Destroyer.io

Destroyer.io
destroyer.io

If they can't be arsed to spell-check "HIPAA", I'm not entirely convinced that I should be trusting them to maintain HIPAA compliance if I decide to send them drives that potentially contain patient data.

That is, unless they're instead shouting about complying with sand crabs, though I'm still concerned in either case.

> The easiest way to destroy your hard drive.

You mean other than nuking it with DBAN or shred and then taking a hammer to it and/or burning it in a fire?

> Same methods, machines and processes used by banks and recommended by the NSA

Yeah, because banks and the NSA are obviously bastions of trustworthiness.

> Place the sealed box in any UPS dropbox or schedule a free pick-up.

This seems to be a rather significant point of potential failure. While I certainly like UPS better than the USPS (or - God forbid - FedEx), I'm not inclined to go with this approach rather than take drives to a local data destruction facility and/or destroy them myself.

If you're going to send me a box, it had damn well better be one with a good locking mechanism and some measure of tamper resistance and/or evidence. Even that's not surefire, but it's sure as hell better than "here's a cardboard box; trust us, it's secure enough".

The idea's cute and creative, but when it comes to things like EHRs and such that require absolute confidentiality and security to a degree that would make top-notch military agencies and veteran cryptonerds blush, neither "cute" nor "creative" are good selling points.

I've answered your same questions a couple of times today, here's what I've been saying:

Great question. Naturally, most of the inquiries or concerns around this service are going to revolve around trust and security.

The obvious and straight forward answer is that we're not. The more complicated one would be that I'd break a large amount of serious laws if we were doing something like that.

When testing the service out, some users asked for further assurance. The solution that seemed to be liked the most involved a video feed (or pictures), that showed how we opened the package, removed the drive and destroyed it. That's something that we'd build down the road if I get enough requests or feel that it would move the needle in the right direction.

For now, here's what we do: receive the drive, degauss (demagnetize) it, destroy it. The customer is notified when the package arrives and when the drive is destroyed, at which point we send a certificate of destruction.

Also, we'm in the process of getting our NAID AAA, eStewards, R2 and ISO 14001 certifications. The machines and processes that we use follow all of their guidelines, it's just a matter of getting approved (and paying the fees).

Let me know if you have any other ideas on how we could show/proof that we're trustworthy. Interested in listening to any suggestions.