PHI Retention Policy Guide for Public Safety-Net Hospitals

A sound PHI retention policy helps a public safety-net hospital keep patient information for the periods required by law, preserve records when they may be needed, and dispose of them securely when eligible. HIPAA does not set one general retention period for every medical record, so you need to distinguish clinical records from HIPAA compliance documentation and check the rules that apply to your hospital and jurisdiction.

What HIPAA Requires for PHI and Compliance Records

The HIPAA Privacy Rule does not establish a general period for keeping medical records. It does require covered entities to apply appropriate safeguards to PHI for as long as it is maintained, including during disposal. HHS guidance on HIPAA and medical-record retention explains this distinction.

HIPAA does set a six-year retention period for certain HIPAA compliance documentation. Privacy Rule documentation must be retained for six years from its creation or the date it was last in effect, whichever is later. The Security Rule applies the same period to documentation required by that rule. These requirements cover specified policies, procedures, communications, actions, and assessments—not every clinical record just because it contains PHI. See 45 CFR 164.530(j) and 45 CFR 164.316(b).

HIPAA also requires privacy safeguards while PHI is maintained. For hospitals subject to Medicare hospital conditions of participation, a separate federal rule requires medical records to be retained in original or legally reproduced form for at least five years. That rule is not a universal HIPAA retention period; it is a distinct requirement that applies to covered hospitals under 42 CFR 482.24.

How State and Federal Laws Affect Medical-Record Retention

State medical-record retention statutes can set different periods and may distinguish among hospitals, record types, and patient circumstances. A public hospital may also be subject to state or local records-management rules, its governing authority’s approved schedule, and requirements tied to particular programs or funding. Confirm which rules apply to the hospital’s legal structure and location rather than assuming every public hospital follows the same schedule.

Federal requirements may create additional retention obligations. For example, the Medicare hospital rule sets a five-year minimum for medical records at hospitals subject to that condition of participation, while HIPAA sets six years for specified compliance documentation. Other federal program rules, contracts, audits, or research requirements may apply to particular records. Identify each applicable requirement and reconcile it with the relevant state and local rules.

Public access laws do not mean that patient records should be released without review. A public hospital should have legal counsel assess how state open-records duties, confidentiality laws, and HIPAA apply to a request. HHS explains that HIPAA preemption and state-law exceptions depend on the specific provisions involved; see its guidance on HIPAA and state laws.

Federal records schedules apply to federal records and federal agencies. They should not be treated as the default schedule for a state, county, or municipal hospital simply because that hospital receives federal funding. The National Archives explains the scope and approval process for federal records schedules; public hospitals should locate the applicable state or local authority for their own records.

How Public Hospital Retention Schedules Vary by Record Type

A public hospital records retention schedule should distinguish records by purpose and record series, not treat every document containing PHI as one group. The applicable period and its starting point can differ by record type and jurisdiction. A working schedule may include:

• Patient medical records: inpatient, outpatient, emergency, and discharge records, including the forms and entries that make up the official chart.
• Diagnostic records: laboratory results, imaging, reports, and related files maintained in separate systems.
• Billing and reimbursement records: claims, supporting documentation, payment records, and audit materials, which may have requirements separate from the clinical chart.
• Privacy and compliance records: policies, required notices and communications, training documentation, complaint records, and other required HIPAA documentation.
• Special-category records: records involving minors, behavioral health, research, or other areas that may be subject to additional rules or distinct schedules.
• Operational records containing PHI: release-of-information logs, registration documents, scanned forms, and system records that must be classified according to their purpose and legal requirements.

Set clear start events for each category—for example, the end of an encounter, the date of discharge, the closing of a claim, or the date a policy is superseded—only after confirming that event fits the governing rule. Keep the official record and its components identifiable across the electronic health record, imaging systems, paper files, archives, and vendor-held systems. A schedule should also identify which records are permanent, if applicable, and which are eligible for eventual destruction.

How to Set Retention Periods for Different Patient Records

Build the retention schedule from an inventory of where the hospital creates, receives, stores, and shares records. Include paper and electronic repositories, departmental systems, backups, archives, and records held by contractors. For each record series, document the applicable law or approved schedule, the required period, the start event, the responsible custodian, and the permitted final disposition.

Use a review process that compares state medical-record retention statutes, applicable federal requirements, local public-records schedules, program rules, and legal advice. Do not apply the six-year HIPAA documentation period to a patient chart by default, or assume that the five-year Medicare hospital minimum resolves every state or program requirement. If requirements appear to conflict, ask counsel to analyze them before setting the period.

Make the schedule usable in day-to-day operations. State when a period begins, how staff identify records that have reached the end of that period, who approves disposition, and how exceptions are handled. Provide specific instructions for records involving minors or other special categories only after verifying the relevant jurisdiction’s rules. Avoid leaving retention decisions to individual staff members or vague instructions such as “keep as needed.”

Define legal hold requirements in the policy. When counsel issues a hold or identifies records that must be preserved for litigation, an investigation, an audit, or another legal matter, suspend routine destruction for the records in scope. Document the hold, notify the affected departments and vendors, preserve relevant electronic information, and resume normal disposition only when the hold is formally released.

How to Secure Paper and Electronic PHI During Retention

HIPAA safeguards apply throughout the period records are maintained, not only while staff are actively using them. For paper PHI, use controlled-access rooms or cabinets, limit access to authorized staff, protect files during transport, and track records sent to off-site storage. Keep retrieval processes and access approvals clear so staff can locate records without exposing them unnecessarily.

For electronic protected health information, use access controls appropriate to staff roles, maintain secure systems and devices, and manage system access when roles change or employment ends. Back up information and protect stored media. Encryption may be an appropriate safeguard based on your risk analysis and operating environment; do not describe it as a universal HIPAA mandate for every circumstance. The HIPAA Security Rule requires policies for physical access and electronic media, including disposal and reuse; see 45 CFR 164.310.

Review the safeguards used by storage providers and other business associates that handle PHI. Contracts and procedures should address access, security, return or destruction of records, and cooperation with holds or authorized retrievals. HIPAA requires appropriate administrative, technical, and physical safeguards for PHI; see 45 CFR 164.530(c).

How to Dispose of PHI Confidentially

Before disposing of a record, confirm that its retention period has expired, no legal hold or other preservation requirement applies, and the person authorizing destruction has the right to do so. Follow the approved schedule and document the disposition according to hospital policy. Keep records that must be preserved out of routine destruction batches.

Use a method appropriate to the form and sensitivity of the information. Paper may be shredded, pulped, or otherwise destroyed so it cannot reasonably be read or reconstructed. Store materials awaiting pickup in secure containers, and supervise or contract with a vendor under appropriate business associate terms. For electronic media, follow documented procedures to clear, purge, or destroy PHI before reuse or disposal.

HIPAA does not prescribe one disposal method for every situation, but it does require safeguards and policies that protect PHI during disposal. HHS describes examples of confidential records disposal, including secure paper destruction and appropriate sanitization or destruction of electronic media. Train workforce members whose duties involve disposal, and maintain evidence of completed destruction when your policy or applicable rules call for it.

Who Should Review and Administer the Retention Policy

Retention works best as a shared governance responsibility. Assign a policy owner and involve the privacy officer, health information management, records management, legal counsel, information security, IT, compliance, finance, and the departments that create or manage records. Public hospitals should also involve the records officer or public authority responsible for the applicable state or local schedule.

Define who interprets requirements, approves schedule changes, manages legal holds, authorizes destruction, and monitors vendors. Provide workforce training that matches staff duties and the hospital’s policies. HIPAA requires training as necessary and appropriate for workforce functions, including when relevant policies materially change; it does not establish one universal annual certificate-renewal rule.

Review the policy on a set schedule and when laws, systems, contracts, organizational responsibilities, or recordkeeping practices change. Keep a dated version history and make the current instructions available to the staff who apply them.

In summary, a reliable PHI retention policy separates clinical records from HIPAA compliance documentation, maps each record series to the laws and schedules that apply, defines clear retention triggers, preserves records subject to a legal hold, and protects information through secure storage and disposal.

FAQs

Does HIPAA set a general retention period for medical records?

No. The HIPAA Privacy Rule does not set a general medical-record retention period. Other federal rules may apply: for example, hospitals subject to the Medicare hospital conditions of participation must retain medical records for at least five years. State law or another applicable requirement may require a different or longer period. See HHS guidance and 42 CFR 482.24.

How long must HIPAA compliance documentation be retained?

HIPAA requires specified Privacy Rule and Security Rule documentation to be retained for six years from its creation or the date it was last in effect, whichever is later. This period does not automatically apply to every patient medical record. See 45 CFR 164.530(j) and 45 CFR 164.316(b).

Can state law require public hospitals to retain records longer?

Yes. State medical-record retention statutes and public-sector records schedules may impose requirements that differ by record type and hospital. Check the rules for the hospital’s jurisdiction and have counsel assess how they interact with applicable federal requirements.

How should a hospital securely dispose of PHI?

First confirm that the record is eligible for disposition and is not subject to a legal hold. Then use a secure method appropriate to the format, such as shredding or pulping paper and sanitizing or destroying electronic media. HIPAA requires reasonable safeguards and disposal procedures but does not prescribe one method for every case. See HHS disposal guidance.