How a health system cleared 52 racks and cabinets without moving readable media off-site
A regional health system retired 766 assets after moving its main clinical system to a hosted provider.
The scope covered a data center inside a working hospital and a separate disaster recovery cage.
ITAMG cleared 46 hospital racks over 22 overnight shifts and six recovery-cage cabinets over three day shifts. It destroyed 4,205 drives and 310 tapes at their originating sites before equipment moved.
The work returned 1,900 square feet on schedule and produced $253,642 in net cash to the client.
4,515 media items destroyed
4,205 drives and 310 tapes were destroyed on-site under witness and listed on one certificate.
22 controlled night shifts
Crews worked from 10 p.m. to 5 a.m. around clinical access and shared hospital routes.
52 racks and cabinets cleared
46 were inside the hospital; six were in the separate recovery cage.
$253,642 net cash to the client
$420,280 in client recovery less $166,638 in project cost.
Two retirement sites, one fixed hospital handoff
| Detail | Project record |
|---|---|
| Type of organization | A regional health system covered by HIPAA |
| Size | A multihospital system with a substantial outpatient network |
| Publication basis | The client is anonymized under contract, and exact project dates are omitted to reduce re-identification risk. This was one completed engagement. Recovery figures are historical, not current offers. |
| Sites retired | The main data center inside a working hospital and a separate disaster recovery cage |
| Retirement trigger | The main clinical system moved to a hosted provider, leaving the on-site servers and storage ready for retirement |
| Approvals | The VP of Technology signed off, the Privacy Officer approved the media controls, and Facilities accepted the room |
| Control basis | The HIPAA Security Rule, including 45 CFR 164.310(d), and the hospital's environment-of-care requirements |
Two acceptance conditions defined the assignment
No readable media could leave its originating site. The hospital room also had to be released to the conversion contractor on the date Facilities had set.
ITAMG had to retire 766 assets and an eleven-year tape archive within those controls while the hospital remained in operation.
The constraints that set the work plan
One freight route served clinical and support teams
The lower-level data center was one corridor from clinical space. Its freight path was shared with Materials Management and Food Service.
The service area and freight elevator were available only in approved windows. Every movement to the street followed the hospital's access and protection plan.
Access was limited to seven hours each night
Crews could work only from 10 p.m. to 5 a.m. An emergency-department surge, a code or a Facilities conflict could cancel a window after staging began.
The schedule had to absorb each lost window without changing the room handoff date.
Readable media stayed at its originating site
Policy required each drive and tape to remain on-site through witnessed destruction. ITAMG documented custody until that control was complete.
No intact media moved between the two sites or to ITAMG's processing facility.
The tape archive required a separate count
The eleven-year archive added 310 tapes. ITAMG reconciled the available catalog to the physical count before destruction.
The hospital room had a fixed release date
The conversion contractor was already booked before the decommissioning scope was written. A cancelled window reduced the remaining schedule; it did not move the handoff.
Access, custody and closeout were planned as one sequence
Build the baseline and approve the route
ITAMG walked the sites with IT, the Privacy Officer, Facilities and Environmental Services. The team recorded every asset and media identifier visible at the rack.
Identifiers blocked before de-racking were added as units came out. The route plan covered protected corridors, fire exits, elevator scheduling and floor protection.
ITAMG documented two options: physical destruction and verified sanitization using the NIST Purge method. After reviewing data classification, technical verifiability and risk tolerance, the Privacy Officer selected physical destruction.
Remove and destroy media under witness
ITAMG removed each drive and tape under documented custody, scanned its identifier and kept it at its originating site through physical destruction.
The Privacy Officer or a designee witnessed the work at both locations. ITAMG reconciled the destroyed-media record against the baseline before closeout.
Clear the hospital racks and recovery cage
At the hospital, ITAMG disconnected and removed the equipment, in-cabinet device cabling, rail kits, client-owned racks and power units.
The protected corridor was restored before day staff arrived. At the recovery cage, ITAMG emptied the provider-owned cabinets and left the cabinets and facility cabling in place.
Reconcile the records and release the room
ITAMG matched 766 assets and 4,515 destruction records to the opening baseline, then cross-referenced the certificate, destruction log and witness statement.
The settlement report recorded the client recovery credited for each accepted asset.
The health system approved site access, the work plan and night windows. It also coordinated Facilities and Environmental Services.
The Privacy Officer or a designee witnessed on-site destruction. ITAMG staffed the night work, managed execution and assembled the closeout records.
What the completed work achieved
$253,642 in net cash after project cost
$420,280 in client recovery less $166,638 in project cost produced $253,642 in net cash. The project also avoided $18,400 in colocation charges and returned 1,900 square feet; neither is included in net cash.
Client recovery is the amount ITAMG paid or credited to the health system for accepted assets based on secondary-market values at the time of the engagement. It is not ITAMG's downstream sale price.
Project cost is the sum of the listed service charges. Net cash is client recovery less project cost.
Client recovery by category
Settlement rates reflected model, configuration, condition and secondary-market demand at the time of the engagement. The table shows accepted quantities and recovery credited to the client.
Drive value is excluded because every drive was destroyed on-site. The modeled purge alternative appears after the project-cost table.
| Asset category | Accepted quantity and settlement basis | Client recovery |
|---|---|---|
| Servers, sold as complete systems | Blade and rack servers from Cisco, HPE and Dell, spanning half-width blade, 1U and 2U formats. 312 accepted units; $820 client recovery per unit | $255,840 |
| Network equipment | Data center and campus switches, wireless controllers and firewalls. 123 accepted units; $520 client recovery per unit | $63,960 |
| Storage equipment | SAN controllers and expansion shelves, sold empty after the drives were destroyed on-site. 153 accepted units; $380 client recovery per unit | $58,140 |
| Parts recovered from systems not sold whole | Memory, processors, power supplies and mezzanine cards recovered from blade and rack chassis. 86 chassis; $380 client recovery per chassis | $32,680 |
| Power, tape hardware and appliances | Rack power units, tape-library hardware and KVM consoles from both sites. 92 accepted units; $105 client recovery per unit | $9,660 |
| Total client recovery | 766 accepted assets across the five recovery categories | $420,280 |
Project costs
The fixed quote covered labor, asset processing, transport, destruction and recycling across both sites. The bundled labor charge includes night work inside the hospital.
| Cost item | Scope | Amount |
|---|---|---|
| Labor and removal at night | Bundled project charge for night work inside the hospital, including remobilization after cancelled access windows | $92,400 |
| Transport | Insured transport on 11 secure runs, scheduled around the hospital's approved access windows | $19,800 |
| Project management and site protection | Protected-corridor setup, infection-control materials, coordination and reporting | $12,510 |
| Recycling | Fixed project charge for destroyed media and residual chassis or components left after parts recovery, handled through ITAMG's R2v3-certified operations | $11,500 |
| Asset processing and testing | 766 assets received, audited, tested and reported line by line, at $15 per asset | $11,490 |
| On-site destruction at both locations | Bundled project charge for destroying 4,205 drives and 310 tapes on-site, including identifier capture, witnessing, reconciliation and certification | $11,288 |
| Labor at the recovery cage | Three days at standard day rates, totaling 9 crew-days | $7,650 |
| Total project cost | Fixed project-cost quote covering both sites | $166,638 |
HIPAA requires a final-disposition process; it does not prescribe shredding. For this engagement, the health system selected Destroy under its policy.
The comparison for the unselected Purge option used a sanitization and verification cost of $4.51 per drive for 4,205 drives, while retaining destruction for 310 tapes.
The modeled option cost about $19,700, or $8,400 more than destruction, and added about $246,000 in client recovery and $237,600 in net value.
The certificate, destruction log and witness statement document the approved method and the completed work.
The closeout record from baseline to final disposition
| Document | What the record contains |
|---|---|
| Certificate of destruction (1) | Method, dates and locations, with 4,205 drive serial numbers and 310 tape barcodes or other identifiers on one certificate |
| Destruction log | Identifier, media type and destruction result for each drive and tape, reconciled to the certificate |
| Witness statement (1) | ITAMG and client-witness attestations that all listed media was physically destroyed on-site |
| Chain-of-custody records (11) | The responsible party at each documented handoff for every secure run; equipment moved only after its data-bearing media was removed and destroyed on-site |
| Media disposition report | Method, date, site, media identifiers and supporting destruction and witness records |
| Settlement, recycling and downstream reports | Client recovery for each accepted asset and downstream recycling records from ITAMG's R2v3-certified operations |
| Final reconciliation | 766 assets and 4,515 destruction records matched to the opening baseline |
Controls and documentation for retired IT assets
ITAMG scopes custody, media disposition, asset recovery and recycling as one documented workflow.
This engagement used data center decommissioning, data destruction, server recycling and data center recycling.
Data Destruction
On-site and off-site media destruction aligned to NIST SP 800-88 Rev. 2, with identifier-level records.
Learn moreIT Asset Disposition
Enterprise-hardware retirement with documented custody at each handoff.
Learn moreSell Used IT Equipment
Client recovery for accepted servers, storage and networking hardware.
Learn moreComputer Recycling
Residual-material recycling through ITAMG's R2v3-certified operations, with downstream records.
Learn moreIndependent company ratings for ITAMG
Plan a decommission
Working inside a facility that cannot pause?
ITAMG provides service coverage across all 50 states. Each proposal defines the access plan, schedule, removal scope, approved media method, closeout records and fixed project quote.