How to Dispose of Old Hard Drives Securely in 2026

The Short Answer

Deleting files or reformatting a drive does not remove the data, it only erases the index that points to where the data sits. To dispose of an old hard drive securely in 2026, you need to overwrite or physically destroy the storage medium so the information cannot be rebuilt with recovery software, then keep proof that you did it. The right method depends on whether you're retiring a traditional hard disk drive (HDD), a solid-state drive (SSD), or the drive inside a server, copier, or laptop that once held client or patient records.

Why Deleting Files Isn't Disposal

A standard delete or format command removes the file table entry, not the underlying data. Free forensic and consumer recovery tools can pull readable files off a drive that was only reformatted, which is why old hard drives sold, donated, or scrapped without proper sanitization show up in data breach reports every year. For businesses, this isn't just a reputational risk. The Federal Trade Commission's Safeguards Rule requires financial institutions, including tax preparation firms, to dispose of customer information securely, and the Department of Health and Human Services' HIPAA Security Rule requires covered healthcare entities to sanitize or destroy electronic protected health information (ePHI) before equipment leaves their control. Neither rule specifies a single product, but both expect a documented, repeatable process.

If your firm is still building that process, start with the FTC Safeguards Rule checklist and review the fuller requirements in secure data destruction requirements for tax preparers, which covers how disposal fits into a WISP.

Do It Yourself or Hire a Destruction Vendor?

A handful of drives from a home office can often be wiped and destroyed in-house with a drill, a hammer, or a consumer drive shredder. A firm retiring a server, a fleet of workstations, or networked copiers after a lease ends is usually better off with a certified destruction vendor, both for consistency and for the paper trail. If you're unsure whether your internal IT support can handle this reliably alongside everything else, it's worth comparing what a managed provider covers in cybersecurity company vs. MSP before you decide where device disposal sits on your team's plate.

Documenting Disposal for Compliance

A certificate of destruction should list the date, the method used, who performed it, and the serial numbers of the drives destroyed. Keep it with your other compliance records rather than as a standalone file, since an examiner reviewing your WISP or security program will want to see disposal tied to your broader data protection practices, including how you handle encryption on active drives and how your team is trained to spot risk in the first place through security awareness training. Healthcare offices should apply the same documentation habit to any device retired after a ransomware incident or hardware refresh, since the Security Rule's disposal requirement applies regardless of why the device is being retired.

There's no fixed retention period set in federal rule for certificates of destruction, so confirm with your own counsel or compliance advisor how long your firm should keep them given any state law or client contract terms that apply to you.