When most New York businesses think about shredding, they picture boxes of paper documents. But the modern office generates sensitive data on a wide variety of physical media beyond paper — USB drives, CDs, DVDs, backup tapes, memory cards, and other portable storage devices that can hold just as much sensitive information as any filing cabinet. Shredding USB drives CDs backup tapes and other digital media is an essential component of any complete data security program. These small devices are easy to overlook, but their data doesn’t disappear when you format them, physically break them, or throw them in the trash.
The risks posed by improperly disposed digital media are well-documented. Investigators and researchers have purchased used USB drives, old backup tapes, and discarded CDs from surplus stores, eBay, and trash dumpsters only to find them loaded with sensitive corporate files, patient records, financial data, and employee information. For New York businesses subject to HIPAA, the SHIELD Act, GLBA, or PCI DSS, failing to properly destroy digital media is a compliance violation that can result in substantial fines and breach notification obligations. Proper media destruction — meaning physical shredding by a certified service — is the only way to eliminate this risk entirely.
Why Deleting or Formatting Is Not Enough
Many office employees believe that deleting files from a USB drive or reformatting a CD makes the data inaccessible. This is a dangerous misconception. When you delete a file or reformat a storage device, the operating system simply removes the index entry for that file — the actual data remains on the storage medium until it is overwritten by new data. On solid-state flash media (USB drives, SD cards, SSDs), even overwriting is unreliable because of how these devices manage storage allocation internally.
For optical media like CDs and DVDs, the situation is even more permanent. Once data is burned onto a disc, it creates physical changes in the recording layer that cannot be undone by any software process. Physically breaking a disc into pieces may seem sufficient, but data recovery tools can reconstruct data from fragments. True data destruction requires rendering the physical recording medium unreadable — which means shredding. Our certified media destruction services use industrial shredders specifically designed to destroy optical media, flash storage, and magnetic tape at the appropriate particle size to prevent any data recovery.
Types of Media That Require Physical Destruction
The following types of storage media should be physically destroyed rather than simply deleted, formatted, or recycled:
- USB flash drives: Contain flash memory that retains data even after formatting; impossible to reliably wipe
- CDs and DVDs: Burned data creates permanent physical changes — only shredding eliminates it
- Backup tapes (LTO, DLT, DAT): Magnetic tape that may hold terabytes of archived data accumulated over years
- SD cards and microSD cards: Flash memory media used in cameras, phones, and IoT devices
- Floppy disks: Legacy magnetic media still found in archives and older facilities
- Zip disks and Jaz cartridges: Older removable magnetic storage from the 1990s-2000s
- Magnetic tape cassettes: Used in older archival and backup systems
For any of these media types, the only certified and compliance-defensible destruction method is physical shredding by a certified media destruction provider. This is true regardless of whether the data has been “deleted” from the device.
Compliance Requirements for Media Destruction
Multiple regulatory frameworks specifically address the destruction of electronic media. HIPAA’s Security Rule (45 CFR § 164.310(d)(2)(i)) requires covered entities to implement policies and procedures for the final disposition of electronic protected health information and the hardware or electronic media on which it is stored. NIST 800-88 Guidelines for Media Sanitization is the technical standard referenced by most federal regulations for secure media destruction.
The New York SHIELD Act requires businesses to implement a data security program that includes a reasonable means of securely disposing of private information in any format. PCI DSS Requirement 9.8 mandates the destruction of cardholder data storage media when it is no longer needed for business or legal reasons. Across all of these frameworks, physical destruction by a certified provider with documented chain of custody is the approach that fully satisfies compliance requirements. A Certificate of Destruction documenting the type of media destroyed, quantity, date, and method provides the audit evidence you need.
How Professional Media Destruction Works
At New York Shredding Document Destruction, Inc., our media destruction process is designed to eliminate data completely while providing the documentation your compliance program requires. The process works as follows:
- Your organization collects end-of-life media in a secure container or box
- Our team collects the media and documents it on a chain of custody manifest
- Media is transported securely to our destruction facility
- Industrial shredders reduce the media to particles below the size required by applicable standards
- Shredded material is sorted for appropriate recycling or disposal
- A Certificate of Destruction is issued to your organization
This process works for all types of digital media — you do not need to sort USB drives from CDs from backup tapes. We accept mixed media loads and destroy everything together. Learn more about how our destruction process works and what to expect when you schedule a pickup.
Setting Up a Media Destruction Program for Your New York Business
The most effective approach is to treat digital media the same way you treat paper documents: establish a secure collection process, set a regular destruction schedule, and document every event. Place collection boxes or secure bins in areas where media accumulates — near workstations, in IT closets, and in file rooms. Train staff not to throw USB drives, CDs, or old backup tapes in the regular trash, and not to donate old drives to charity without first having them destroyed.
For organizations with regular media turnover — particularly IT departments, healthcare facilities, and financial services firms — a scheduled quarterly or annual media destruction service is the most practical and cost-effective approach. For organizations that only occasionally generate end-of-life media, a one-time purge service handles the need without requiring a long-term commitment. Contact New York Shredding today to discuss the right media destruction program for your organization’s size and compliance requirements.
Why New York Businesses Choose New York Shredding
For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.
Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.
Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.