Six-Year Retention Requirements for TB Video Observed Therapy Files

Video observed therapy (vDOT) is now central to managing Tuberculosis Treatment Records, making clear retention rules essential. This guide explains why a six-year retention period is widely adopted, how it fits within CDC-aligned program guidance, and what you should do to achieve Retention Policy Compliance without compromising patient privacy.

CDC Guidelines for TB Record Retention

How CDC-aligned programs approach retention

CDC program guidance emphasizes complete, accurate, and retrievable TB case documentation and adherence to applicable federal, state, and local Regulatory Retention Periods. While jurisdictions set specific time frames, many TB programs use a six-year standard to align with common Public Health Recordkeeping practices and overarching compliance duties, then extend when special conditions apply.

What to include in a TB vDOT record

• vDOT session artifacts: the video itself or validated thumbnails, time stamps, and system verification showing ingestion and review.
• Clinical context: medication regimen, dosing calendar, adverse event notes, missed-dose resolutions, and provider directives.
• Consent and program forms: vDOT consent, telehealth acknowledgments, and patient communications relevant to adherence.
• Audit and integrity metadata: uploader, reviewer, date/time, device indicators, hash values if used, and audit trail entries.
• Case closure documentation: treatment outcome, reason for discontinuation if applicable, and retention/disposition decision.

Duration and exceptions you should plan for

Adopt six years as a baseline for vDOT artifacts and supporting TB records, then extend retention for minors, unresolved cases, active investigations, funding audits, or legal holds. Always document the rationale, effective dates, and review cadence for your schedule.

Importance of vDOT File Retention

Clinical continuity and quality

Consistent retention preserves objective evidence of dose ingestion, supports timely decisions when adherence fluctuates, and strengthens continuity as patients transition across settings. Reliable Video Directly Observed Therapy files also inform regimen adjustments and adverse event follow-up.

Program accountability and reporting

Retained vDOT records substantiate completion metrics, underpin Medical Record Auditing, and support internal quality improvement. They provide defensible documentation for grant monitoring and performance reviews while demonstrating Retention Policy Compliance.

Public health response

During contact investigations or outbreak reviews, well-maintained vDOT artifacts corroborate adherence timelines, narrow exposure windows, and accelerate appropriate interventions—key outcomes in effective Public Health Recordkeeping.

Compliance with Public Health Regulations

Map laws and apply the strictest requirement

Inventory all applicable rules—state TB program directives, health department schedules, and federal privacy and security requirements. When standards differ, adopt the strictest Regulatory Retention Periods that reasonably apply to your setting, and capture the decision in your written policy.

Operationalize the schedule

• Publish a record retention schedule that names the “TB vDOT record” as a category with a six-year default and conditions for extension.
• Embed the schedule into technical controls (tags, folders, lifecycle rules) so retention and deletion are automated and auditable.
• Execute Business Associate Agreements where vendors touch protected data, defining retention, return, and destruction duties.
• Train staff on intake, labeling, storage, and disposition steps to ensure consistent execution across teams.

Best Practices for Secure Storage

Protect confidentiality, integrity, and availability

Use encryption in transit and at rest, enforce multi-factor authentication, and apply role-based access controls. Maintain tamper-evident audit trails so every access, edit, and deletion of TB vDOT files is attributable and reviewable under your Data Confidentiality Standards.

Engineer for lifecycle and resilience

• Apply lifecycle tags at ingestion (patient ID, case number, closure date) to drive automated retention and purge schedules.
• Adopt a 3-2-1 backup approach with at least one offsite or logically isolated copy and routine restore testing.
• Use immutable or “legal hold” capabilities when litigation or investigations require suspension of deletion.

Dispose securely

At the end of the defined period—and only when no holds apply—perform verifiable destruction. For encrypted repositories, cryptographic erasure of keys can be appropriate; for on-prem media, use overwriting or physical destruction methods with documented certificates.

Legal Considerations for TB Records

Retention versus minimization

Balance the need to retain vDOT artifacts for care, reporting, and defense with the obligation to minimize unnecessary data. Keep only what your schedule justifies, and separate training or research copies using de-identification when possible.

Litigation readiness

Treat TB vDOT records as potential evidence. Define clear triggers for legal holds, document who can authorize them, and ensure holds override automated deletion until release. Maintain a chain-of-custody for exported files.

Patient rights and disclosures

Support patient access to their Tuberculosis Treatment Records within reasonable time frames and maintain disclosures logs where required. For non-treatment uses, obtain appropriate authorizations or ensure an applicable public health exception applies.

Access and Confidentiality Controls

Role-based access with the minimum necessary

Limit viewing rights to staff who need vDOT files to perform their duties. Segment admin capabilities, require just-in-time elevation for sensitive tasks, and review access lists at regular intervals.

Workforce readiness and device hygiene

Provide scenario-based training on privacy, secure sharing, and incident reporting. Enforce device encryption, screen locks, and prohibited local downloads for endpoints that access Video Directly Observed Therapy content.

Partner and vendor governance

When sharing with public health partners or vendors, use data-sharing agreements that define permitted purposes, security expectations, retention timelines, and destruction procedures, ensuring alignment with your Retention Policy Compliance framework.

Auditing and Monitoring Retention Compliance

Plan the audit

Establish a Medical Record Auditing calendar that samples open and closed TB cases. Verify the presence of required vDOT artifacts, consent forms, and audit metadata; confirm lifecycle tags and ensure no premature deletions occurred.

Measure what matters

• Record completeness rate: percentage of cases with all required vDOT elements present.
• On-time disposition: percentage of records destroyed or archived within 30 days of eligibility.
• Exception handling: number of legal holds opened/closed, with average time to resolution.
• Access hygiene: percentage of users with access reviews completed each quarter.

Drive continuous improvement

Trend findings, assign owners, and track corrective actions. Update procedures when new laws, technology changes, or incident learnings emerge, and communicate revisions to keep Public Health Recordkeeping aligned with evolving expectations.

Key takeaways

A six-year retention baseline for TB vDOT files helps you meet common compliance expectations, maintain clinical continuity, and be audit-ready. Document your schedule, automate it, protect confidentiality, and verify performance through routine monitoring.

FAQs.

What is the required retention period for TB vDOT files?

Use six years as your baseline retention period for vDOT artifacts and supporting documentation, then extend when state rules, minors’ records, investigations, audits, or legal holds require longer. Always capture your rationale and review dates in a written policy.

Why is six-year retention important for TB therapy records?

It aligns with common Regulatory Retention Periods and gives programs enough history to verify adherence, support quality reviews, satisfy funder and oversight requests, and respond effectively to public health inquiries.

How should TB vDOT files be securely stored?

Encrypt data in transit and at rest, enforce multi-factor authentication and role-based access, tag files at ingestion for lifecycle control, keep immutable backups, and maintain complete audit trails. At end of life, perform documented, verifiable destruction.

What are the legal risks of improper TB record retention?

Risks include privacy violations, regulatory sanctions, funding findings, adverse litigation outcomes, and reputational damage. Gaps can also undermine case management, leading to incomplete Tuberculosis Treatment Records and avoidable public health exposures.