HIPAA Data Retention Requirements: What to Keep, How Long, and How to Dispose of It

Short answer: HIPAA requires you to keep your compliance documentation, such as policies, procedures, risk analyses, business associate agreements and disclosure records, for six years from creation or the date it was last in effect, whichever is later. HIPAA does not set a retention period for medical records themselves. State law and other programs set that.

Related guides:

• How to create and manage HIPAA policies and procedures
• HIPAA compliant data storage requirements and best practices
• Data retention policy: template and audit evidence

Key takeaways

• The HIPAA six-year rule applies to required documentation, not to patient charts. It is set out in the Security Rule and the Privacy Rule.
• The clock starts at creation or the date the document was last in effect, whichever is later. A policy retired in 2026 is kept until 2032, even if it was written in 2015.
• Medical record retention comes from state law and from other programs, such as Medicare conditions of participation, not from HIPAA.
• HIPAA sets no audit log retention period. Pick one deliberately, document why, and apply it consistently.
• Retention ends in disposal. HIPAA requires disposal procedures and media re-use procedures, and business associates must return or destroy PHI at contract end where feasible.

What does HIPAA actually require you to retain?

HIPAA requires you to retain the documentation that proves your compliance program exists and operates, for six years.

Two rules say this almost word for word. The Security Rule's 45 CFR 164.316(b)(2)(i) requires covered entities and business associates to retain Security Rule documentation for 6 years from the date of its creation or the date when it last was in effect, whichever is later. That documentation covers your written security policies and procedures, plus a record of any action, activity or assessment the Security Rule requires you to document.

The Privacy Rule's 45 CFR 164.530(j)(2) sets the same six-year period for Privacy Rule documentation. Under 164.530(j)(1), that includes privacy policies and procedures, any communication the Privacy Rule requires to be in writing, records of required actions, activities or designations, and documentation sufficient to meet your burden of proof for breach notification.

The "last in effect" wording is the part teams miss. Retention runs from the day a document stopped applying, so every superseded policy version needs its own retirement and disposal date.

How long should you keep each type of HIPAA record?

Most HIPAA documentation follows the six-year rule, while clinical and operational data follows other rules or your own documented decision.

Record type	Retention basis	Period
Security policies and procedures, including superseded versions	164.316(b)(2)(i)	6 years from creation or last in effect
Privacy policies, procedures and required written communications	164.530(j)(2)	6 years from creation or last in effect
Risk analyses, risk management plans, activity reviews	Required Security Rule activities under 164.308, documented under 164.316	6 years
Business associate agreements	Documented assurances under 164.308(b)(3), retained under 164.316	6 years from the date last in effect
Accounting of disclosures records	164.528(d), retained under 164.530(j)	6 years
Medical records	State law and other applicable law	Varies
Audit logs and system data	No HIPAA period, your documented decision	Your choice

Disclosure records have a second reason to last six years. Under 164.528(a)(1), an individual can request an accounting of disclosures made in the six years before the request. Section 164.528(d) requires you to document the information each accounting must contain, the written accountings you provided and the titles of the people or offices that handle requests.

How long do you keep medical records under HIPAA?

HIPAA itself does not say. HHS states that the Privacy Rule does not include medical record retention requirements and that state laws generally govern how long medical records are kept.

What HIPAA does require is protection for as long as you hold the records. The same HHS answer points to 164.530(c): covered entities must apply appropriate administrative, technical and physical safeguards to PHI for as long as they maintain it, including at disposal.

Other federal programs can add a floor. For example, the Medicare hospital condition of participation at 42 CFR 482.24(b)(1) requires hospitals to retain medical records in their original or legally reproduced form for at least 5 years. Map the rules for each state where you or your customers operate.

A common myth is that HIPAA's 50-year protection for a deceased person's information means you must keep it for 50 years. HHS says no: records may be destroyed when state or other applicable law allows.

For a SaaS business associate, the retention period for clinical data is usually your customer's decision, expressed in the business associate agreement and your contract. Ask for it in writing rather than guessing.

How long should you keep audit logs and system data?

HIPAA does not set a retention period for audit logs, so you need to choose one and document the reasoning.

The Security Rule's audit controls standard in 164.312(b) requires mechanisms that record and examine activity in systems containing ePHI, and 164.308(a)(1)(ii)(D) requires regular review of information system activity. Neither names a period. A raw log stream is not the same thing as the documentation in 164.316, but your review records, such as tickets, sign-offs and investigation notes, are documented activities and fall under the six-year rule.

Practical factors that shape a log retention decision:

• Investigation window. Keep enough history to reconstruct who accessed which records if a breach is discovered late.
• Disclosure tracking. If logs are your evidence of disclosures, they need to support the six-year accounting lookback.
• Customer contracts. Customers may set log retention in security addenda.
• Other frameworks. SOC 2, ISO 27001 or HITRUST commitments may already define a period you can reuse.
• Minimization. Logs often contain PHI, so keeping them forever widens your breach surface.

In our experience, a tiered design works well: searchable hot storage for recent logs, then immutable, encrypted archive storage for the rest of the period, with deletion automated at the end.

What happens to PHI when a business associate contract ends?

The business associate must return or destroy the PHI, keep no copies, and protect anything it truly cannot return or destroy.

45 CFR 164.504(e)(2)(ii)(J) requires every business associate contract to say that, at termination and if feasible, the business associate returns or destroys all PHI it still maintains in any form and retains no copies. If that is not feasible, it must extend the contract's protections to the information and limit further uses and disclosures to the purposes that make return or destruction infeasible.

HHS has also said the HIPAA Rules generally do not require a business associate to keep ePHI after its services end, unless other law requires it.

Backups are usually the hard part. Plan offboarding before you sign:

1. Define an export format and timeline for returning data.
2. Map every copy: production databases, replicas, object storage, analytics stores, logs and backups.
3. Decide how backups age out, and document why immediate deletion from them is infeasible if it is.
4. Issue a written certificate of return or destruction to the customer.
5. Keep the certificate and the business associate agreement for six years after the agreement was last in effect.

Our HIPAA for HealthTech guide covers the wider business associate obligations.

How do you dispose of PHI securely?

Use a method that makes PHI unreadable and unrecoverable, and follow written disposal and media re-use procedures.

The Security Rule makes two disposal specifications required under 164.310(d)(2): policies and procedures for the final disposition of ePHI and the hardware or media it is stored on, and procedures to remove ePHI from media before re-use. Maintaining a record of hardware and media movements is an addressable specification in the same section.

HHS disposal guidance says the rules do not require a particular method and gives examples:

• Paper, film and labels: shredding, burning, pulping or pulverizing so PHI is essentially unreadable and cannot be reconstructed.
• Electronic media to be reused: clearing, meaning overwriting with non-sensitive data, or purging, such as degaussing.
• Electronic media leaving your control: destroying it, such as by disintegration, pulverization, melting, incinerating or shredding.

HHS also says PHI must never be abandoned or placed in dumpsters or other containers accessible to the public, and that workforce members who dispose of PHI need training on disposal. If you use a shredding or media destruction vendor, treat it as a business associate.

In cloud environments, teams typically combine deletion, encryption key destruction and the provider's documented media sanitization. Record which method applies to each data store.

How do you build a HIPAA retention schedule?

Inventory your records, attach a legal or business basis to each, set a trigger event and period, then automate and evidence disposal.

1. Inventory record types. List HIPAA documentation, clinical data, logs, backups and contracts, with the system where each lives. Our data retention policy guide covers the general policy structure.
2. Assign a basis. Cite the HIPAA section, state law, program rule, contract clause or business reason for each.
3. Define the trigger event. For HIPAA documentation, the trigger is the later of creation or last in effect. For clinical data, it may be the last encounter or contract end.
4. Set the period and owner. One accountable owner per record type.
5. Automate disposal. Use lifecycle rules, scheduled jobs and key destruction. Include legal hold handling so litigation or investigations pause deletion.
6. Evidence it. Log each disposal run and keep certificates of destruction.

Review the schedule when you enter a new state, sign a new type of customer or add a data store. The broader compliance data retention policy overview explains how retention fits into continuous compliance.

What retention evidence do auditors and customers ask for?

They want proof that retention rules are written, applied and evidenced. Expect requests for:

• The current retention policy and schedule, with version history and approvals.
• Superseded policy versions with their "last in effect" dates.
• Signed business associate agreements, including expired ones still inside the six-year window.
• Accounting of disclosures records and the procedure for answering requests.
• Log retention settings and the reasoning for the chosen period.
• Disposal logs, certificates of destruction and media sanitization records.
• Offboarding records showing PHI return or destruction for former customers.

In our experience, the most common gap is missing old versions: teams keep the current policy but overwrite its history.

How SecureSlate helps

SecureSlate gives HealthTech and SaaS teams one place for HIPAA documentation and the evidence behind it. Built-in HIPAA support, with multi-framework control mapping to SOC 2, ISO 27001 and HITRUST, lets you map retention and disposal controls once. State or customer-specific retention rules can be added as custom controls. Audit management keeps policy versions, risk analyses and disposal evidence together, vendor risk management tracks business associates such as disposal vendors, and agentless read-only cloud integrations help you check storage and logging configuration. Security questionnaire automation helps you answer customer retention questions consistently.

Start your free SecureSlate trial

FAQ

How long do you have to keep HIPAA records?

Required HIPAA documentation must be kept for six years from creation or the date it was last in effect, whichever is later. Medical record retention is set by state and other applicable law.

Does the six-year rule apply to patient medical records?

No. HHS states the Privacy Rule does not include medical record retention requirements. State laws generally govern medical record retention, and programs such as Medicare can add minimums.

Does HIPAA say how long to keep audit logs?

No. The Security Rule requires audit controls and regular activity review but sets no log retention period. Choose a period based on investigations, disclosure tracking, contracts and other frameworks, and document the reasoning.

Do business associates have to keep PHI after a contract ends?

Generally no. The business associate agreement must require return or destruction of PHI at termination where feasible, with continued protection for anything that cannot be returned or destroyed, unless other law requires retention.

Can we just delete old HIPAA policies when we update them?

No. A superseded policy must be kept for six years from the date it was last in effect, so keep version history rather than overwriting documents.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.