Record retention schedule

A retention schedule governs the full lifecycle

A schedule operationalizes retention across creation, classification, correction, active use, archive, access, holds, migration, vendor exit, disposition approval, secure destruction, and evidence.

The CASP Organizational Guidelines public overview describes public recommendations across business, clinical, and risk-management operations. CASP sells the full guidelines. This article uses only that public frame and does not claim a universal retention period.

Map clinical, authorization and billing, incident, privacy and security, workforce, credentialing, payroll and tax, governance and finance, contract, insurance, facility, and vendor records as distinct classes when their sources, triggers, or safeguards differ.

HIPAA has several different retention concepts

HHS states that the HIPAA Privacy Rule does not set a general medical-record retention period; state law generally governs that question. HIPAA safeguards still protect medical records and other protected health information for as long as a covered entity maintains them, including during disposal.

That point should be kept separate from HIPAA documentation duties. The HHS OCR audit protocol reproduces the Privacy Rule requirement to retain specified documentation for six years from creation or the date last in effect, whichever is later. It also reproduces the parallel Security Rule time limit for documentation required by that rule. These six-year provisions cover defined Privacy and Security Rule documentation, not every clinical record merely because the record contains PHI.

State medical-record, professional or facility, minor-record, Medicaid or commercial payer, employment, tax, research, litigation, insurance, and business sources may use other scopes, periods, and triggers.

Official examples show why one “business records” clock fails. A CMS fact sheet gives seven years from date of service for records within 42 CFR 424.516(f). The EEOC generally gives covered personnel records one year and preserves relevant charge records through final disposition. DOL Fact Sheet 21 gives covered payroll records three years and wage-computation records two. The IRS gives employment-tax records at least four years after the tax becomes due or is paid, whichever is later. None is a universal ABA-practice period. Verify jurisdiction, coverage, payer and product, role, record class, trigger, contract, effective date, and holds.

Minimum schedule fields

Define each trigger precisely. “Keep seven years” is incomplete without saying seven years from what event, for which record, under which version of which source, and how minors, appeals, audits, or amended records affect the calculation.

Holds suspend ordinary disposition

A hold suspends routine disposition only for records within its defined scope. In federal civil litigation, Rule 37(e) addresses electronically stored information that should have been preserved in anticipation or conduct of litigation and was lost because reasonable steps were not taken. It is a remedies rule for lost ESI, not a universal hold schedule.

Counsel should define the trigger and scope for litigation holds under the governing matter and forum. The schedule should separately name the authorized owner and controlling source for payer, tax, employment, insurance, complaint, incident, audit, or investigation holds. Custodians and system owners then preserve in-scope records, monitor the hold, and wait for written release. Routine disposition continues only outside that scope; “the longest visible period wins” is not a safe universal rule.

For Medicare review, the CMS Program Integrity Manual says amendments, corrections, and delayed entries must be clearly and permanently identified, with the date and author identifiable. That payer rule is not a universal template. For each record class, apply its controlling correction rule and preserve an audit trail rather than silently replacing an original.

Backups and vendors belong in the schedule

An archive supports retrieval; a backup supports recovery. Map authoritative systems, replicas, exports, analytics, email, devices, paper, vendors, and backup rotation. Test how an approved disposition decision reaches each copy and how restoration avoids reintroducing disposed records.

Vendor contracts should map export, subcontractors, holds, termination access, deletion verification, and incidents. For a HIPAA business-associate contract, 45 CFR 164.504(e)(2)(ii)(J) requires the contract to address PHI at termination. If feasible, the business associate must return or destroy all PHI it still maintains in any form and retain no copies. If return or destruction is infeasible, contractual protections continue and further uses and disclosures are limited to the reason it is infeasible. A dashboard deletion alone does not prove disposition.

HHS disposal guidance requires covered entities to use reasonable safeguards for PHI disposal and final-disposition policies for ePHI and its media; it does not mandate one method. Select a method appropriate to the circumstances and train relevant workforce members.

For BCBA and BCaBA certificants and applicants, the BACB Ethics Code covers confidentiality; storing, transporting, retaining, and destroying documentation; billing and reporting corrections; documentation of professional activity; and continuity. It directs behavior analysts to applicable law, regulation, contract, funder, and organization requirements. It sets no organization-wide period, and BACB has no separate jurisdiction over organizations or corporations.

A fictional schedule calculation

A fictional HIPAA covered practice created a required Privacy Rule policy on July 1, 2020. Its replacement became effective October 1, 2025, so the old version was last in effect September 30, 2025. The later trigger is September 30, 2025; six years runs through September 30, 2031. Absent another rule or hold, the old version first becomes eligible for disposition October 1, 2031. Keep the source, versions, calculation, and owner linked.

The practice identifies 240 destruction candidates. Its eligibility check clears 230 and excludes 10 on a payer-audit hold. Report 230 of 240 eligible, or 95.8%, and 10 of 240 held, or 4.2%. “Eligible” is not “destroyed”: use a separate destruction-completion denominator of records approved for disposition and require evidence by record class, batch, method, system or vendor, date, and approver.

Useful measures include records with a verified rule, overdue source reviews, unidentified copies, hold acknowledgment, access-request retrieval, disposition failures, vendor deletion confirmation, and restored-record integrity. For each metric, define its numerator, denominator, exclusions, period, owner, and evidence; report N/A when no record qualifies.