The short answer
No. HIPAA does not set a general medical-record retention period. HIPAA documentation requirements are different from clinical record retention. Determine the applicable state, professional, payer and other requirements for your practice, including special rules for minors and legal holds.
Separate record categories
HHS specifically explains that the Privacy Rule does not include medical-record retention requirements. Do not convert the familiar HIPAA six-year documentation rule into a universal schedule for clinical charts, images, billing evidence or consent records.
Create an approved retention matrix
This is an operational planning recommendation: classify records, identify controlling requirements, calculate the retention trigger and document who approved the schedule. Suspend routine destruction when a legal hold or other applicable duty requires preservation. Confirm secure destruction procedures separately.
Your practical checklist
- List clinical, image, consent, billing and privacy-policy record categories.
- Identify applicable state and other retention requirements.
- Document trigger dates, minors’ rules and legal-hold handling.
- Approve the schedule before deleting records or migrating systems.
A worked example
A practice changes EMRs and proposes deleting all charts older than six years. That is not a safe conclusion from HIPAA alone. Review the actual retention rules and holds, then reconcile the migrated archive before any approved disposal.
Illustrative workflow example; not a patient case or individualized recommendation.
Mistakes to avoid
- Using six years as a universal chart-deletion rule.
- Assuming a software subscription ending removes retention obligations.
- Deleting old photos without checking whether they are part of the record.