Secure deletion means more than emptying the recycle bin for digital media; physical shredding for paper equivalents still matters in hybrid offices.
Backup systems inherit retention problems—know where archived copies live.
Document who approves destruction and how you verify completion.
Inspectors and partners ask for evidence, not intentions.
Most PHI incidents are human error, not Hollywood hackers.
Treatment, payment, and operations disclosures differ from marketing or research uses—forms should reflect that.
Every field you collect is another place PHI can leak—collect what you need, when you need it.