Federal IT Security Professional (FITSP) Auditor Practice Exam

The recommended disposal method for paper-based medical records containing sensitive personally identifiable information (PII) is the use of cross-cut shredders. This method is particularly effective because it not only cuts the paper into smaller strips but also into confetti-like pieces, making it extremely difficult for anyone to reconstruct the original documents. This level of security is vital when dealing with sensitive information such as medical records, which can have serious implications if exposed.

NIST SP 800-88 emphasizes the need for effective sanitization methods to ensure that sensitive information is irretrievably destroyed and cannot be reconstructed or retrieved by unauthorized individuals. Cross-cut shredding satisfies these requirements by providing a high level of physical destruction, thereby ensuring the confidentiality of the sensitive PII contained within those records.

In contrast, other disposal methods such as classified recycling, purge, or controlled refuse areas do not provide the same level of assurance for the protection of sensitive information. Classified recycling may imply some level of secure handling, but it does not guarantee that the data will be rendered unrecoverable in the same manner as cross-cut shredding. Thus, cross-cut shredders are the most appropriate choice according to the guidelines in NIST SP 800-88 for safely disposing of paper-based medical records with sensitive