In order to protect the University and individuals, many records at Tufts that can be discarded should be confidentially destroyed. In particular records that are designated as Level A: Confidential Institutional Data in the Information Classification and Handling Policy should be destroyed confidentially. These types of records include, but are not limited to, personnel files, student records, protected health information, and any documents with nonpublic personal information.
Throwing these types of documents in the regular trash or recycling or not taking care to wipe this type of data from electronic devices (computer workstations, laptops, CDs, thumbdrives, etc) needlessly risks reputational and financial loss and legal sanctions for Tufts and the violation of peoples’ privacy.
There are two options for confidentially destroying paper records at Tufts. In general, it is safer to confidentially destroy paper documents as a general habit rather than as an exceptional activity.
Tufts has a university-wide contract with Shred-it for information destruction services. Shred-it provides departments with empty bins (two sizes available). Departments fill the bin with documents that need to be confidentially destroyed. Shred-it takes the filled bins to its secure destruction facility and provides new empty bins. Departments are billed individually, but pay an institution-wide rate.
Departments should ensure that their bins are in secure locations with controlled access.
To open a Shred-it account for your department, contact the company’s account representative for Tufts:
Greg Johnson, Sales Executive
Shred-it – North Boston
Office: (603) 595-2033
Shred-it will work with you to determine how many bins your department needs, the locations of the bins, and a pick-up schedule.
The University thoroughly investigated confidential records destruction options and has determined that its contract with Shred-it provides the best value and information protection for departments at Tufts. Departments should not try to find alternative vendor solutions for confidential records destruction.
Using paper shredders to confidentially destroy documents may be a reasonable option for departments and offices that generate a small volume of paper records. Departments and offices should use a cross shredder that cuts paper into tiny squares rather than strip shredders that cut paper into strips. You can recycle the shredded paper.
Computer Workstations and Laptops
When computer workstations or laptops meet the end of their initial lifespan (usually three years), departments should contact their IT support group to have all data on the machine securely wiped. Even if a department intends to repurpose a workstation or laptop or donate it to a charity or organization, it should still have its IT support group wipe the machine.
Computers store data in a complex manner that is not readily apparent to end-users. It is much safer (and easier) to have your machine wiped than to assume that you can manually find and delete all the files on your computer with confidential or sensitive data.
CDs and Flash Drives
When you need to dispose of CDs, flash drives, or other media, contact your IT support group about destroying these devices.
One should not give flash drives or other memory devices to family or friends for reuse. Memory devices store data in a complex manner that is not readily apparent to end-users. Deleting files may not fully destroy files on these memory devices.
Departmental, Personal, and Research Network Drives
Deleting files on your departmental, personal, or research network drives as one normally would is sufficient for destroying records confidentially.
For general questions about information destruction or what records to destroy, please contact the DCA (firstname.lastname@example.org, 7-3737).
For specific questions about how to destroy data stored in specific digital environments, contact your IT support group.