significant restrictions on the use of customer
information by those in the financial industry (insurance, banks, securities, mortgage, escrow, etc). Such financial institutions must disclose their privacy policies to their customers.

The Fair and Accurate Credit Transaction Act (FACTA) requires that “any person who maintains or otherwise possesses consumer information for a business purpose” must properly destroy rather than discard consumer information.