In 2023, OCR settled with a dental practice for $350,000 after an investigation revealed the organization had no documentation of its risk analysis, policies, or workforce training — records that should have been preserved for years. The practice claimed it had once been compliant, but without documentation to prove it, OCR treated the gaps as violations. This is the quiet danger most healthcare organizations overlook: even if you do the work, failing to maintain a proper HIPAA retention policy can leave you exposed as if you never did it at all.

What a HIPAA Retention Policy Actually Requires

Here is where confusion starts. HIPAA does not impose a single, universal retention period for all records. Instead, the retention requirements are scattered across different rules and apply to different types of documentation.

Under the Privacy Rule (45 CFR § 164.530(j)), covered entities must retain all policies, procedures, and certain communications related to the Privacy Rule for six years from the date of creation or the date when the document was last in effect — whichever is later. This applies to your Notice of Privacy Practices, authorization forms, accounting of disclosures, and any amendments to policies.

The Security Rule (45 CFR § 164.316(b)(2)) mirrors this requirement for security-related documentation. Your risk analysis, risk management plans, security policies, and evidence of workforce training must all be retained for six years. OCR has made clear during audits and investigations that it expects to see these documents readily available.

The Six-Year Rule Does Not Apply to Medical Records

One of the most persistent myths I encounter in my work with covered entities is the belief that HIPAA dictates how long you must retain patient medical records. It does not. HIPAA governs how you handle protected health information (PHI) while you possess it, but the actual retention period for medical records is determined by state law.

State requirements vary dramatically. Some states require retention of adult medical records for seven years after the last encounter. Others mandate ten years. Pediatric records often carry longer retention periods, sometimes extending until the patient reaches a specific age plus additional years. Your HIPAA retention policy must account for these state-specific requirements alongside the federal six-year documentation rule.

Documents Your Organization Must Retain for Six Years

To build a compliant HIPAA retention policy, your organization needs to identify and preserve the following categories of documentation:

  • Privacy policies and procedures — every version, including superseded ones, with dates of creation and retirement
  • Notice of Privacy Practices — all versions distributed to patients, with acknowledgment receipts
  • Business associate agreements (BAAs) — active and terminated agreements with every business associate
  • Risk analysis documentation — full risk analysis reports, vulnerability assessments, and risk management action plans
  • Security policies and procedures — access controls, encryption standards, incident response plans, and contingency plans
  • Workforce training records — dates, attendees, training content, and completion records for every member of your workforce
  • Breach notification records — documentation of breach investigations, notifications sent, and corrective actions taken
  • Complaint logs and resolution records — any complaints received about privacy practices and how they were resolved
  • Sanctions applied to workforce members — records of disciplinary action for HIPAA violations

Missing even one category creates a gap that OCR can exploit during an investigation. Healthcare organizations consistently struggle with maintaining training records in particular, often because staff turnover makes historical tracking difficult.

How OCR Enforces Documentation Retention

OCR does not typically launch investigations solely because an organization failed to retain records. Instead, retention failures surface during investigations triggered by breach reports, patient complaints, or compliance audits. When OCR requests documentation and your organization cannot produce it, the regulatory presumption shifts against you.

In practical terms, OCR treats missing documentation as evidence of non-compliance. If you cannot produce a risk analysis from three years ago, OCR assumes you never conducted one. If you cannot show workforce training records, OCR presumes your workforce was never trained. This is not speculation — it is the pattern reflected across dozens of resolution agreements and civil money penalty cases in OCR's enforcement history.

Between 2019 and 2024, multiple enforcement actions cited the failure to maintain required documentation as a contributing factor. Penalties in these cases ranged from $100,000 to over $1 million, depending on the scope of the violations.

Building a HIPAA Retention Policy That Survives an Audit

Start by assigning a compliance officer or privacy officer with direct responsibility for document retention. This individual should maintain a centralized, indexed repository — whether electronic or physical — where all required documentation is stored with clear date stamps.

Establish a retention schedule that maps every document type to its required retention period. For HIPAA-specific documentation, the six-year minimum applies. For medical records, map each record type to your state's retention law. For records that fall under both HIPAA and state requirements, apply the longer period.

Automate reminders for document review and destruction. When the retention period expires, you should have a documented destruction process that ensures PHI is disposed of securely, consistent with the minimum necessary standard and 45 CFR § 164.530(c).

Most importantly, ensure your HIPAA training and certification program covers retention obligations for every workforce member who creates or manages compliance documentation. Staff who do not understand what must be kept — and for how long — are your greatest retention risk.

The Workforce Training Gap That Undermines Retention

Your HIPAA retention policy is only as strong as the people executing it. When front-desk staff discard patient authorization forms, when IT deletes outdated security policies without archiving them, or when managers fail to document sanctions — these are training failures, not just administrative oversights.

OCR expects that every member of your workforce receives training appropriate to their role. That includes understanding which documents must be preserved and how to route them for proper retention. Investing in comprehensive HIPAA workforce compliance is the single most effective step you can take to close these gaps before an investigation exposes them.

Destruction Is Part of Retention

A compliant HIPAA retention policy does not just address how long documents are kept — it addresses how they are destroyed when the retention period ends. Under the Privacy Rule, covered entities must implement reasonable safeguards to prevent impermissible disclosure during disposal. Shredding paper records, degaussing magnetic media, and using certified electronic destruction methods are all standard practices your policy should mandate.

Document your destruction activities. Record what was destroyed, when, by whom, and the method used. These destruction logs themselves become part of your retention documentation and should be preserved for six years.

Take Action Before OCR Comes Asking

The organizations that face the steepest penalties are not the ones that made a single mistake. They are the ones that cannot demonstrate a pattern of good-faith compliance. Your HIPAA retention policy is the backbone of that demonstration. Without it, every risk analysis, every training session, and every policy update you have ever conducted effectively disappears.

Review your current retention practices this quarter. Identify the gaps. Assign responsibility. And make certain your workforce understands that in HIPAA compliance, if it is not documented and retained, it did not happen.