How Long Must HIPAA Documentation Be Retained?

The Privacy Rule generally requires covered entities to retain required compliance documentation for six years from creation or the date last in effect, whichever is later. The Security Rule sets the same period for its required documentation for covered entities and business associates. Neither sets a general medical record retention period.

Privacy Rule (45 CFR 164.530(j)). Subject to the 164.530(k) group health plan exception, a covered entity must maintain its policies and procedures, written communications required by the rule, and written records of required actions, activities, or designations. It must retain them for six years from the date of creation or the date when last in effect, whichever is later (164.530(j)(2)).

Security Rule (45 CFR 164.316(b)). Covered entities and business associates must keep Security Rule policies, procedures, and records of required actions, activities, or assessments for the same six-year period, make them available to those responsible for implementing them, and review and update them periodically.

Example. Covered entities must document that Privacy Rule training has been provided (164.530(b)(2)(ii)), and that documentation is subject to the six-year period. Not every HIPAA-related record has a single retention period, and not every covered entity Privacy Rule duty applies directly to business associates.

Medical records. HHS states that the Privacy Rule does not include medical record retention requirements; state laws generally govern how long medical records must be kept, though the Privacy Rule requires appropriate safeguards through disposal. Other applicable federal or state requirements can still govern medical record retention.

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."