Write the schedule down: one page that answers every keep-or-shred

Yes — write it down, and here's why

A solo clinician who has never written a retention schedule is not automatically out of compliance — but they are making the same decision fresh every time a box of old charts turns up, and that decision drifts over years without anyone noticing. A written schedule fixes the answer once, in one place, so "can I shred this" becomes a one-line lookup instead of a fresh judgment call made under time pressure, often by whoever happens to be cleaning out a storage closet — the same records-retention question a solo practice would otherwise re-answer from scratch every time it comes up.

The schedule doesn't need to be elaborate. A single page — one row per record category, one column for the trigger event (last date of service, date of hire, tax year), one column for how long to keep it — covers what a solo practice actually needs. What it buys is consistency: the same record type gets the same treatment whether it's reviewed this year or in year seven, and whoever eventually takes over as custodian inherits a rule instead of a mystery.

What belongs on the schedule

A useful schedule covers every category of document the practice actually generates, not just the clinical chart. Missing a category doesn't remove the retention obligation — it just means the practice finds out about it the hard way, usually during an audit or a request.

• Clinical records — the chart itself: notes, treatment plans, correspondence, and any psychotherapy notes kept separately.
• Billing and financial records — claims, remittances, ledgers, and the documentation behind them.
• HR and OSHA records — if the practice has any employees, even part-time; solo practices with no staff at all typically fall outside this category.
• Credentialing files — license verifications, malpractice-history documentation, and the paperwork behind each payer's credentialing decision.
• Tax records — the separate tax retention clock that runs alongside, not instead of, the clinical one.
• Written policies — cancellation policy, telehealth consent, crisis-protocols documentation, and anything else patients sign or the practice operates by, dated and reviewed on a cycle of their own.

Setting the period for each category

Each row needs its own period, because the categories don't share one clock. HIPAA's own documentation-retention rule requires covered entities to keep required documentation — policies, authorizations, the accounting-of-disclosures log — for six years from creation or last effect, whichever is later 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The §164.316 six-year documentation-retention floor that anchors the HIPAA-paperwork row of the schedule.; that is a floor for HIPAA paperwork, not the clinical chart itself. For the clinical record, APA's widely used guideline recommends seven years after the last date of service for adult patients and longer for records of minors, always yielding to whatever the clinician's own state sets as the actual floor 2Ref 2American Psychological Association (2007).Record Keeping Guidelines.The seven-years-after-last-service norm for adult clinical records, longer for minors, always deferring to state law..

Credentialing files run on a different logic entirely: NCQA's standards treat primary-source verifications as aging out after 180 days and require recredentialing at least every 36 months, which is why credentialing paperwork needs refreshing on its own schedule rather than sitting untouched for years 3Ref 3National Committee for Quality Assurance (2026).Credentialing — NCQA.The 180-day verification aging window and 36-month recredentialing cycle that set the refresh period for the credentialing-file row.. HR and OSHA records have a narrower trigger question first — a practice with ten or fewer employees is exempt from routine OSHA injury and illness recordkeeping, though severe-incident reporting still applies, so many solo practices can mark that row "not applicable" rather than guess at a period that was never required 4Ref 4Occupational Safety and Health Administration (2026).Recordkeeping.The exemption for employers with ten or fewer employees from routine OSHA recordkeeping, which decides whether an HR/OSHA row applies at all..

A retention schedule is a compliance-program element, not paperwork for its own sake

The OIG's General Compliance Program Guidance scales the seven elements of an effective compliance program down to practices of any size, and documented policies covering how records are handled sit squarely inside that framework 5Ref 5HHS Office of Inspector General (2023).General Compliance Program Guidance.That documented record-handling policy is one of the seven elements OIG's compliance-program guidance scales to small practices.. A written retention schedule is one of the cheapest ways a solo practice can point to something concrete when the question "do you have a compliance program" comes up — not because a regulator is likely to ask a one-clinician practice that question soon, but because the same document that answers it is also the document that keeps the practice's own record-handling consistent.

That dual purpose is the real argument for writing it down: the schedule isn't produced to satisfy an audit that may never happen. It's produced because the alternative — reconstructing the rule from memory each time — is slower, less consistent, and eventually wrong.

Don't confuse it with your fee schedule

The word "schedule" does double duty in practice management, and it's worth being explicit about which one this is. Your fee schedule is the separate document listing what the practice charges for each service; a retention schedule has nothing to do with rates and everything to do with how long documents are kept and when they're destroyed. Keeping the two clearly labeled and stored apart avoids the confusion of someone reaching for pricing information and finding a destruction timeline instead, or vice versa.

Both are worth having in writing for the same underlying reason — a one-clinician practice has no colleague down the hall to ask, so the answer has to already be on paper.

Keep it current, and hand it to whoever becomes custodian

A retention schedule that was accurate five years ago and hasn't been reviewed since is a liability dressed as a compliance document — state retention rules change, credentialing cycles shift, and a practice that adds its first employee suddenly has an HR row that didn't exist before. Reviewing the schedule annually, or whenever practice circumstances change, keeps it a living answer rather than a stale one.

The schedule also earns its keep at the moment a solo practice most needs a clear answer fast: when a patient's access request arrives, having every category's location and retention status already documented is what lets a practice meet HIPAA's response window instead of scrambling to reconstruct it 6Ref 6HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The 30-day access-request timeline that a documented schedule helps a practice meet without scrambling.. And if the practice ever closes, the schedule is the first document that should go to the records custodian — the records custodian concept only works if the custodian has something concrete to follow, not a verbal understanding of "we usually keep things around seven years or so."