Here is a brief piece from the Boston Herald that covers the high points of shredding.
"MetroWest Medical Center in Framingham also uses shredders at each nurse's station, and a HIPAA compliance team regularly "audits" the regular trash cans to ensure medical records have not been placed there, said spokesman Beth Donnelly. And when the hospital needs to purge computerized records, it locks the hard drives in a secure location and hires an outside company to "de-gouse," or strip, them with magnetic equipment. "
OT: Extra points for anyone who catches the fairly obscure reference in the title of this post. *And I am pretty sure that they mean "degauss"--- "de-gouse" sounds like a fairly unpleasant office procedure involving harsh chemicals and minor surgery.