A Guide to PHI Retention Policies for Human Trafficking Survivor Clinics

How long must clinics retain medical records?

HIPAA does not set a general retention period for medical records. The HHS Office for Civil Rights’ HIPAA retention guidance explains that state law generally determines how long providers must keep them. The applicable period can depend on the clinic’s location, the type of record, and the patient’s age.

Do not confuse the medical-record retention period with HIPAA’s six-year rule for certain required documentation. Covered entities must retain specified HIPAA policies, authorizations, and other required documentation for six years from creation or from when it was last in effect, whichever is later. That rule does not mean every clinical record must be kept for six years; see 45 CFR § 164.530(j) and 45 CFR § 164.316(b)(2).

Before setting a schedule, identify the record categories the clinic maintains, including clinical charts, billing records, psychotherapy notes, consent forms, and records involving minors. Check the relevant state medical record retention statutes and any applicable rules for specific provider types or programs. If a legal hold or investigation applies, consult counsel before destroying records, even if the routine retention period has expired.

Which state and federal rules govern retention?

Start by confirming whether the clinic is a HIPAA covered entity or business associate. A health care provider generally falls under HIPAA when it conducts certain transactions electronically, but a clinic’s particular structure and activities matter. If HIPAA applies, its Privacy Rule and Security Rule govern how the clinic protects PHI while it maintains it, not a general clinical-record retention duration.

State medical record retention statutes and related regulations commonly set the baseline retention periods. Verify the rules for the clinic’s state and record types, including any special provisions for minors, behavioral health, or closing a practice. Because no state is specified here, this guide cannot provide a single state-specific retention schedule.

Other federal requirements may apply to particular records or programs. For example, federally assisted programs that provide substance use disorder diagnosis, treatment, or referral may be subject to additional confidentiality requirements under 42 CFR Part 2, as described by SAMHSA’s Part 2 guidance. Review applicable grant terms, program rules, and contracts rather than assuming one rule covers every record.

What safeguards protect PHI during storage and disposal?

Covered entity safeguards apply for as long as PHI is maintained, including during storage and disposal. HIPAA requires appropriate administrative, technical, and physical safeguards, and its Security Rule requires policies for the final disposition of electronic PHI and the media that stores it. See 45 CFR § 164.530(c) and 45 CFR § 164.310(d).

Use controls suited to the clinic’s risks and systems. Examples include locking paper files, limiting access to storage areas, protecting electronic systems with individual accounts, reviewing access logs, maintaining secure backups, and ensuring vendors that handle PHI are appropriately contracted and supervised. HIPAA’s encryption specification is addressable, so assess whether encryption is reasonable and appropriate in the clinic’s environment and document the decision.

Secure PHI disposal should make records unreadable or unrecoverable before they enter an ordinary waste stream. HHS describes methods such as shredding paper and clearing, purging, or destroying electronic media; it does not prescribe one universal disposal method. Follow the clinic’s documented process and confirm that a disposal vendor safeguards PHI through destruction, as explained in HHS guidance on disposing of PHI.

How can documentation support survivor-centered care?

Clinical documentation should support safe, coordinated care while respecting the survivor’s choices and privacy. Record information that is relevant to treatment and continuity of care, and avoid collecting or repeating sensitive identifying details that are not needed for those purposes. These are survivor-centered practices, not a separate HIPAA retention rule.

Ask each patient how and when it is safe to communicate, then document the preferences in the appropriate, access-controlled part of the record. For example, note whether voicemail, text, email, mail, or messages through a portal are safe, and whether staff may identify the clinic in a message. Revisit those preferences when circumstances change.

Keep clinical notes accurate, relevant, and respectful. When recording a patient’s account, distinguish the patient’s statements from clinical observations and avoid unnecessary speculation. Make sure staff understand where sensitive information may appear in the record, such as appointment reminders, visit summaries, billing communications, or portal notifications.

How should clinics control access and manage portal proxies?

Use role-based access control to give workforce members access appropriate to their duties, and update access when roles change or employment ends. HIPAA requires policies for workforce security and information access management, as well as technical access controls and unique user identification for electronic PHI; see 45 CFR § 164.308 and 45 CFR § 164.312.

Portal proxy access is a way to let another person view or manage information through a patient portal; it does not by itself establish that the person is legally authorized to act as the patient’s personal representative. Verify the patient’s instructions and any legal authority that applies, grant only the access the clinic and portal can appropriately support, and provide each person with their own credentials rather than shared passwords.

For survivors, consider whether a proxy could expose sensitive information or create a safety risk. Confirm whom the patient wants involved and whether that choice is safe before setting up access. For minors, state law and the type of care can affect parental access. HIPAA also allows a provider, in specified circumstances, to decline to treat someone as a personal representative when the provider reasonably believes that doing so could endanger the individual; see HHS guidance on personal representatives.

When is written consent required to release PHI?

HIPAA generally allows covered entities to use or disclose PHI for treatment, payment, and health care operations without a written authorization, subject to the Privacy Rule’s requirements. Other disclosures may be permitted or required by law without authorization. For example, the law provides specific conditions for disclosures involving public health, legal requirements, and certain abuse or neglect reports; the rules do not create a blanket permission to disclose a survivor’s information to law enforcement simply because the patient is a trafficking survivor.

For disclosures that are not otherwise permitted or required, obtain a valid written authorization for PHI disclosure. HIPAA also specifically requires authorization for most uses or disclosures of psychotherapy notes, marketing, and the sale of PHI. See 45 CFR § 164.508 and 45 CFR § 164.512.

A valid authorization should clearly identify the information, who may disclose it, who may receive it, the purpose, and an expiration date or event. It must explain the individual’s right to revoke the authorization in writing and the potential for the recipient to redisclose the information. Give the patient a copy and document the authorization. A patient can generally revoke it in writing, although revocation does not undo actions already taken in reliance on the authorization; see HHS guidance on revoking an authorization.

What should a written retention policy cover?

A written policy should turn applicable legal requirements into a clear schedule and an operational process. Identify who owns each step, how the clinic handles exceptions, and how staff can confirm that PHI remains protected throughout its lifecycle.

• Scope and responsibilities: Define the records and systems covered, name the responsible roles, and explain how workforce members and vendors follow the policy.
• Retention schedule: List record categories, the applicable retention period, the legal or program basis for that period, and any different rules for minors or specialized records.
• Storage and access: Describe where records are maintained, who may access them, how access is reviewed, and how the clinic preserves records that must remain available.
• Legal holds and exceptions: Explain how staff pause routine destruction when a legal hold, audit, investigation, or other applicable requirement calls for preservation.
• Disposal and documentation: Specify approved secure PHI disposal procedures for paper and electronic records, how destruction is verified, and what documentation the clinic keeps.
• Patient preferences: Set out how staff record and review safe communication preferences and handle portal proxy requests without treating portal access as proof of legal authority.
• Review and training: Assign responsibility for reviewing the schedule when laws or operations change and training staff on their relevant duties.

In short, a sound policy applies the correct state and program-specific retention period, keeps required HIPAA documentation for its separate six-year period, and protects PHI from storage through secure disposal. For survivor-centered care, pair those rules with careful access controls and regularly confirmed communication preferences.

FAQs

Does HIPAA set a medical record retention period?

No. The HIPAA Privacy Rule does not establish a general retention period for medical records. State law generally governs how long records must be kept, while HIPAA requires covered entities to protect PHI for as long as they maintain it. HIPAA’s six-year retention rule applies to specified HIPAA documentation, not to every clinical record.

How can clinics determine the retention period that applies in their state?

Identify each record type and the clinic’s provider category, then check the current state statutes and regulations that apply to those records. Review any additional federal program rules, grant terms, contracts, and legal holds. Have qualified counsel or a compliance professional confirm the schedule when rules overlap or are unclear.

Can a patient revoke consent for a PHI release?

A patient may generally revoke a HIPAA authorization in writing. The revocation applies after the covered entity receives it, but does not undo disclosures or other actions already taken in reliance on a valid authorization. The clinic should document the revocation and follow its procedures for updating future disclosures.

How should clinics document a survivor’s communication preferences?

Ask the survivor which channels, times, and types of messages are safe, including whether staff may leave voicemail or identify the clinic. Document the preferences in an appropriate, access-controlled place, share them only with staff who need them, and check whether they have changed. Consider how portal alerts, appointment reminders, and mailed communications might reveal sensitive information.