On this page
The HIPAA document retention requirements say covered entities and business associates must keep the documentation each rule requires of them for six years from the date it was created or the date it was last in effect, whichever is later: Privacy Rule records such as policies and signed authorizations for covered entities, and Security Rule records for both (45 CFR 164.530(j); 45 CFR 164.316(b)). HIPAA does not set how long medical records themselves are kept; HHS says state laws generally govern that (HHS). For marketing teams, the records to keep are signed marketing authorizations, policy versions and the security records for any tool that handles ePHI. Curve Compliance, which signs a BAA on every plan, checked each source below on November 2, 2026.
Book a call. Collecting leads on a healthcare site? Curve Forms are hosted by Curve under the BAA it signs on every plan, with a retention window and legal hold for individual leads, and every view or export of submissions is logged. Curve's team does the setup, typically live in about a week. Book a call with Curve.
The six-year rule
The rule appears twice, once in each main HIPAA rule. The Privacy Rule: "A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.530(j)(2)). The Security Rule, which applies to business associates too: "Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.316(b)(2)(i)).
The clock matters. A privacy policy written in 2020 and replaced in 2026 must be kept until 2032, six years after it was last in effect, not six years after it was written. The Security Rule adds two more duties: make documentation available to the people who carry out the procedures, and "Review documentation periodically, and update as needed" (164.316(b)(2)). HHS's Security Rule summary puts it the same way: keep it "until six years after the later of" the creation date or the date last in effect (HHS).
What documentation it covers
The six-year rule applies to documentation the rules require. Under the Privacy Rule that means written policies and procedures, any communication the rule requires in writing, and a record of any action, activity or designation the rule requires to be documented (164.530(j)(1)). Under the Security Rule it means policies and procedures and a record of any required "action, activity, or assessment" (164.316(b)(1)).
| Record | Rule that requires it | Source |
|---|---|---|
| Privacy policies and procedures, each version | 164.530(i) and (j) | eCFR |
| Notices of privacy practices | HHS lists them among documents kept six years | HHS |
| Signed authorizations, including for marketing | "A covered entity must document and retain any signed authorization under this section as required by § 164.530(j)" | 164.508(b)(6) |
| Privacy official and contact designations | 164.530(a)(2) | eCFR |
| Training provided | 164.530(b)(2)(ii) | eCFR |
| Complaints and their disposition | 164.530(d)(2) | eCFR |
| Sanctions applied | 164.530(e)(2) | eCFR |
| Security policies, risk analysis and other required assessments | 164.316(b)(1) | eCFR |
| Security incidents and their outcomes | 164.308(a)(6)(ii) | eCFR |
| Written contracts with business associates for ePHI | 164.308(b)(3) | eCFR |
A related six-year window covers patients: the right to an accounting of disclosures reaches back "in the six years prior to the date on which the accounting is requested" (45 CFR 164.528). For what the notice must say, see the notice of privacy practices; for who keeps these records, see the HIPAA privacy officer.
What it doesn't cover: medical records
HHS answers this directly: "No, the HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained." HIPAA still governs how records are protected while you hold them: covered entities must "apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records and other protected health information (PHI) for whatever period such information is maintained by a covered entity, including through disposal" (HHS).
Disposal is a Security Rule duty too. Device and media controls require policies "to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored," and removal of ePHI from media before reuse (45 CFR 164.310(d)). See the three types of HIPAA safeguards.
Retention for marketing records
- Marketing authorizations. Keep each signed authorization for six years from when it was signed or last in effect (164.508(b)(6)). See HIPAA marketing authorization.
- Policy and notice versions. Keep every version of your privacy policies and notice, with the dates each was in effect.
- Vendor contracts. The Security Rule requires the assurances from a business associate to be documented "through a written contract or other arrangement" (164.308(b)(3)). Keep each BAA, and note its end date.
- Risk analysis of marketing tools. If a form, CRM or tracking tool holds ePHI, its risk analysis is required documentation. See how to include marketing tools in a risk assessment.
- Lead form submissions. If they contain PHI, HIPAA sets no fixed period for them, but they must be safeguarded for as long as you keep them and disposed of securely (HHS). Anything that becomes part of a medical record also follows your state's medical record law.
- When a vendor contract ends. The business associate contract must require the vendor to "return or destroy all protected health information" it still holds, if feasible, or extend the contract's protections to it (45 CFR 164.504(e)).
Building a retention schedule
A retention schedule is a list of record types, the rule behind each, and the date each can be destroyed. A simple build:
- List the records. Use the table above, plus anything your state requires for medical records.
- Set the clock per record. Six years from creation or from the date last in effect, whichever is later. For policies and contracts, that means tracking when each version ended.
- Check state law. HHS says state laws generally govern how long medical records are kept.
- Plan disposal. Write down how paper is shredded and how ePHI is removed from devices and media.
- Handle holds. Note how you will pause deletion of records tied to a complaint, investigation or lawsuit; your legal team decides when a hold applies.
- Review it. The Security Rule asks you to review documentation periodically and update it after changes.
How Curve Compliance helps
Curve Compliance helps on the lead and marketing side. Curve Forms are hosted by Curve under the BAA it signs on every plan, so submissions never pass through a third-party form tool. Each form has a retention window and legal hold for individual leads, read-only and full-access roles, and a log of every view or export of submissions. Separate checkboxes capture privacy consent and marketing consent, and form answers are never sent to ad platforms.
For ads, Curve replaces browser pixels with one script, strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what it accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. Retention periods for your own records depend on your state and your contracts, so talk to your counsel.
Sources, checked November 2, 2026: HHS, FAQ 580 on medical record retention; HHS, Summary of the HIPAA Privacy Rule; HHS, Summary of the HIPAA Security Rule; HHS, Regulatory Initiatives; eCFR, 45 CFR 164.308, 164.310, 164.316, 164.504, 164.508, 164.528 and 164.530; Federal Register, 90 FR 898 (2025).
Frequently Asked Questions
What are the HIPAA document retention requirements?
Covered entities must keep Privacy Rule documentation, such as policies and signed authorizations, and covered entities and business associates must keep Security Rule records, for six years from creation or the date last in effect, whichever is later (45 CFR 164.530(j); 164.316(b)).
What is the HIPAA data retention policy?
HIPAA has no single data retention policy. It sets six years for required documentation, leaves medical record retention to state law, and requires safeguards for PHI for as long as you keep it, including disposal (164.530(j); HHS).
Do you have to keep data for 7 years under HIPAA?
Not under the HIPAA documentation rules, which say six years (164.530(j)(2); 164.316(b)(2)(i)). Any other period, such as one for medical records, comes from outside those sections; HHS says state laws generally govern medical record retention (HHS).
How long must a signed HIPAA authorization be kept?
Six years from the date it was created or last in effect, whichever is later, because 164.508 requires signed authorizations to be retained under 164.530(j) (45 CFR 164.508(b)(6)).
Does HIPAA set how long medical records are kept?
No. HHS says "the HIPAA Privacy Rule does not include medical record retention requirements" and that state laws generally govern it (HHS).
How long should lead form submissions be kept?
HIPAA sets no fixed period for PHI in a lead form, but it must be safeguarded for as long as you keep it, including through disposal (HHS). Curve Forms let you set a retention window and place a legal hold on individual leads.
What is the new HIPAA rule in 2026?
HHS says compliance with the remaining notice of privacy practices changes "is required by February 16, 2026," so a new notice version joins your six-year files; the Security Rule update is still a proposed rule (HHS; Federal Register). See the new HIPAA rules in 2026.
Talk to Curve Compliance
Book a call. Want lead forms with retention controls and ad tracking that keeps PHI away from ad platforms? Curve Forms and Curve's server-side conversions run under the BAA Curve signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.