How to Handle Sensitive Information or Records Safely

Handling sensitive information and records safely comes down to a repeatable sequence: identify what you have, apply the safeguards the law requires for that data type, keep it for the mandated retention period, train everyone who touches it, and destroy it properly when its time is up. The specific rules depend on whether you hold health data, financial data, consumer credit data, or federal agency records, and penalties for getting it wrong range from a few hundred dollars per violation to ten years in prison.

Start by Identifying What You Actually Have

You can’t protect data you haven’t inventoried. Sensitive information generally falls into three buckets: personally identifiable information (Social Security numbers, dates of birth, biometric data), protected health information (medical histories, insurance claims, lab results, anything that ties a person to a health condition),¹ and financial records (credit card numbers, bank account details, non-public tax documents).

A practical inventory means walking through your digital file systems and physical filing cabinets, tagging record types, and assigning each a sensitivity level. It’s tedious, and most organizations delay it until a regulator or auditor forces the issue. That’s a mistake. You cannot comply with any of the laws below if you don’t know what data you hold or where it lives.

Know Which Federal Law Applies to Your Data

Several overlapping federal statutes govern sensitive records, and more than one may apply to you at the same time.

HIPAA for Health Data

The Health Insurance Portability and Accountability Act requires covered entities and their business associates to protect electronic protected health information through administrative, physical, and technical safeguards.² Covered entities are health plans, healthcare clearinghouses, and providers who transmit health information electronically. A business handling patient data on behalf of one of those entities is a business associate, and the same rules apply.

Civil penalties are adjusted annually for inflation. The 2026 tiers run from $145 per violation at the low end (the entity did not know and could not reasonably have known) up to $2,190,294 per violation for willful neglect that was not corrected, with a $2,190,294 annual cap per identical requirement violated.³ Criminal penalties are separate: up to $50,000 and one year for a basic violation, up to $100,000 and five years for violations under false pretenses, and up to $250,000 and ten years when someone misuses health information for commercial gain or malicious harm.⁴

Gramm-Leach-Bliley for Financial Institutions

If you’re a financial institution, the Gramm-Leach-Bliley Act requires you to protect the security and confidentiality of customers’ nonpublic personal information, provide clear privacy notices, and refrain from disclosing that information to unaffiliated third parties without proper notice.⁵ The FTC’s Safeguards Rule adds operational requirements: a written information security program covering administrative, technical, and physical safeguards.⁶

Fair Credit Reporting Act for Consumer Credit Data

The Fair Credit Reporting Act governs consumer reporting agencies and anyone who furnishes data to credit bureaus or pulls consumer credit reports. It requires reasonable procedures that balance commercial need with the consumer’s right to accuracy, privacy, and fair treatment, and it gives consumers the right to dispute inaccuracies.⁷

Privacy Act of 1974 for Federal Agencies

Federal agencies may maintain only information that is relevant and necessary to a statutory purpose, must collect it directly from the individual whenever possible, and must inform individuals of the authority behind the collection and the consequences of refusing.⁸ Agencies must publish a Federal Register notice for each system of records, and individuals can request their records and sue for willful violations.

A growing number of states have their own consumer privacy laws that apply on top of these federal statutes. If you do business across state lines, expect to comply with multiple state regimes as well.

Storing Records Securely

Digital files containing sensitive data should be encrypted at rest. AES-256 encryption is the standard adopted by the U.S. government for classified information, and it renders data unreadable without the key.⁹ Access should be restricted to employees whose current job functions require it, and permissions should be reviewed regularly. Stale permissions from role changes and departures are among the most common audit findings.

Network environments need firewalls and intrusion-detection systems, configured and then actually maintained. Security is maintenance, not installation.

Paper records and physical media belong in locked containers or access-controlled rooms. Sensitive files should sit in a space that only authorized personnel can enter, whether that means a biometric scanner, a badge reader, or a keyed lock with a sign-out log. Classified national security information carries stricter container requirements under federal regulation and is a separate regime from the everyday sensitive-records handling covered here.¹⁰

Sharing and Transmitting Records

Records are most vulnerable when they’re moving. Transport Layer Security encrypts the connection between sender and receiver and is the baseline for secure email. Secure File Transfer Protocol adds authenticated sessions before data moves between systems. Both should be your default for anything containing personally identifiable information, health data, or financial records. Sending an unencrypted spreadsheet of Social Security numbers as an email attachment is still common, and it’s a violation waiting to happen.

Multi-factor authentication should gate access to any system holding sensitive records. Passwords alone are not enough. They get reused, phished, and stolen from other breached databases.

For physical records, keep a documented chain of custody that tracks who had the file, when, and where it went. Encrypted courier services provide this for external transfers.

Business Associate Agreements for Health Data

A HIPAA-covered entity must execute a Business Associate Agreement before sharing protected health information with a vendor. The contract must spell out permitted uses, require appropriate safeguards, and obligate the vendor to report any unauthorized use or breach.¹¹ If the business associate subcontracts any function involving patient data, a separate agreement must be in place with the subcontractor. At the end of the relationship, the business associate must return or destroy all protected health information; if that’s not feasible, the contract must extend the protections indefinitely. That last provision trips up organizations during mergers and vendor transitions, because the data doesn’t disappear when a contract ends.

Training the People Who Touch the Data

HIPAA’s Security Rule requires every covered entity to train all workforce members on its security policies and procedures.¹² That means everyone, not just IT. The receptionist pulling up patient files, the billing clerk handling insurance claims, and the intern with temporary access all need to know what they can and cannot do.

Training should cover phishing recognition, records-request handling, what counts as unauthorized disclosure, and where to report suspected incidents. Repeat it on a regular schedule rather than treating it as a one-time onboarding checkbox. A sanction policy with defined consequences, from written warnings to termination, backs the training up.

Even if HIPAA doesn’t apply to you, training is the cheapest and most effective security measure available. Most breaches start with a human mistake: a clicked link, an unlocked laptop, a file sent to the wrong person. Technology cannot fix all of those. Consistent training can prevent most of them.

How Long You Must Keep Records

You cannot destroy records whenever you feel like it. Destroying them too early can expose you to penalties or leave you defenseless in an audit or lawsuit.

Tax records must be kept as long as they are needed to prove income or deductions on a return. Employment tax records must be kept for at least four years.¹³
Payroll records under the FLSA must be preserved for at least three years from the date of last entry. Supporting wage-computation records, such as time cards and piece-rate tables, must be kept for at least two years.¹⁴
Employee medical records under OSHA must be kept for the duration of employment plus 30 years. Employee exposure records must be kept for at least 30 years. The obligation survives even if the business closes.¹⁵

The OSHA period catches people off guard. Thirty years is a long time, and the duty doesn’t disappear because an employee left decades ago. If your organization handles any hazardous materials or has jobs with chemical exposure, that is where compliance costs quietly add up.

Destroying Records the Right Way

Once a record has outlived its retention period, keeping it around only creates liability. The goal is to make recovery impossible.

For paper, NIST SP 800-88 specifies cross-cut shredders producing particles no larger than 1 mm by 5 mm. Paper may also be pulverized with a disintegrator using a 3/32-inch security screen, or burned to white ash.¹⁶ Standard strip-cut shredders don’t meet this bar because their output can be reassembled with enough patience.

For digital media, cryptographic erasure destroys the encryption key protecting the data, and physical degaussing neutralizes the magnetic fields on a hard drive. Solid-state drives don’t respond to degaussing, so they require either cryptographic erasure or physical destruction such as shredding or disintegration. NIST 800-88 provides sanitization methods for each media type.¹⁶

After destruction, obtain a Certificate of Destruction. For electronic media, it should include the make, model, and serial number of the destroyed device, the serial number of the parent computer, the destruction method, and the identity of the person who performed the sanitization. That paper trail proves to auditors that the data was eliminated, not merely misplaced on an old drive in a storage closet.

What to Do When a Breach Happens

Speed matters more than perfection. The FTC recommends securing your systems to stop additional data loss, assembling a response team that includes forensic investigators and legal counsel, and preserving all evidence.¹⁷ Take affected equipment offline immediately, but don’t power anything down until forensic experts can examine it. If personal information was posted online, get it removed from your site and contact any other sites that may have cached it.

Notification obligations kick in quickly. HIPAA-covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured protected health information.¹⁸ Organizations that handle personal health records but aren’t covered by HIPAA fall under the FTC’s Health Breach Notification Rule, which requires notification after any unauthorized acquisition of identifiable health information. Properly encrypted data is exempt, because an unauthorized party can’t read it.¹⁹

Outside healthcare, there is no single federal deadline for breach notification. State laws fill the gap and vary considerably. Some states require notification within 30 days, others allow up to 60, and many say “without unreasonable delay.” Many also require reporting to the state attorney general or another agency. If you operate in multiple states, the strictest deadline controls your timeline in practice. Contact law enforcement early if the breach involves identity theft risks; the FTC recommends local police, the FBI, or the Secret Service depending on the incident.¹⁷

1
U.S. Department of Health and Human Services. The HIPAA Privacy Rule
2
U.S. Department of Health and Human Services. The Security Rule
3
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
4
GovInfo. 42 USC 1320d-6 Wrongful Disclosure of Individually Identifiable Health Information
5
Office of the Law Revision Counsel. 15 USC Chapter 94 – Privacy
6
Federal Trade Commission. Safeguards Rule
7
Office of the Law Revision Counsel. 15 USC 1681 – Congressional Findings and Statement of Purpose
8
Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals
9
National Institute of Standards and Technology. Federal Information Processing Standard 197 – Advanced Encryption Standard (AES)
10
GSA. Security Containers
11
eCFR. 45 CFR 164.504 – Uses and Disclosures: Organizational Requirements
12
U.S. Department of Health and Human Services. Summary of the HIPAA Security Rule
13
Internal Revenue Service. Recordkeeping
14
eCFR. 29 CFR Part 516 – Records to Be Kept by Employers
15
eCFR. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
16
National Institute of Standards and Technology. NIST SP 800-88 Revision 1 – Guidelines for Media Sanitization
17
Federal Trade Commission. Data Breach Response: A Guide for Business
18
eCFR. 45 CFR 164.404 – Notification to Individuals
19
Federal Trade Commission. Complying with FTC’s Health Breach Notification Rule