Immunohematology Reference Lab PHI Retention Policy: A Practical Guide

An immunohematology reference lab needs a retention policy that does more than set one deadline for every patient record. The right period depends on the record’s purpose, whether it relates to a blood product or transfusion, which federal rules apply to the laboratory, and any applicable state medical-record retention law.

Use this guide to build a schedule that separates HIPAA privacy safeguards from record-retention requirements, identifies key transfusion and testing records, and sets a controlled process for secure disposal.

What HIPAA Requires for PHI Retention and Disposal

HIPAA does not set a general retention period for medical records or PHI. It requires covered entities to safeguard PHI for as long as they maintain it, including during disposal. HHS explains that state and other applicable laws generally determine how long medical records must be kept. See the HHS HIPAA FAQ on disposal of protected health information.

Do not confuse medical-record retention with HIPAA’s six-year rule. Under 45 CFR 164.530(j), covered entities must retain certain HIPAA-required documentation—such as policies, procedures, and records of required actions—for six years from creation or the date it was last in effect, whichever is later. That requirement does not establish a six-year retention period for clinical records.

HIPAA also requires appropriate safeguards when PHI is disposed of. For electronic PHI, policies and procedures must address final disposition of the information or its media, and removal of ePHI before media are reused, as provided in 45 CFR 164.310(d)(2). HIPAA does not prescribe one disposal method for every organization; safeguards should reflect the information, media, and risks involved.

Which Immunohematology Records Must Be Retained

Start by inventorying records by function and regulatory scope rather than treating every item containing PHI as the same record type. Depending on what the laboratory does and which rules apply, the inventory may include:

• Transfusion-related records: compatibility-testing results, crossmatches, patient-sample testing, antibody screening and identification, confirmatory testing, transfusion-reaction reports, and associated investigations or follow-up.
• Blood establishment records: records tracing significant steps in blood collection, processing, compatibility testing, storage, distribution, and product disposition, when the laboratory is subject to the applicable blood regulations.
• Non-transfusion-related testing records: test requisitions and authorizations, test procedures, analytic-system and patient-test records, and final, preliminary, or corrected reports.
• Quality-control records: equipment calibration, performance checks, reagent checks, proficiency testing, and laboratory quality-system assessments. Their applicable retention period can depend on whether they are ordinary CLIA records, blood-product records, or both.
• Supporting records: instrument output, reference-laboratory communications, audit trails, specimen information, and records needed to interpret or trace a result.

The federal rules do not make every record in these categories subject to one identical deadline. For example, CLIA’s retention rule sets periods for laboratory records and separately cross-references certain immunohematology, blood, blood-product, and transfusion records to the blood regulations. Review the current requirements in 42 CFR 493.1105 and 21 CFR 606.160 against the lab’s actual activities.

How Long Must Transfusion-Related Records Be Kept

For records covered by 21 CFR 606.160(d), the minimum is generally 10 years after completion of processing or six months after the latest expiration date for the individual product, whichever is later. Records must also be kept beyond the product’s expiration date as needed to facilitate reporting of unfavorable clinical reactions. When a product has no expiration date, the regulation requires the records to be retained indefinitely.

The rule also describes records that support traceability, such as compatibility-test results, confirmatory testing, storage and distribution information, and transfusion-reaction reports. CLIA’s 42 CFR 493.1105 specifically directs laboratories to retain immunohematology and related blood or transfusion records as specified in 21 CFR 606.160.

Confirm that the specific records and products fall within the relevant provisions before applying the 10-year or indefinite period across an entire archive. A reference lab’s scope and role matter; a record’s presence in a lab system does not, by itself, establish that every blood-establishment retention rule applies to it.

How State Laws Affect Retention Periods

State medical-record retention laws may impose requirements in addition to the applicable federal rules. Requirements can vary by state, record type, provider or facility, and patient age. HHS notes that state laws generally govern medical-record retention where HIPAA does not set a period. A lab should identify the laws that apply to its locations, services, and records rather than relying on a generic national deadline.

For each record category, compare all applicable federal, state, contractual, and organizational requirements. Where more than one rule applies, use a schedule that meets every applicable requirement and does not authorize destruction before the longest required period ends. Ask qualified counsel to review any apparent conflict or uncertainty; the interaction between laws can depend on the specific facts.

How to Build a Compliant Retention Schedule

A workable retention schedule gives staff a clear answer to what to keep, for how long, and what must happen before destruction. Build it around record categories and their applicable retention triggers, not simply the date a file was opened.

1. Inventory records and locations. Include paper files, laboratory information systems, instrument systems, shared storage, vendor-hosted systems, scanned documents, and backups that may contain PHI.
2. Classify each record. Identify whether it is a transfusion-related record, blood establishment record, non-transfusion-related testing record, quality-control record, HIPAA compliance document, or another category.
3. Identify the rule and trigger. Record the applicable federal or state authority and the event that starts the retention period, such as report date, completion of processing, product expiration, or the end of a defined relationship.
4. Use the longest applicable period. Compare federal minimums, state requirements, contracts, and organizational commitments. Document which rule controls and why.
5. Set review and approval controls. Require a check for open investigations, audits, complaints, claims, legal holds, and other preservation instructions before a scheduled destruction.
6. Plan for continuity. If the lab relocates, changes systems, or ceases operations, assign responsibility for maintaining and making records available for their required periods. CLIA addresses records when a laboratory ceases operation in 42 CFR 493.1105(b).
7. Review the schedule regularly. Reassess it when regulations, state law, lab services, contracts, or record systems change, and train staff on the procedures relevant to their work.

Keep the schedule itself, approvals, destruction logs, and any required HIPAA documentation under their own applicable retention rules. HIPAA’s six-year documentation period applies to documentation required by the Privacy Rule; it should not be copied into the schedule as a default period for patient or transfusion records.

How to Securely Dispose of PHI After Retention

Dispose of PHI only after the approved retention period has ended and the lab has confirmed there is no preservation hold or other reason to keep it. HIPAA prohibits abandoning PHI in places accessible to the public or unauthorized people. HHS describes risk-based safeguards and examples in its guidance on HIPAA disposal safeguards.

• Paper: Use secure shredding, pulping, pulverizing, or another process that renders the information essentially unreadable and unreconstructable.
• Electronic media: Use an appropriate process to clear or purge data, or physically destroy the media. Apply the lab’s approved procedures before reusing devices or storage media.
• Third-party vendors: If a vendor disposes of PHI for the lab, establish the required business associate arrangements and safeguards, and document the destruction process.
• Verification: Record what was destroyed, when, under whose authorization, and by what method. Ensure the method also addresses copies and storage locations included in the approved disposition plan.

HIPAA requires reasonable safeguards, not one universal destruction technique. Choose and document a method appropriate to the information, its format, and the risk of unauthorized access.

What Exceptions Require Longer or Indefinite Retention

Some transfusion-related records must be kept longer than a routine schedule would otherwise allow. Under 21 CFR 606.160(d), retain covered product records at least until the later of the 10-year processing period or six months after the latest product expiration date; retain them indefinitely when the product has no expiration date. Keep records longer when necessary to facilitate reporting of unfavorable clinical reactions.

Other reasons to suspend scheduled destruction may include an open investigation, audit, complaint, claim, or legal hold. These are preservation triggers to evaluate under applicable law and the organization’s instructions; they do not mean every record must be retained forever. State law or a contract may also set a longer period for particular records.

HIPAA’s protection of a decedent’s PHI for 50 years after death is not a requirement to retain that person’s medical records for 50 years. HHS confirms that records may be destroyed when permitted by state or other applicable law. See the HHS FAQ on decedent records.

In practice, a sound policy separates HIPAA privacy safeguards from medical-record retention, applies the blood-record minimums only to records within their scope, checks state requirements, and blocks destruction until all applicable periods and preservation holds have cleared.

FAQs

Does HIPAA set a general PHI retention period?

No. HIPAA does not set a general retention period for medical records or PHI. It requires covered entities to protect PHI while it is maintained and to use appropriate safeguards for disposal. The six-year HIPAA documentation rule applies to specified compliance documentation, not medical records generally.

How long should an immunohematology reference lab retain transfusion-related records?

For records covered by 21 CFR 606.160(d), retain individual product records at least 10 years after processing is complete or six months after the product’s latest expiration date, whichever is later. Keep records beyond expiration as necessary to facilitate reporting of unfavorable clinical reactions; records for products with no expiration date must be retained indefinitely. Confirm that the particular record and product are covered by the rule.

Can state law require longer retention than federal rules?

State law may impose additional or longer retention requirements for records within its scope. Compare state rules with applicable federal requirements, contracts, and preservation instructions, and use a schedule that meets all applicable obligations. Consult qualified counsel if the requirements appear to conflict.

When may blood records need to be retained indefinitely?

Under 21 CFR 606.160(d), covered records must be retained indefinitely when the blood or blood component has no expiration date. A separate legal hold or another applicable requirement may also prevent routine destruction until the hold or requirement is resolved.