How you handle company mail, payroll, and tax records can put your business, employee, and customer data at risk. Protect confidential information by ensuring your document shredding methods follow federal and industry rules for secure document disposal.
There are several solutions for getting rid of your paper documents while cleaning out your files or switching to a digital storage system. Below, we’ll go over which records to keep, what to shred, and ways to dispose of everything from personnel files to invoice copies.
Know which records to keep and which to toss
Many small businesses have documents with proprietary data and personally identifiable information (PII), like tax or payroll records. Before you scan or shred, confirm which paper documents to keep so originals aren’t destroyed too soon. Your records retention policy should list requirements. When in doubt, check with your certified public accountant or attorney.
Methods for secure document disposal
Papers with confidential business data or PII can’t be tossed in the trash or recycled. According to the U.S. Federal Trade Commission disposal rule for consumer report data, businesses must take “reasonable measures to protect against unauthorized access to or use of the information” when disposing records. This rule implements the Fair and Accurate Credit Transactions Act (FACTA).
The secure document disposal method should align with risks and the amount to shred while following applicable industry, local, and FACTA disposal rules. Use stronger processes for more sensitive data, like financial or medical data, and bigger tools when you have a lot of paper, like boxes of old records, rather than a few pages.
Paper shredders
A paper shredder is one of the most common ways to dispose of sensitive documents and offers convenience and security. You can buy three different types: cross-cut, strip-cut, and high-security models for top-end paper destruction. Cross-cut shredders cut paper in two directions. The downside is that cross-cut shredders create more paper volume, and the machine may need more frequent maintenance, such as oiling.
In contrast, strip-cut shredding only cuts in one direction. These shredders may last longer but provide less security for sensitive documents than heavy-duty versions. Alternatively, devices on the evaluated products lists from the U.S. National Security Agency (NSA) and Central Security Service shred papers into tiny bits. But, they’re more expensive than other options.
If you want a shredder, here are some things to consider:
- The cost of shredders varies widely, from $30 to several thousand dollars.
- Some shredders will break if they encounter staples or paper clips.
- The shredding rate and size of documents the shredder can handle differ among models.
- Container capacities vary, and you’ll need to empty smaller ones more often.
Small job document disposal tools
The biggest problem you may face at your business is getting employees to dispose of paper documents properly. Out of convenience or habit, they may toss records or mail in the garbage or recycling bin.
Give staff tools to use for low-risk document shredding at their desk, such as:
- Multicut scissors: This tool works as a manual strip-cut shredder. You sacrifice some security due to the larger paper sizes, and it’s laborious if you have many documents.
- Trash can shredder: These portable solutions fit over a garbage can, allowing you to move them around the office.
- Identity-masking stamps: Handheld stamps are usually self-inking and may resemble a stamping tool or roller. They work by imprinting multiple black marks over confidential data.
Document shredding locations
Local companies may shred documents for their customers. Some services are free, whereas others charge per pound. Retail and community drop-off options mix your papers with those of other customers, known as comingled shredding. This can be a secure document disposal method when the service provider follows a documented chain of custody, which includes container ID numbers and hand-off logging.
When destroying confidential records, here’s what to consider:
- Document transfer and storage: Ask if papers are shredded on arrival. If not, see where they are stored, for how long, and if the area is secured and monitored.
- Chain of custody: Require controls that protect PII and protected health information (PHI). Consider companies with a National Association of Information Destruction (NAID) AAA certification for high-risk jobs.
- Certificate of destruction: Use vendors that provide certificates listing the date and time, disposal method, location, and weight or amount. Store records securely for an audit trail.
- Regulations: Agreements should confirm compliance with the FTC disposal rule and allow you to monitor compliance. The regulation explicitly allows this. If you dispose of medical records, verify that the vendor meets Health Insurance Portability and Accountability Act (HIPAA) standards.
According to the U.S. Federal Trade Commission disposal rule for consumer report data, businesses must take ‘reasonable measures to protect against unauthorized access to or use of the information’ when disposing records.
Professional paper shredding service
Service providers help businesses tackle big document disposal jobs. With mobile companies, a truck comes to your office, destroys records on-site, and hauls them away. Factory-based providers, which are cost-effective for large purge projects, pick up documents and shred them off-site. NAID AAA-certified companies are held to the highest standards.
Look for paper shredding service providers who offer:
- NAID-certified shredding services.
- Well-defined chain-of-custody controls.
- A signed service agreement.
- Vehicle tracking and sealed office containers.
- Certificates of destruction.
Should you hire a shredding service or shred in-house?
In-house shredders work well for everyday mail and low-volume disposal jobs that don’t justify a separate trip or pickup. Consider costs, risks, and volume for other documents, like those covered by the FACTA disposal rule.
Think about choosing a shredding service when:
- You’re cleaning archived files and must dispose of high volumes.
- Records include consumer reports, PHI, or card data.
- You need proof of destruction for audits.
- Your labor and equipment costs exceed the per-pound rate for shredding services.
Legal compliance: What records need to be kept and for how long?
Create a schedule based on business document-retention timelines and adjust it for state or industry rules. Go over your policies annually or when laws change. At a minimum, the IRS says to keep tax records for three years, but this goes up to six if you underreported your income, and it’s four years for employment records. Healthcare, financial, and transportation companies may have additional requirements.
Confirm record retention rules for the following:
- Tax and payroll records: Check IRS recordkeeping rules and limitations for special cases like bad debts or refund claims.
- Employment eligibility: Store Form I-9 for three years after hiring or one year after termination, whichever is longer.
- Workplace safety logs: Keep your annual summary and OSHA 300/301 logs for five years after the calendar year the forms cover.
How to secure digital records after shredding paper documents
After scanning and shredding, any remaining digital files become your official records. Lock these down so a stolen password or lost phone can’t harm your business or customers.
Use these tips to secure your digital records:
[Read more: 5 Steps to Take Immediately If Your Business Is Hacked]Alternative methods to dispose of paper documents
NSA and HIPAA-approved document destruction methods also include burning and pulping. These approaches are time-consuming and messy for small businesses. If burning documents, you need to ensure charred pieces don’t fly into the air and that the ashes are well broken up after you finish.
Pulping involves soaking paper documents in a bin with water for 24 hours. Then, mix the solution using a paint mixer with a drill to ensure all the pieces have completely broken down.
Manage documents from creation to disposal
The key to secure document disposal is developing a consistent life cycle policy that covers retention, access, backup, and destruction. Whether you’re moving documents to cloud storage or getting rid of mail, destroying paper records is better than putting them in the trash. Choose convenient methods that protect sensitive data and let staff dispose of records or mail quickly.
CO— aims to bring you inspiration from leading respected experts. However, before making any business decision, you should consult a professional who can advise you based on your individual situation.
CO—is committed to helping you start, run and grow your small business. Learn more about the benefits of small business membership in the U.S. Chamber of Commerce, here.
Brought to you by
The Walmart you love, now for your business
Give your business a boost by saving time, money & hassle
Published
