164.316(b)(2) Policies and Procedures

Time Limit

Medium Risk Moderate Medium

Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.

Implementation Guidance

Retain the documentation required by 164.316(b)(1) for six years from the date of its creation or the date when it last was in effect, whichever is later. Make it available to those responsible for implementing the procedures, and review it periodically, updating as needed in response to environmental or operational changes affecting the security of ePHI.

The "whichever is later" clause is regularly misread. A policy in force for eight years must be retained for six years after it ceases to be in effect — fourteen years from creation in total. Retention schedules built on creation date alone delete evidence that is still required.

Note also that this six-year period is a federal floor, not a ceiling. State law, professional licensure requirements and medical record retention rules frequently demand longer, and the longest applicable period governs. HIPAA sets no medical record retention period at all; that is a matter of state law, and conflating the two is a common error.

Implementation approach:
• Build a retention schedule covering every documentation type, with the retention trigger stated
• Compute retention from the later of creation or last effective date, and record both
• Retain superseded policy versions for six years after they cease to apply
• Suspend disposal on litigation hold or regulatory inquiry, and document the suspension
• Prevent premature deletion technically, not only by policy — retention locks or immutable storage
• Preserve readability across format and system changes; six-year-old evidence must still open
• Assign a documentation owner responsible for the schedule
• Reconcile against state and professional requirements and apply the longest period
• Dispose securely at end of life, and record what was destroyed and when
• Review the schedule annually alongside the policy review cycle

Required Documentation

• Retention schedule covering every documentation type and its retention trigger
• Records showing both creation date and last-effective date for each policy version
• Superseded policy and procedure versions within their retention window
• Retention configuration evidence, such as retention locks or immutable storage settings
• Legal hold and inquiry suspension records
• Format migration records demonstrating continued readability
• Secure disposal certificates and destruction logs
• Analysis reconciling HIPAA retention with state and professional requirements
• Annual retention schedule review records
• Named documentation owner and their responsibilities

Best Practices

• Record both creation and last-effective dates so the retention trigger can be computed correctly
• Enforce retention technically with immutable storage or retention locks, not policy alone
• Retain superseded versions for six years after they cease to apply, and label them clearly
• Automate legal hold so disposal stops immediately on notice
• Migrate formats proactively so old evidence remains readable
• Reconcile with state and professional retention rules and apply the longest period
• Keep destruction certificates; incomplete disposal records are themselves a finding
• Review the schedule annually with the policy review cycle
• Distinguish compliance documentation retention from medical record retention, which HIPAA does not govern

Common Violations

• Retention computed from creation date only, deleting evidence still within its window
• Superseded policy versions discarded on replacement
• Six years applied where state law requires longer
• No retention schedule, so practice varies by individual
• Retention unenforced technically, allowing premature deletion
• Legal hold not suspending routine disposal
• Old records retained but unreadable after a system or format change
• No destruction records for disposed documentation
• HIPAA's six-year documentation rule mistaken for a medical record retention period
• No named owner for retention

Testing Procedures

• Review the retention schedule and confirm it computes from the later of creation or last effective date
• Retrieve a document from the earliest retained period and confirm it opens and is legible
• Confirm superseded policy versions are retained with their effective and end dates recorded
• Attempt to delete a record within its retention window and confirm prevention
• Verify legal hold suspends disposal, and that suspensions are documented
• Sample disposal records and confirm items were genuinely eligible for destruction
• Confirm destruction certificates exist for disposed records
• Check the schedule against applicable state retention requirements
• Confirm the schedule has been reviewed within the last year
• Verify a named owner is accountable for retention