Compliant ITAD for Healthcare: Protecting Patient Data and Enhancing Estate Efficiency
Healthcare providers across NHS Foundation Trusts, Integrated Care Boards (ICBs), and private clinical networks face complex structural challenges when modernising their technology estates.
Mitigating the risk of exposing electronic Protected Health Information (ePHI) requires more than standard equipment disposal; it demands verifiable compliance with the NHS Data Security and Protection Toolkit (DSPT) and UK GDPR. Surplex UK Limited delivers a secure, non-outsourced IT Asset Disposition framework engineered explicitly for risk-averse healthcare procurement officers and clinical informatics teams. We mitigate your regulatory exposure while optimizing the economic value of your retired medical and corporate hardware.
Maximising Procurement Efficiency and Compliance Control
The Value-Offset Model, and Why Most Collections Are Free
Healthcare budgets require maximum operational efficiency. Surplex UK Limited offsets the costs of collection, secure logistical transport, and certified data erasure by harvesting and refurbishing components for secondary markets. This model often returns capital rebates directly back to your trust’s IT procurement budget, funding next-generation clinical hardware refreshes without increasing your overhead.
Framework Integration and Onboarding Efficiency
We reduce administrative friction for public bodies and private health networks. Surplex UK Limited is fully registered with JOSCAR and FSQS, ensuring that our security, financial, and operational structures meet strict institutional standards. This structural suitability accelerates vendor onboarding, satisfies internal risk assessments, and provides a clear path for direct-award public tenders.
Compliance we can prove, not just promise
Every collection comes with a complete, audit-ready paper trail – certificates of data destruction, serial-level reporting, WEEE evidence notes and ESG data, all available in your portal. Our secure facilities include a BS EN 1143-1 rated strong room, and data is destroyed to NIST 800-88 standards. We’re ISO 14001 certified, ICO registered, an Environment Agency licensed waste carrier, and JOSCAR & FSQS registered.
De-risking the Healthcare Hardware Lifecycle
Disposing of healthcare technology requires total compliance with the National Data Guardian's 10 Data Security Standards and strict environmental laws. Surplex UK Limited operates a fully transparent custody chain that satisfies UK GDPR and clinical audit frameworks, ensuring data is permanently destroyed and hardware is recycled legally.
Bilateral Liability and NDAs
We execute comprehensive, legally binding non-disclosure agreements and formal processing contracts before any technical survey or physical collection begins, locking down client legal protections.
Self-Performed, Vetted Logistics
We do not use third-party couriers. Your assets are collected by long-tenured, un-badged Surplex personnel who are DBS-checked and police-vetted to BS 7858 standards, using our own fleet of GPS-tracked vehicles.
Biometric Facility Processing
Upon arrival at our Gloucester processing hub, all hardware is moved directly into a dedicated, restricted-access On-Site Strong Room protected by biometric access controls and 24/7 CCTV monitoring.
Certus NIST 800-88 Sanitisation
Data-bearing media is sanitized using ADISA-approved Certus software to NIST 800-88 standards. Any storage drive that fails software erasure is immediately destroyed via physical shredding to a secure particle size in accordance with BS EN 15713:2023.
Automated Audit and Certification
The Surplex Portal automatically generates and hosts serial-specific Certificates of Destruction and WEEE Waste Transfer Notes. These documents are stored securely for a minimum of 7 years to protect your trust during clinical compliance audits.
Managed Clinical and Corporate Technology Hardware
Frequently asked questions
Surplex UK Limited produces a full audit trail for every collection, available at any time in the Surplex Portal.
- WEEE waste transfer notes, the legal proof of compliant disposal
- A certificate of destruction against each device serial number
- Asset inventory reports carrying make, model, serial number and specification
- Scope 3 carbon and landfill-diversion figures for your ESG reporting
The Data Security and Protection Toolkit asks organisations to show that equipment holding personal data is disposed of securely, and to document it.
Surplex UK Limited provides a certificate of destruction against each device serial number, time-stamped chain-of-custody records and WEEE evidence notes, which is the documentary evidence a DSPT submission calls for. Destruction is carried out to BS EN 15713:2023 and NIST 800-88.
The NHS Net Zero Supplier Roadmap requires suppliers to account for the carbon embedded in what they provide to the NHS, and disposal forms part of that.
Surplex UK Limited reports Scope 3 carbon and landfill-diversion figures for every collection, and is a signatory of the SME Climate Hub under the United Nations Race to Zero. Recovering value from equipment that still has working life moves that figure furthest of all.
Yes. Surplex UK Limited collects across England, Wales and Scotland, including estates where equipment is spread across acute sites, community clinics and the homes of remote staff.
Every asset is recorded against its serial number at the point of collection, so the audit trail stays per device wherever it was picked up. There is no minimum quantity for a collection.
Most customers find their collection is free. Surplex UK Limited works on an open-book value-offset model with no minimum quantity, so a single ward clear-out is handled on the same terms as a trust-wide refresh. The value recovered from redundant hardware is set against the cost of collection, data destruction and recycling, and you are shown both figures. Where the recovered value does not cover the work, a small logistics and processing fee is payable, quoted and agreed upfront.
Request an Auditable Tech Survey for Your Healthcare Estate
Ensure your upcoming hardware refresh meets all DSPT and UK GDPR requirements. Contact our Gloucester operational centre today to arrange a technical survey, request a live demonstration of the Surplex Portal, or review our compliance documentation.
