The most dangerous line in a medical record retention policy is often “HIPAA requires seven years.” HHS says HIPAA does not set the retention period for patient medical records. State law generally does. HIPAA’s well-known six-year period applies to specified compliance documentation, which is a different bucket.
That distinction belongs at the top of the policy, not in a footnote discovered during an audit. Use the template below to build a schedule with counsel and the people who run the systems.
Copyable retention policy skeleton
MEDICAL RECORD RETENTION AND DISPOSAL POLICY
Policy owner: ___________________________
Approved by: ____________________________
Effective date: _________________________
Next review: ____________________________
1. PURPOSE
Define how the practice classifies, retains, protects, retrieves, preserves,
and disposes of records across paper, primary systems, backups, exports,
vendors, and closed-practice arrangements.
2. SCOPE
People, locations, systems, vendors, and record classes covered: __________
3. AUTHORITY REGISTER
Federal source: _________________________
State professional/licensing source: ____
Facility or payer source: _______________
Contract or insurer source: _____________
Counsel review date: ____________________
4. RETENTION SCHEDULE
Record class | Trigger date | Minimum period | Controlling source | Owner
Adult medical record | ____ | ____ | ____ | ____
Minor medical record | ____ | ____ | ____ | ____
Imaging or diagnostic record | ____ | ____ | ____ | ____
Billing and claim support | ____ | ____ | ____ | ____
HIPAA-required documentation | ____ | ____ | ____ | ____
Patient request and disclosure records | ____ | ____ | ____ | ____
Contracts and business-associate records | ____ | ____ | ____ | ____
Other approved class | ____ | ____ | ____ | ____
5. HOLDS
Who can issue a hold: ___________________
How systems and vendors receive it: _____
How release is authorized: ______________
6. ACCESS AND CONTINUITY
How records remain retrievable: __________
How patients request access: _____________
Closed-practice or custodian plan: _______
7. DISPOSAL
Approval: _______________________________
Method by medium: _______________________
Vendor evidence: ________________________
Disposal log fields: ____________________
8. EXCEPTIONS, TRAINING, AND REVIEW
Exception approver: _____________________
Training cadence: _______________________
Annual test and review: _________________Do not fill the period column from a generic web table. The answer can depend on state, license, facility type, patient age, payer, record class, and whether a hold exists.
Split medical records from HIPAA documentation
The HHS Office for Civil Rights FAQ is direct: the Privacy Rule does not include medical-record retention requirements, and state laws generally govern the period. HIPAA still requires safeguards for protected health information for as long as the covered entity maintains it, including disposal.
The HHS Security Rule summary describes a separate six-year requirement for documentation that the Security Rule requires. The clock runs until six years after the later of creation or the date the document was last in effect.
Create at least two rows:
- Patient medical records, with the applicable state and specialty sources.
- HIPAA-required policies, procedures, assessments, and actions, with the federal documentation source.
More rows will follow. Combining the first two is how a confident but wrong “HIPAA period” enters contracts, backup settings, and staff training.
Use trigger dates, not just durations
“Keep seven years” is incomplete. Seven years from what? The last visit, discharge, record creation, the patient’s age, contract end, or the date a policy stopped being effective can produce different disposal dates.
Write the trigger beside the period. Test it against an adult patient, a minor, a deceased patient, a long-running episode of care, a corrected record, and a closed location. If the system cannot calculate the trigger safely, retain the record until the practice has a reviewed method.
Version the authority register. State rules and program requirements can change. Record the exact citation, programme, effective date, counsel review, and next review. A screenshot with no source date will be a poor guide five years later.
Inventory every copy
The EHR is only the first row. List paper files, scanned-document stores, imaging systems, billing platforms, patient portals, secure messaging, email, file shares, transcription systems, data warehouses, backups, cold archives, vendor support tools, and exports.
For each system, record:
- Which record classes it stores.
- Whether it is authoritative, a working copy, or a backup.
- The retention or expiry control.
- Who can place and release a hold.
- How deletion or destruction is proved.
Backups deserve blunt language. A backup is not an alternative permanent archive unless the practice can search, restore, protect, and produce it under the approved policy. At the same time, deleting the production chart while leaving indefinite vendor snapshots does not complete disposal.
Stop the clock for holds
A legal, audit, investigation, payer, patient-safety, or preservation hold can override the ordinary destruction date. Define who may issue a hold, how it identifies affected records, and how every custodian and vendor receives it.
Make release just as formal. A staff member should not resume deletion because a meeting ended or an email thread went quiet. Record the authorized release, date, scope, and systems notified.
Test holds with fake identifiers. Confirm that the EHR, paper archive, backup owner, billing vendor, and any other custodian block destruction for the same set. A hold that reaches only the main chart is a partial hold.
Preserve access during the retention period
A retained record must remain readable and retrievable. Plan for software changes, encryption keys, media aging, staff turnover, vendor exit, and practice closure.
The HHS right-of-access guidance describes individuals’ access rights under the Privacy Rule. The retention policy should point to the separate access-request procedure and make clear who produces records after a location closes or a system is retired.
Export samples before a migration. Open them without the old system. Check text, attachments, image references, author, dates, amendments, and audit information that the approved scope requires. A successful file count is not the same as a usable record.
Dispose by medium and keep evidence
HHS publishes guidance on disposal of PHI. The practice should approve methods for paper, local devices, removable media, hosted systems, and vendor-held copies. Staff should never improvise disposal at the end of a storage project.
Keep a disposal log that avoids unnecessary PHI. It can record the record class, date range, quantity or batch identifier, authority, hold check, method, vendor certificate where used, approver, and completion date.
Deletion needs exception handling. If a vendor cannot remove a backup immediately, document the technical limit, access restriction, expiry schedule, contract duty, and evidence that deletion later completed. Do not label the batch destroyed while an accessible copy remains unexplained.
Run one annual retrieval and disposal test
Choose synthetic records in several classes. Calculate their dates, place one on hold, retrieve one from archive, attempt an access request, and dispose of one eligible test copy through the approved path.
Record every handoff. The exercise should reveal who owns old media, whether vendor tickets close with evidence, and whether staff can distinguish medical records from HIPAA compliance documentation.
Patient Square is an AI clinical platform. Practice Copilot brings the whole practice under one AI copilot — an ambient AI Medical Scribe that hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft minutes after the visit, plus a bundled AI EHR, scheduling, and messaging as you move up the plan. Hospitals get Hospital Copilot.
Patient Square does not decide a practice’s retention schedule. If late documentation is making the record harder to close and govern, review the current Practice Copilot scope. Keep retention, holds, access, and disposal under the practice’s approved records programme.