HIPAA's six years covers policies — charts follow state law

Is the HIPAA six year rule about medical records?

No. The six-year figure most solo practices have heard comes from 45 CFR 164.316, and it governs your Privacy and Security Rule documentation — written policies and procedures, risk analyses, training records, and similar compliance artifacts — not the clinical chart 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The §164.316 documentation-retention rule requiring six years for Privacy and Security Rule policies, procedures, and related compliance records.. It runs from whichever is later: the date the document was created, or the date it was last in effect.

The clinical record itself is a separate question entirely, governed by your state's medical-records statute or your licensing board's rule, not by HIPAA. Confusing the two is the single most common retention mistake a solo practice makes.

What §164.316 actually requires you to keep for six years

The documentation clock covers the paper trail of your compliance program: your written Privacy and Security Rule policies and procedures, business associate agreements, risk analyses and their remediation plans, workforce training records, sanction records, and any documentation the rules require you to create. OCR's professional hub for the Privacy, Security, Breach Notification, and Enforcement Rules is the reference point for what falls under each rule's own documentation duty 2Ref 2HHS Office for Civil Rights (2026).HIPAA for Professionals.The OCR hub organizing the Privacy, Security, Breach Notification, and Enforcement Rules and each rule's documentation duties..

Think of this as evidence that your compliance program exists and functions, separate from evidence of what happened in a patient's care. An auditor asking for your six-year documentation is asking a different question than a court asking for a ten-year-old chart.

A practical habit: date-stamp every policy document when you write it and again whenever you revise it, so the six-year clock has an unambiguous start point. A policy nobody dated is a policy nobody can prove was ever current, which defeats the purpose of keeping it in the first place.

Where the confusion comes from

Six years is the most quoted number in HIPAA, so it gets pulled into conversations it was never meant to answer. A colleague says "HIPAA requires six years" in the context of a chart, and the number sticks even though the source regulation was talking about something else. The retention question a solo practice actually needs answered — how long to keep a patient's medical record — has no federal floor at all; HIPAA is silent on it.

That silence is filled entirely by state law, licensing board rules, and professional-body guidance, which is why the real answer to "how long" always starts with "which state."

Your clinical record retention clock is set by your state

Once you're past the documentation question, retention for the actual chart is a state-law question with no single national number. As a professional-body reference point, not a legal requirement, the American Psychological Association's record-keeping guidelines use seven years after the last date of service for an adult as a common example, longer for a minor, and explicitly defer to whatever the clinician's state requires 3Ref 3American Psychological Association (2007).Record Keeping Guidelines.The illustrative professional-body retention example of seven years after last service for adults, longer for minors, deferring to state law.. Treat that as an illustration of the norm, not as your state's rule.

Build your actual schedule from your board's regulation or your state's medical-records statute, not from a number you heard once. A retention period copied from a colleague licensed in a different state is not a compliance plan.

If you hold more than one license or see patients across state lines, the longest applicable period is the safe default — running separate schedules per state for the same practice invites the exact mix-up this article is trying to prevent.

Minors, personal representatives, and the longer clock

A minor's record typically has to survive longer than an adult's, because most states measure the clock from the age of majority rather than from the last date of service — meaning the retention period effectively includes the years of childhood plus whatever period follows adulthood. HIPAA itself defers to state law on who controls a minor's record and treats the personal representative as standing in the individual's shoes for access purposes, with narrow exceptions 4Ref 4HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who controls a minor's records and treats the personal representative as the individual for access purposes..

Because the personal representative question and the retention-length question are both state-controlled, verify both together rather than assuming your general adult retention period covers a pediatric or adolescent chart.

Enforcement reality: OCR checks documentation, not just charts

The civil-money-penalty framework that backs HIPAA enforcement sits in 45 CFR Part 160's general administrative provisions, and OCR uses it against practices of every size, including small ones, through complaint investigations, compliance reviews, and resolution agreements 5Ref 5Office of the Federal Register (2026).45 CFR Part 160 — General Administrative Requirements.The civil-money-penalty framework underlying HIPAA enforcement against covered entities of any size.. When OCR opens an inquiry, the documentation clock is often what gets tested first — can you produce the risk analysis, the policies, the training log — because that evidence is what shows a functioning program rather than one that exists only on paper after the fact 6Ref 6HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR enforces through complaint investigation, compliance reviews, and resolution agreements, including against very small practices, often testing documentation first..

When the subpoena arrives instead of a routine inquiry, the same split still applies: you produce what you were required to keep, on whichever clock governs that particular document, under legal compulsion rather than a request.

A retention map for a practice of one

Keep two separate lists rather than one blended retention policy. On the six-year HIPAA documentation clock: policies and procedures, risk analyses, BAAs, training and sanction records, breach-related documentation. On your state's clinical-record clock: the chart itself, typically far longer and sometimes tied to a patient's age rather than a fixed date. A third, shorter clock governs the right of access — a patient's records request gets a response within 30 days regardless of which retention period the underlying document sits on 7Ref 7HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The 30-day right-of-access response clock, a separate timeline from either the six-year documentation clock or a state's clinical-record retention period..

Write the two schedules down as a single page you can hand to anyone helping with retention or disposal, including what to shred and when, so the decision doesn't depend on remembering which six years belongs to which clock.

Review both lists once a year, not only when something forces the question. A retention map that was accurate two moves and one EHR migration ago is not a retention map anymore — it's a guess with a date on it.