Billing paper: the longer clocks behind FCA lookbacks

Why billing paper runs on a different clock than the chart

HIPAA's own documentation-retention floor keeps Security and Privacy Rule paperwork for six years from creation or last effective date 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The §164.316 six-year documentation retention floor, contrasted against the separate, often longer clock billing paper needs to survive., but that floor was never written with False Claims Act exposure in mind — it's a privacy-and-security clock, not a billing-defense one. Clinical-record retention conventions, like the guideline example of roughly seven years after last service for an adult that behavioral-health associations publish, are built around malpractice and continuity of care, always deferring to state law 2Ref 2American Psychological Association (2007).Record Keeping Guidelines.The clinical-record retention convention (roughly seven years after last service for adults, deferring to state law) used to contrast against billing paper's separate retention driver..

Billing paper needs its own analysis rather than borrowing either clock by default. The exposure that actually drives how long to keep claims, EOBs, and coding support is federal fraud-and-abuse enforcement, and that exposure window doesn't track neatly with either the HIPAA floor or the clinical-record convention.

The False Claims Act is why the clock runs long

The False Claims Act imposes treble damages and per-claim penalties for knowingly submitting a false claim — and "knowingly" reaches reckless disregard, not just deliberate fraud — with private qui tam relators empowered to bring suit on the government's behalf 3Ref 3U.S. Department of Justice (2026).The False Claims Act.The FCA's treble-damages exposure, reckless-disregard standard, and qui tam mechanism — the underlying reason billing documentation needs to survive longer than the chart it supports.. A claim submitted years ago can still resurface in an investigation or a relator's lawsuit long after the encounter itself has faded from memory.

That's the practical reason billing documentation needs to outlive the chart note it supports: if a coding decision, a medical-necessity justification, or a modifier choice is ever questioned, the record proving why the claim was submitted the way it was is your defense, and it has to still exist when the question arrives.

What actually counts as billing paper worth keeping

Keep the claim form or superbill, the EOB or remittance advice showing what was actually paid and why, the documentation supporting medical necessity for each billed code, any appeal correspondence, and your self-pay financial agreements — the full chain from what you billed to what you were paid and why. A missing link in that chain is exactly what turns a routine audit into a prolonged one.

Don't assume your EHR or billing software retains this automatically in a form you can retrieve years later; confirm what your clearinghouse and billing vendor actually keep, for how long, and whether you can export it independently of their own retention window.

Denial and appeal correspondence deserves particular care, since it's often the first thing discarded once a claim finally resolves. A denial that was overturned on appeal, with the appeal letter and the payer's reversal both on file, is far stronger evidence of a good-faith billing practice than the paid claim alone — it shows you caught and corrected an error rather than simply resubmitting until something stuck.

If OIG ever asks you to self-disclose, this is the file you'll need

OIG maintains a self-disclosure protocol for providers who discover their own conduct implicating federal health-program fraud laws, and a submission has to quantify the affected claims and calculate the repayment owed — which is impossible to do accurately without the underlying billing records for the period in question 4Ref 4HHS Office of Inspector General (2026).Health Care Fraud Self-Disclosure Protocol.That a self-disclosure submission must quantify affected claims and repayment, which depends on the underlying billing records for that period still existing.. Thin records don't protect you from the disclosure obligation; they just make the disclosure harder to get right.

A practice that finds a billing error is in a materially better position to self-disclose accurately, and often to negotiate a better outcome, when the claims history behind the error is intact rather than partially reconstructed from memory.

Where Stark and AKS documentation rides along with billing paper

Stark applies strict liability to a physician's referrals of designated health services to an entity with which they have a financial relationship, unless a specific exception applies 5Ref 5Centers for Medicare & Medicaid Services (2026).Physician Self-Referral.Stark's strict-liability treatment of physician self-referral arrangements, evaluated using the underlying contract alongside billing records for services rendered under it., and the anti-kickback safe harbors protect arrangements like space rental or personal-services contracts only when their required elements are actually met and documented 6Ref 6Office of the Federal Register (2026).42 CFR 1001.952 — Exceptions (Anti-Kickback Safe Harbors).The anti-kickback safe-harbor elements (space rental, personal-services arrangements) that must be documented and matched against actual billing to hold up as protected.. Both are proven — or disproven — using the underlying contracts alongside the billing records showing what was actually billed under them.

Keep the lease, the services agreement, or the marketing arrangement filed together with the billing records for services rendered under it, not in a separate binder you'd have to reconstruct the connection between years later.

Subpoenas and payer audits reach for exactly this file

HIPAA distinguishes a court order, which authorizes disclosure of only what it specifies, from a bare subpoena without a court order, which requires satisfactory assurances of notice to the patient or a protective order before you can respond 7Ref 7HHS Office for Civil Rights (2026).Court Orders and Subpoenas.The distinction between a court order and a bare subpoena for disclosure purposes, relevant because billing records are a frequent subject of both.. Billing records are a frequent subject of both — in payer disputes, in malpractice litigation, and in fraud investigations alike.

Knowing which kind of request you're holding, and confirming the records it asks for actually still exist, are two separate problems. A retention schedule that discards billing paper too early solves neither one when the request finally arrives.

Payer audits run on their own timeline entirely separate from a subpoena, and a contract's own look-back window can be longer than you'd assume from the claim's original timely-filing deadline — timely filing governs when you can submit a claim, not how long the payer can later ask you to justify one it already paid. Read that specific clause in your provider agreement rather than assuming the two deadlines mirror each other.

Setting your own billing-records retention schedule

Pick the longest of the relevant clocks rather than the shortest: your state's chart-retention rule, your malpractice carrier's recommended tail, and your specific payer contracts' own audit look-back windows, then retain billing paper for at least that long. State-by-state records-retention rules and the carrier's longer clock cover the other two clocks feeding into this comparison.

minors' records typically need to survive longer still, tied to the age-of-majority extension that applies to their clinical records generally, so build that exception into your billing-retention schedule rather than applying one uniform period to every patient. When it's finally time to destroy anything, destruction logs are what prove you disposed of it properly rather than simply losing it.