NPP issued-copy retention

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The later date controls the clock

45 CFR 164.520 requires retention of issued notice copies, and 45 CFR 164.530 supplies the six-year rule. A long-lived notice can require retention well beyond six years after creation because the clock also considers when it last was in effect.

Calculate both dates for every version. Record creation or approval date, first effective date, last-in-effect date, supersession, applicable entity and sites, and any legal hold or longer controlling requirement. The scheduled destruction date should follow the later federal anchor plus six years, then extend when another approved rule requires it. Preserve the calculation and reviewer.

Archive the exact issued artifact

Store the final notice content as it appeared in each material issued format, including paper-ready files, web or portal artifacts, translations, accessible versions, and joint notices where applicable. Keep source files, approvals, checksums, effective periods, issuing entities, release evidence, and relationships among variants. Screenshots can supplement the record but may omit searchable text, links, accessibility behavior, or complete pages.

Separate historical artifacts from the public current notice. Use access controls and clear archive labels so staff can retrieve prior terms without accidentally distributing them. Prevent content systems and search engines from presenting retired files as current.

One current file is insufficient

Preserve every issued version that matters, including translated and accessible variants when they form part of the issued notice set. Store approval, effective dates, publication evidence, entity and site scope, supersession, and integrity data. Keep the current public copy separate from the controlled archive.

Create an archive manifest with version, title, language, format, checksum, repository object, entity, effective start and end, source system, owner, retention anchor, legal hold, scheduled destruction, and last integrity test. Make dependencies explicit when one approved source renders several outputs. If a derivative format differs materially, retain it as its own issued artifact.

Test retrieval, integrity, and export

Sample versions from different years, entities, languages, and systems. Verify that a reviewer can retrieve the artifact, confirm its checksum or integrity marker, read its effective period, and link it to release evidence. Test exports before vendor or platform migration. An archive that exists only in an inaccessible legacy system does not provide reliable operational evidence.

Use role-based access, backup, tamper-evident history, and monitored deletion. Correct metadata without overwriting the original record; preserve who changed the index and why. Apply legal holds before scheduled destruction and confirm that an export retains both artifact and context.

Govern destruction carefully

Before deletion, recalculate the later-date rule, check state law, contracts, litigation holds, audits, investigations, and related policy. Use a second reviewer and a precise list of objects. Preserve destruction approval and completion evidence. Do not apply the NPP schedule broadly to medical records, authorizations, or other record classes with different rules.

Example with the later-date rule

A notice was created January 1, 2020 and remained in effect until June 30, 2026. Its HIPAA documentation date is calculated from the later event, June 30, 2026, so the federal retention period runs six years from that date. Other law or contracts may require longer retention.

The archive retains the approved source, English and translated issued copies, web artifact, entity scope, and effective period. In 2032 the owner checks holds and longer requirements before destruction. A pending investigation extends retention, and the schedule records the new basis rather than silently moving the date.

NPP archive checklist

• Record creation, approval, effective, and last-in-effect dates.
• Calculate six years from the later federal anchor.
• Preserve exact issued formats, translations, and accessibility variants.
• Link every artifact to entity, scope, approval, and release evidence.
• Separate historical copies from the public current notice.
• Test integrity, retrieval, export, backup, and legal holds.
• Require reviewed destruction with object-level evidence.

Owner controls

The HHS notice guidance frames the notice duty. Use immutable version identifiers, legal holds, retention schedules, access controls, export tests, deletion approval, and periodic sampling. Never treat the federal six-year rule as a universal medical-record period.

Monitor versions archived, metadata complete, retention calculations reviewed, retrieval tests passed, integrity failures, holds, migrations, and deletion exceptions. Audit from release records into the archive and from archived artifacts back to their effective-period evidence. Keep the archive owner involved in every notice release and platform change.

Record failed retrieval tests as control findings with owners and deadlines.