Disposal and Surplus Handling of Computers

Policy for the Disposal and Surplus Handling of Computers and Electronic Storage Devices

To ensure compliance with federal and state statutes with confidential information, such as the Health Information Portability and Accountability Act of 1996 (HIPAA), the Gramm-Leach-Bliley Act (GLBA), and the Family Educational Rights and Privacy Act (FERPA), the University of Wisconsin – Green Bay requires the destruction of all data in computers or electronic storage devices prior to surplusing or disposal. These computers or electronic storage devices include, but are not limited to, hard drives, laptops, servers, mainframes, personal digital assistant (PDA) devices (i.e., Palm, Visor) or handheld computers ( i.e., Windows Mobile or CE based devices).

When any computer equipment or peripheral devices (i.e., printers, scanners, external drives, etc.) are no longer needed in a department, the equipment must be disposed of through standard State and University procedures for disposal of surplus equipment. This includes equipment that may have been purchased with grant, faculty startup, or professorship funds. Equipment purchased with federal grant funds may have specific federal guidelines that will need to be observed by the department. It is the responsibility of the department to ensure any federal guidelines are coordinated with University staff involved with the disposal of surplus equipment.

Computer hardware sent for surplus is generally sold to non-profit organizations and the general public. Any software or data files left on a hard drive, mainframe, server, and/or electronic storage device could potentially be retrieved. This oversight can lead to conflicts with software licensing agreements and/or result in unauthorized access to University documents.

Departments may dispose of computer media (floppy disk, tape media, zip media, CD media, DVD media) once it has been rendered unreadable. The preferred method is physical destruction and/or mutilation of the computer media that renders it unusable. This would include cutting of the floppy disk or tape media or physically breaking the CD or DVD media.

Specific procedures must be followed for the disposal of all computer equipment and storage devices to ensure secure removal of any information that may be on the device. These procedures are detailed below:

• For all computer workstations and peripheral devices that need to be disposed of, the department must complete a surplus property declaration form. This form is available on the Purchasing web site. Once the form is filled out, please contact Helen Alexander in the Information Services Division and request the equipment be picked up. Purchasing staff will not accept any computer related items for surplus unless the devices have been reviewed and processed by Information Services Division staff.

• Information Services Division staff will pick up the equipment and assess whether it will be retained for use as spares for other campus equipment or if the equipment is to be disposed of.

• For any equipment that is to be disposed of, Information Services Division staff will follow procedures to ensure any information on the equipment has been permanently removed. For all hard drives in computers, this is defined as using software that meets US Department of Defense Standard DoD 5220.22-M to overwrite the physical hard drive and remove any and all data on the hard drive. This will be done before any software image is installed on the system.

• Information Services Division staff will fully destroy and properly dispose of any electronic devices that cannot be cleaned sufficiently to guarantee that all data has been removed during the cleanup procedures outlined in item (3) above.

• Once the equipment has been properly prepared, it will be forwarded to the Purchasing department to be sold through standard surplus handling procedures.