HIPAA Record Retention Requirements: The 6-Year Rule and State Medical Record Laws

For practice owners, practice managers and compliance leads. Updated October 22, 2026 · Prepared by Prospyr. HIPAA requires covered entities and business associates to keep their HIPAA compliance documentation, such as policies and procedures, risk analyses, training records and other required records of actions and assessments, for 6 years from the date it was created or the date it was last in effect, whichever is later (45 CFR 164.316(b)(2); 45 CFR 164.530(j)(2)). HIPAA does not set how long you keep patients' medical records: HHS says "the HIPAA Privacy Rule does not include medical record retention requirements," and state law sets that period, with Medicare and other programs adding their own. A practice's retention schedule therefore has to track at least two clocks: the 6-year HIPAA documentation rule and the medical record period for each state where it treats patients.

This guide explains the federal rules and how to build a retention schedule. It is not legal advice. Confirm your state's medical record period with your licensing board or a healthcare attorney.

HIPAA record retention requirements at a glance

How long must HIPAA documentation be kept?

Six years. The Security Rule says to "Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.316(b)(2)(i)). The Privacy Rule has the same 6-year period for its required documentation (45 CFR 164.530(j)(2)). A policy you adopted in 2020 and replaced in 2026 must be kept until 2032.

Documentation commonly covered by the 6-year rule:

• Privacy and security policies and procedures, including earlier versions.
• Security risk analyses and risk management plans.
• Workforce training records and sanctions applied to staff.
• Your notice of privacy practices, and patients' acknowledgments of receipt.
• Patient authorizations and requests to amend or restrict records.
• Business associate agreements (BAAs).
• Breach risk assessments, incident logs and breach notifications.
• Accountings of disclosures, where required.

The rule also requires you to make the documentation available to the people responsible for carrying out those procedures, and to review and update it periodically.

Does HIPAA say how long to keep medical records?

No. HHS states: "No, the HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained" (HHS FAQ). State periods differ by state, by type of provider and for minors, whose records are often kept until a set number of years after they reach the age of majority.

What HIPAA does require is that you protect the records with appropriate administrative, technical and physical safeguards "for whatever period such information is maintained by a covered entity, including through disposal" (same HHS FAQ, citing 45 CFR 164.530(c)).

Medicare and other federal retention rules

Federal programs add their own periods on top of state law. A CMS Medicare Learning Network podcast on record retention (September 2010, still posted by CMS) states:

• HIPAA rules require a Medicare fee-for-service provider to keep required documentation for 6 years from its creation or the date it was last in effect, whichever is later.
• Providers that submit cost reports must keep all patient records for at least 5 years after the cost report is closed.
• A Medicare managed care program provider must keep patient records for 10 years.

The 10-year figure matches the Medicare Advantage contract rules. An MA organization agrees to maintain its records for 10 years, and must require its contracted entities to give HHS the right to audit their records, including medical records, through 10 years from the end of the contract period (42 CFR 422.504(d) and (i)). Check your payer contracts too: commercial payers often set their own record retention and audit terms.

On format, the same CMS source says Medicare "does not require a specific media format": records can be kept in their original form or a legally reproduced form, including electronic, as long as the system protects their security and integrity.

How to build a record retention schedule

1. List every record type. Medical records, imaging, consent forms, photos, billing and payment records, HIPAA documentation, BAAs and audit records.
2. Assign the longest applicable period. For each record type, compare the HIPAA 6-year documentation rule, your state's medical record period (including rules for minors), Medicare or payer contracts and any litigation hold. Keep the record for the longest period that applies.
3. Name an owner. Your privacy officer or practice manager should own the schedule and review it each year.
4. Record the trigger date. Retention usually runs from a date, such as the last patient visit or the date a policy was replaced. Store that date with the record so you can tell when it expires.
5. Pause destruction for legal holds. Stop deleting anything related to an audit, investigation or lawsuit until counsel releases the hold.
6. Document destruction. Keep a log of what was destroyed, when, how and by whom.

If you treat patients in more than one state, apply each state's period to the records of patients treated there, or use the longest period across all your states for simplicity.

What counts as PHI in your records?

Protected health information (PHI) is individually identifiable health information held or transmitted by a covered entity or business associate, in any form (45 CFR 160.103). That includes information about a patient's health, the care they received and the payment for that care, when it can identify the patient. Intake forms, chart notes, before-and-after photos, appointment records and invoices for medical care are all PHI. A staff roster or a general office policy is not PHI, though HIPAA policies themselves still fall under the 6-year documentation rule.

Storing paper and electronic records

HIPAA applies to PHI in any form. For paper records, the Privacy Rule requires reasonable administrative, technical and physical safeguards (45 CFR 164.530(c)), such as locked cabinets or rooms, limited access and sign-out procedures. For electronic records, the Security Rule requires access controls, audit controls, integrity controls and transmission security (45 CFR 164.312), plus a contingency plan with a data backup plan and a disaster recovery plan (45 CFR 164.308(a)(7)).

When you move from paper to an electronic system, scan and verify each record before destroying the paper, keep the scanned copy for the full retention period, and confirm that the vendor storing your records signs a BAA.

How long should HIPAA audit logs be kept?

The Security Rule requires audit controls: "hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information" (45 CFR 164.312(b)). It does not set a retention period for the logs themselves. Many practices keep audit logs, and the records of their reviews, for 6 years in line with the HIPAA documentation rule. Write your chosen period into your security policy and apply it consistently. The same reasoning applies to backups and email archives that contain PHI: HIPAA sets no fixed period, so your policy should.

How to dispose of records securely

When a record reaches the end of its retention period and no hold applies, destroy it so the PHI cannot be read or reconstructed. HHS says covered entities "are not permitted to simply abandon PHI or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons," and that the rules "do not require a particular disposal method" (HHS disposal FAQ). Its examples of proper disposal:

• Paper: shredding, burning, pulping or pulverizing, so the PHI is "essentially unreadable, indecipherable, and otherwise cannot be reconstructed."
• Electronic media: clearing (overwriting with non-sensitive data), purging (degaussing) or destroying the media, such as by disintegration, pulverization, melting, incineration or shredding. HHS points to NIST SP 800-88, Guidelines for Media Sanitization.
• Disposal vendors: HHS describes using "a disposal vendor as a business associate" to pick up and destroy PHI, so put a BAA in place.

The Security Rule also requires policies for the final disposition of electronic PHI and the media it is stored on, and for removing electronic PHI before media is reused (45 CFR 164.310(d)(2)). Train everyone who handles disposal.

Where Prospyr fits

Prospyr keeps charting, digital intake and consent forms on one patient record, so the records you need to retain are in one system rather than spread across paper files and exports. Software does not set your retention periods; your schedule and your state's rules do. To review your safeguards, try the free HIPAA compliance checklist and HIPAA risk assessment. If you want outside help with HIPAA policies and risk analysis, see our list of HIPAA compliance consultants for clinics.

Frequently asked questions

How long must HIPAA compliance documentation be retained?

For 6 years from the date it was created or the date it was last in effect, whichever is later. That covers policies and procedures, risk analyses, training records, BAAs and other documentation HIPAA requires.

Does HIPAA require medical records to be kept for 6 years?

No. The 6-year rule applies to HIPAA documentation, not to the medical record itself. State law sets how long medical records must be kept, and many practices use the longer of the state period and any payer or Medicare requirement.

Does HIPAA require 7 years of data retention?

No. HIPAA's only retention period is 6 years, for compliance documentation. A 7-year (or longer) period may come from your state's medical record law, a payer contract or your own policy.

What is the longest retention period that might apply?

It depends on your state, your patients and your payers. Records of minors are often kept longer, and CMS states that Medicare managed care program providers must keep patient records for 10 years. Build your schedule around the longest period that applies to each record type.

Can we keep only electronic copies of paper records?

Generally yes, as long as the electronic copy is complete, accurate and protected for the full retention period, and your state allows it. Medicare does not require a specific media format. Verify the scan before destroying the paper.

What happens to records if a practice closes?

State law usually sets what a closing practice must do, such as transferring records to a custodian and telling patients how to request copies. HHS notes that many states require covered entities to retain and make records available for a time after a business closes, and suggests giving patients the chance to pick up their records first. HIPAA safeguards still apply for as long as the records exist.

Sources

• 45 CFR 164.316, Security Rule documentation requirements
• 45 CFR 164.530, Privacy Rule administrative requirements
• 45 CFR 164.312, Security Rule technical safeguards
• 45 CFR 164.310, Security Rule physical safeguards
• 45 CFR 164.308, Security Rule administrative safeguards
• 45 CFR 160.103, definitions including protected health information
• 42 CFR 422.504, Medicare Advantage contract provisions
• CMS Medicare Learning Network: Medical Record Retention and Media Format (PDF)
• HHS: does HIPAA require covered entities to keep medical records for any period?
• HHS: disposal of protected health information FAQ
• NIST SP 800-88, Guidelines for Media Sanitization

Editorial method and corrections