Anyone know what HIPAA requires when donating machines?

The privacy and security rule in HIPPA are quite relevant in the scenario. The Privacy Rule pertains to all Protected Health Information (PHI) including paper and electronic, the Security Rule deals specifically with Electronic Protected Health Information (EPHI). There are safeguards to ensure with the existence of the PHI and EPHI.

@ http://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act#Security_Rule

In particular, you would want to note this

- Administrative Safeguards: Covered entities that out-source some of their business processes to a third party must ensure that their vendors also have a framework in place to comply with HIPAA requirements. Companies typically gain this assurance through clauses in the contracts stating that the vendor will meet the same data protection requirements that apply to the covered entity. Care must be taken to determine if the vendor further out-sources any data handling functions to other vendors and monitor whether appropriate contracts and controls are in place.

- Physical Safeguards: Controls must govern the introduction and removal of hardware and software from the network. (When equipment is retired it must be disposed of properly to ensure that PHI is not compromised.)

- Technical Safeguards: Each covered entity is responsible for ensuring that the data within its systems has not been changed or erased in an unauthorized manner.

Overall, there should be recording of the erasure procedure and executed by authorised personnel. Actually if data erasure does not occur when a disk is retired or lost, an organization or user faces that possibility that data will be stolen and compromised, leading to identity theft, loss of corporate reputation, threats to regulatory compliance and financial impacts. It may implicate to other federal laws beside HIPPA, such as Sarbanes-Oxley, Graham-Leach-Bliley or other state laws. That would be further emphasized based on user data type

Nonetheless, I will say that to go for the charity efforts, we will just have to ensure the HDD does not have the traces of the PHI and EPHI not found and there are assurances (trust but verify procedure logged) complied, then it may not be subjected to HIPPA. But the procedure for handling need to be audit as well (esp for future investigation if there are foul play) - best is to adhere to company data handling procedure and have HIPPA as the overarching rule where applicable.

The key is then to ensure there are proper data santisation and importantly, sensitive data traces are securely wiped and not recoverable forensically. These of course need to be authorised and not be abused. Also based on classification of the data, degaussing and physical destruction is necessary. Degaussing often renders hard disks inoperable, as it erases low-level formatting that is only done at the factory during manufacturing. In your case, you are probably going for secure wiping and erasure

Some standards to check out in below link

@ http://en.wikipedia.org/wiki/Data_remanence#Standards

NIST DoD 5220.22-M is quite well recognised and supported in the erasure tool such as BCWipe and Eraser (http://eraser.heidi.ie/). The U.S. DOD specification 5220.22 standard says a file must be overwritten three times. Also understand that DBAN is using Gutmann wipe instead. It would be best to use those recognised by the NIST for Enterprise purpose if you want to stay with conformity. I know I am a bit more on the paranoid side but better if the product has already claimed conformity to certain standard.

Also good to note that
a) the effectiveness of the overwrite procedure may be reduced by several factors: ineffectiveness of the overwrite procedures, equipment failure (e.g., misalignment of read/write heads), or inability to overwrite bad sectors or tracks or information in inter-record gaps.

b) Three techniques are commonly used for media sanitization: overwriting, degaussing, and destruction. Overwriting and degaussing are the methods recommended for disposition of sensitive automated information.

In term of software, you may want to check out this correspondence
@ http://www.experts-exchange.com/Storage/Misc/Q_26896045.html