New York University requires the destruction of all data in computers or electronic storage devices prior to the surplus or disposal of these items, to ensure compliance with federal and state statutes associated with disclosure of confidential information, such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Family Educational Rights and Privacy Act (FERPA), and to ensure compliance with software license agreements. All CRT's, computers, electronic storage devices and other electronic equipment collectively are referred to as 'computer equipment'.

Software and data files left on a hard drive, main frame, server, and/or electronic storage device could potentially be retrieved. This oversight can lead to conflicts with software license agreements and/or result in unauthorized access to University documents.

It is your department's responsibility to ensure that all computers and electronic storage devices including but not limited to hard drives, laptops, servers, have all personal and confidential University files removed.

Disposal of On-Campus Equipment

After the hard drive has been sanitized, please fill out a surplus form (www.nyu.edu/asset) and forward to the Asset Management Office. After Asset Management personnel have placed a disposal label on the equipment, contact your Building Manager for arrangements to remove the items from your department.

Disposal of Off-Campus Equipment

Equipment which a department has authorized to be used for certain NYU related work outside of NYU must be returned to NYU at the end of its useful life, or earlier upon demand made by NYU for data/software deletion and proper disposal. After the hard drive has been sanitized, please fill out a surplus form (www.nyu.edu/asset) and forward to the Asset Management Office. After Asset Management personnel have placed a disposal label on the equipment, contact your Building Manager for arrangements to remove the items from your department.

Surplus

After the hard drive has been sanitized, fill out a surplus form (www.nyu.edu/asset) and send it to the Asset Management Office. After Asset Management personnel have confirmed that the item(s) can be surplused, they will arrange to remove the items from your department.

Instructions to Sanitize Hard Drives

When you wish to dispose of a machine, you should first remove all the data (sensitive or otherwise) that is on it. This is important for two reasons. First, you do not want the next user of the system to have access to sensitive information (like research data, student information, financial data or patient information); and second, you do not want people to have unauthorized access to licensed software, such as Microsoft Word.

Warning: Just using the "delete" command or dragging items to the Trash does not remove the data from the disk. A plain "format" command is somewhat better, but a determined person could still access sensitive data. Some operating systems offer a "format and zero out all data" command, which is better, and is sufficient for machines which are being relocated within the University.

The easiest and most secure way to remove the data is to use a "wiping" tool that not only deletes the data, but overwrites each file with garbage data multiple times. You will need a disk or CD to boot the computer from before you run the tool, so that you can clean the whole drive. Be aware that the process will take some time (potentially hours if the drive is very large). Make sure that the tool you use has a feature to wipe the whole drive, not just empty space. There are many software programs that would work, so if you are unsure about whether a particular program is sufficient, check with NYU ITS' Network Security department at www.nyu.edu/its/security. If you do not wish to complete the sanitization process yourself, Purchasing Services has an agreement with a supplier who can provide this service (see Vendor Information below).

Vendor Information

NYU has an agreement with Computer Network Solutions who can perform the sanitization process. Upon completion of the sanitization process, CNS will attach a Certification Document to their Field Service Report, on CNS letterhead, that attests to the sanitizing of the disk. For further information, on the NYU/CNS program please refer to the Purchasing Services web site, www.nyu.edu/purchasing.services . Computer Network Solutions has created a custom website for NYU detailing all the aspects of the sanitization program.

To summarize, here are 3 easy steps you should follow to surplus or dispose of computers:

1. Sanitize the hard drives either using the Purchasing Services approved supplier or you may do this yourself.
2. Fill out an Asset Management Surplus Form
3. Fax or mail the Surplus Form to the Asset Management Office.
4. Asset Management will arrange for removal of surplus items. Contact your building manager for removal of items indicated as disposal through Environmental Services

Key Links

ITS »
Environmental Services »
Purchasing Services »