A covered entity is required to retain a broad range of documentation regarding its compliance with HIPAA, including:

• any policy or procedural documentation, including notices of privacy practices, consents (if any), authorizations and other standard forms;

• patient requests for access, amendment, or accountings of PHI disclosures;

• handling of patient and workforce members' complaints; and

• processes for and content of workforce training.

In general, the required retention period for documentation under HIPAA is six years from the date of creation, or the date last in effect, whichever is later.

If state laws require longer retention of these or any other records held by the covered entity, the state requirements control.

See also:

• 45 CFR 164.530(j)

  Last modified: 11-May-2005 [RC]