Meta description: Learn how long HIPAA records must be kept, what the six-year rule actually covers, and how state laws and other requirements affect medical record retention.
There is no single federal HIPAA deadline for keeping every medical record. HIPAA generally requires covered entities and business associates to retain certain compliance documentation for six years, but that rule does not automatically apply to patients’ medical charts. Medical record retention periods often come from state law, Medicare or other program rules, and organizational policies. Knowing which requirement applies is essential before records are destroyed.
How Long Does HIPAA Require Records to Be Kept?
HIPAA requires covered entities and business associates to keep specified documentation for six years. Under the HIPAA Privacy Rule, the period runs from the date the documentation was created or the date it was last in effect, whichever is later. The Security Rule uses the same basic retention period for required documentation.
This is a retention rule for HIPAA-related documentation—not a universal six-year rule for every patient record. For example, a provider may need to retain privacy policies, security procedures, and records of certain decisions for six years, while the applicable period for a patient’s chart may be set by state law or another federal requirement.
The main federal provisions are the HIPAA Privacy Rule at 45 C.F.R. § 164.530(j) and the Security Rule at 45 C.F.R. § 164.316(b)(2)(i). These regulations should be read alongside applicable state and program-specific requirements.
Which HIPAA Records Are Covered by the Six-Year Rule?
The six-year period applies to documentation that the HIPAA rules specifically require an organization to create or maintain. The exact materials depend on the organization’s role and the rule involved. Examples commonly include written policies and procedures, notices, authorizations, certain complaint and disclosure documentation, and records of required actions or assessments.
Under the Security Rule, a covered entity or business associate must retain required security policies and procedures, along with required records of actions, activities, or assessments. Documentation should be available to people responsible for implementing the organization’s security practices. HIPAA also requires updates when needed, so the retention clock may be tied to when a document was last in effect.
Organizations should consult the specific regulatory provision for each document type rather than assume that every item connected to health information has the same retention period. A compliance record may also be subject to a longer period under another law, contract, or legal hold.
Does HIPAA Require Medical Records to Be Kept for Six Years?
Not by itself. HIPAA’s six-year documentation rule is often confused with medical chart retention. HIPAA establishes privacy and security protections for protected health information, but it generally does not set a minimum period for retaining the underlying medical record.
The U.S. Department of Health and Human Services explains that the HIPAA Privacy Rule does not include medical record retention periods. Instead, these periods are generally determined by state law or other applicable laws. As a result, a physician’s office, hospital, health plan, or other organization may face different deadlines depending on its location, services, and governing requirements.
Medical records can include more than a provider’s narrative chart. Depending on the setting, they may include test results, imaging reports, medication records, treatment plans, consent forms, billing records, and records of communications. Whether each item follows the same deadline depends on the relevant law and the organization’s recordkeeping rules.
What Determines the Medical Record Retention Period?
State laws and regulations
State requirements may specify how long certain providers must retain records, and the time period may vary by provider type, record type, and patient age. Some rules distinguish between hospitals and individual practitioners. Others set a separate period for records of minors or begin the retention clock when a patient reaches adulthood or receives a final treatment.
Because these rules differ, organizations should check the laws and regulations in every state where they provide services or maintain records. A general online chart may be useful as a starting point, but it should not replace review of current official state sources or advice from qualified counsel.
Federal and program-specific rules
Other federal requirements may apply to particular facilities, services, or payment programs. For example, Medicare hospital conditions of participation require hospitals to retain medical records for at least five years, subject to the specific regulatory provisions and any longer applicable requirements. That rule does not create a universal five-year deadline for every provider or every type of record.
Medicare, Medicaid, research, public health, and other program rules may impose additional documentation or retention duties for particular activities. The relevant rule may cover clinical records, claims support, research documentation, or another defined category. Organizations should identify which rules apply rather than treat all records as interchangeable.
Contracts, litigation, and organizational policies
Contracts with health plans, vendors, research sponsors, or business partners can establish recordkeeping obligations. A lawsuit, government investigation, audit, or reasonably anticipated legal claim may also require an organization to preserve relevant records beyond its ordinary schedule. Destruction should be paused when a legal hold applies.
Organizations often adopt retention schedules that set practical timeframes for records not covered by a specific minimum. A policy may choose to retain certain records longer to meet operational needs, support continuity of care, or manage legal risk. A policy cannot authorize destruction before a controlling legal requirement expires.
HIPAA Retention Rules at a Glance
| Record category | Typical federal HIPAA rule | What to check |
|---|---|---|
| HIPAA Privacy Rule documentation | Generally six years from creation or the date last in effect, whichever is later | 45 C.F.R. § 164.530(j), plus longer state or program rules |
| HIPAA Security Rule documentation | Generally six years from creation or the date last in effect, whichever is later | 45 C.F.R. § 164.316(b)(2)(i), plus other applicable requirements |
| Patient medical charts | HIPAA does not set a general retention period | State law, provider-specific rules, federal programs, contracts, and legal holds |
| Hospital medical records | Some federal program rules apply; Medicare hospital conditions include a five-year minimum | Current federal conditions, state law, and any longer requirement |
The table summarizes common distinctions, not a complete legal analysis. A record can fall under more than one category, and the longest applicable retention requirement generally controls.
How to Calculate the Six-Year HIPAA Period
For required HIPAA documentation, the regulations generally measure six years from the date the documentation was created or the date it was last in effect, whichever is later. If a policy is revised and replaces an earlier version, the organization should preserve the earlier version for the required period measured from the applicable date. Keeping only the latest version may leave gaps in the compliance record.
Organizations should document when policies and procedures take effect, when they are revised, and when they are retired. A clear version history can help demonstrate which requirements were in place at a particular time. Retention systems should also account for records stored electronically, including audit trails and relevant metadata when those are part of required documentation.
How State Rules Can Change the Answer
State medical record laws may require a longer period than the HIPAA documentation rule, or they may establish different periods for different types of providers and patients. In some states, rules for minors differ from rules for adults. The applicable deadline may depend on a patient’s age at the last visit, the date of the last treatment, or another event defined by state law.
Organizations operating across state lines should not assume that one retention schedule works everywhere. Telehealth services, records maintained by a centralized system, and records held by a provider licensed in multiple states can raise questions about which rules apply. Legal and compliance teams should assess the relevant jurisdictions and document the basis for the schedule they adopt.
When a state deadline is longer than the federal HIPAA documentation period, the longer applicable period should be followed for the records covered by that state rule. Conversely, a shorter state period does not eliminate a separate federal, contractual, or legal obligation to preserve the same records longer.
What Happens When Records Reach the End of Their Retention Period?
Reaching the end of a retention period does not mean records must automatically be destroyed. It means the organization may be able to dispose of them if no other requirement or legal hold applies. Before destruction, the organization should confirm that the record category, date, jurisdiction, and applicable retention rules have been reviewed.
HIPAA requires covered entities and business associates to use appropriate safeguards when disposing of protected health information. The Privacy Rule requires reasonable steps to limit access to and protect PHI during disposal. The method should make the information unreadable or indecipherable when appropriate to the medium and circumstances. Paper records may need secure shredding or destruction; electronic media may require secure wiping, destruction, or another approved process.
Organizations should also address records held by vendors. A business associate agreement should cover the business associate’s handling of protected health information, including what happens when the services end. If a business associate cannot return or destroy PHI when the relationship ends, the HIPAA rules require continued protections and limits on use and disclosure under the circumstances described in the regulations.
Building a Practical HIPAA Records Retention Schedule
A written retention schedule helps staff apply rules consistently and reduces the risk of premature deletion or indefinite storage. A sound process typically includes these steps:
- Inventory record types. Identify medical charts, HIPAA compliance documents, billing files, claims support, research records, and vendor-held information separately.
- Identify governing rules. Review HIPAA provisions, state requirements, federal program rules, contracts, and other laws that apply to each category.
- Set the controlling period. Apply the longest applicable retention period and record how the deadline is calculated, including any special rule for minors or inactive policies.
- Track holds and exceptions. Create a process to pause routine destruction during litigation, audits, investigations, or other preservation obligations.
- Securely dispose of eligible records. Use approved methods for paper and electronic information, and retain appropriate documentation of destruction.
Staff should know how to identify records that are subject to a hold and whom to contact before deleting or destroying them. Automated deletion systems should be configured to respect holds, extensions, and different deadlines for distinct record categories.
Common Mistakes to Avoid
- Applying the six-year HIPAA rule to every medical chart. HIPAA’s six-year documentation rule is not a blanket medical-record retention requirement.
- Relying on a single national deadline. State and program rules can vary, and the relevant period may depend on provider type or patient age.
- Keeping only the current policy. Superseded HIPAA documentation may still need to be retained for the required period.
- Destroying records during a legal hold. Routine retention schedules do not override an obligation to preserve relevant evidence.
- Assuming electronic records are exempt. Electronic documents and other stored information may be subject to the same retention duties as paper records.
Where to Verify Current Requirements
For HIPAA documentation, consult the current text of the Privacy and Security Rules in Title 45 of the Code of Federal Regulations. HHS’s HIPAA FAQ on medical record retention clarifies that HIPAA does not establish a general medical-record retention period.
For patient charts and other records, check current state statutes and regulations, applicable federal program requirements, and relevant contracts. When the rules overlap or the consequences of destruction are uncertain, a health care compliance professional or attorney can help determine the controlling period.