Q: We are selecting a vendor to look after our shredding. Do we need an information management agreement (IMA)?
A: Yes, you need an information manager agreement (IMA) with your shredding vendor.
Think about all the health information that you have authorized them to manage on your behalf. You certainly want to select a reputable vendor who will pick up the paper and securely transport it to their facility for secure shredding.
The Health Information Act (HIA) allows custodians to contract with other health service providers and vendors for the purposes of providing information management or information technology services, like shredding. This requires the custodian to give the vendor access to the papers with health information so that the vendor can securely destroy the paper.
The shredding vendor is known under the HIA as an information manager.
The custodian must ensure that the vendor has reasonable safeguards in place to protect the sensitive health information. The custodians must also ensure that there is a written agreement between the custodian and the information manager. These agreements are known as “Information Manager Agreements.” This requirement is stated in the HIA section 66(2).
There are many reputable vendors from which to choose
Some vendors will do the shredding right in your parking lot; others will transport it to their processing facility.
Remember to ask for a certificate of destruction at the completion of the shredding to document the secure destruction of the paper. Some vendors require a witness from the clinic to confirm that the shredding was done securely.
Some vendors can offer a recycling program for the paper after it has been securely shredded.
Ask your shredding vendor for an IMA. This is different than a service agreement where you agree to pay a fee for the shredding service.
For more information on what is an IMA, see the e-book, Top 3 Agreements Your Healthcare Practice MUST Have (and Why).
