A Practice Note addressing the standards for secure data disposal of protected health information (PHI) for covered entities and their business associates under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its related regulations, including the Privacy Rule, Security Rule, and Breach Notification Rule. This Note also discusses related Department of Health and Human Services (HHS) HIPAA enforcement actions and settlement agreements.