Sialendoscopy at a Salivary Gland Center: A Guide to PHI Retention Policies

A clear retention policy helps a salivary gland center keep sialendoscopy records for the right period, protect patient privacy, and dispose of records securely when they are eligible for destruction. The key distinction: HIPAA’s six-year documentation rule generally applies to required HIPAA compliance records—not to every medical record.

What PHI and records are created during sialendoscopy?

Depending on the care provided and the center’s workflow, a sialendoscopy record may include the patient’s history and symptoms, procedure indication, consent documents, clinical notes, endoscopy findings, images or video, medication details, follow-up instructions, referrals, and billing information. Anesthesia or monitoring records may also be created when applicable.

When these materials identify a patient—or could reasonably be used to identify one—and relate to their health, care, or payment for care, they may be protected health information (PHI). PHI can exist in paper, electronic, image, video, or other formats. See the HHS definition of protected health information.

Keep procedure consent distinct from HIPAA paperwork. A patient’s clinical consent and the center’s Notice of Privacy Practices acknowledgment serve different purposes; neither makes the entire chart subject to a universal six-year retention period.

Does HIPAA set a medical-record retention period?

No. The HIPAA Privacy Rule does not set a general medical-record retention period for covered entities. HHS explains that state laws generally govern how long medical records must be kept, while HIPAA safeguards apply for as long as the center maintains PHI, including during disposal. See HHS guidance on HIPAA and medical-record retention.

So, the six-year rule should not be used as a default deadline for deleting sialendoscopy charts. A center must identify the applicable state medical-record retention laws and any additional requirements that apply to its facility, services, or contracts.

Which HIPAA-required documentation must be kept for six years?

HIPAA-required documentation generally must be retained for six years from its creation or, if later, the date it was last in effect. This requirement applies to documentation the HIPAA rules require—not automatically to every document containing PHI. The Privacy Rule and Security Rule each have documentation requirements; see 45 CFR § 164.530(j) and 45 CFR § 164.316(b)(2)(i).

Examples can include:

• Required Privacy Rule policies and procedures, Notices of Privacy Practices, and documentation of required actions, activities, or designations.
• Documentation of a provider’s good-faith effort to obtain a patient’s acknowledgment of the Notice of Privacy Practices, when applicable.
• Security Rule policies and procedures, and records of actions, activities, or assessments the Security Rule requires the center to document.

These are HIPAA compliance records, not a list of all clinical records. Also, a patient’s right to request an accounting of certain disclosures covering the prior six years is a separate rule; it does not create a six-year retention requirement for every medical record.

How do state laws and facility rules affect retention?

State medical-record retention laws may set specific periods based on factors such as the type of record, the patient’s age, or the provider or facility involved. A center should check the rules in each state where it operates rather than assume the HIPAA six-year documentation period controls its clinical charts.

Facility policies, payer or contract terms, and requirements tied to a particular program may also affect how long records must be kept. The phrase “federally regulated clinic records” does not, by itself, establish one retention period for every clinic; identify the specific federal program or rule that applies and confirm its requirements. If requirements overlap, obtain advice from qualified compliance or legal counsel before setting a destruction date.

How should a center safeguard records during storage and disposal?

Protect records for the entire time they are maintained. HIPAA requires appropriate safeguards for PHI, and the Security Rule specifically requires policies and procedures for the final disposition of electronic PHI and for removing it from electronic media before reuse. See HHS guidance on safeguarding and disposing of PHI.

As practical safeguards, a center can limit access to staff who need records for their work, use secure storage for paper files and devices, protect electronic systems and backups, and document authorized access and disposal processes. These are operational measures to support privacy and security; the center should select safeguards appropriate to its risks and systems.

For secure PHI disposal, HIPAA does not prescribe one method for every situation, but the method must reasonably protect against unauthorized access. Paper records may be shredded, pulped, or otherwise destroyed so they cannot be read or reconstructed. Electronic information should be securely cleared, purged, or destroyed as appropriate to the media. Do not place identifiable PHI in publicly accessible trash or recycling. Train workforce members involved in disposal and ensure any disposal vendor handling PHI is appropriately engaged as a business associate when required.

What retention-policy steps should a salivary gland center take?

A practical policy should separate clinical charts from HIPAA compliance documentation and specify how each record category is managed. A center can:

• Inventory the records created during sialendoscopy, including paper forms, electronic notes, images, video, billing records, and applicable anesthesia records.
• Identify the federal, state, contractual, and facility requirements that apply to each category, and set a retention period that satisfies all applicable requirements.
• Assign responsibility for retention decisions, legal holds, authorized access, and secure disposal.
• Document the retention schedule, review it when laws or operations change, and train relevant staff on the procedures.
• Use a process to confirm that records are eligible for destruction before disposal, including checking for legal holds or other preservation obligations.

In short, do not treat HIPAA’s six-year documentation rule as the retention period for every sialendoscopy chart. Determine the applicable record-specific requirements, safeguard PHI while it is stored, and use secure disposal when the approved retention period ends.

FAQs

How long must a salivary gland center retain sialendoscopy records?

There is no single HIPAA-wide retention period for sialendoscopy records. The center must determine the period required by applicable state medical-record retention laws and any facility, program, or contract requirements. HIPAA-required compliance documentation has its own six-year rule, which does not automatically apply to the full clinical chart.

Does HIPAA require medical records to be kept for six years?

No. HIPAA does not establish a general six-year retention period for medical records. Its six-year rule applies to specified documentation required by the Privacy Rule and Security Rule. State law and other requirements may determine how long medical records must be retained.

Which records fall under HIPAA’s six-year documentation rule?

The rule covers documentation HIPAA requires, such as relevant written policies and procedures, Notices of Privacy Practices and related required acknowledgment or good-faith-effort records, and documented Security Rule actions or assessments. The period is six years from creation or from the date the documentation was last in effect, whichever is later.

How should PHI be protected when records are disposed of?

Use a disposal method that reasonably prevents unauthorized access or reconstruction. Paper PHI can be securely shredded or otherwise destroyed; electronic PHI and media should be securely cleared, purged, or destroyed as appropriate. Keep materials secure until disposal, train involved staff, and use an appropriately contracted business associate when a vendor handles PHI.