What does HIPAA say about destruction of medical records? Can a lab sheet with the patient's name be tossed in the garbage? Can we box up old medical records, securely tape the box, and throw the whole thing out?

HIPAA does not specifically address the issue. What it does say, of course, is that practices should create "reasonable safeguards" to protect medical information.

Reasonableness is in the eye of the beholder, but given the risks attendant if someone were to open that box of medical records, it certainly seems reasonable to invest in a shredder - or hire a company that specializes in destroying private documents to take them away.