HIPAA's Security Rule requires covered entities and business associates to keep required policies, procedures and records of required actions, activities and assessments for six years from the date of creation or the date last in effect, whichever is later. That is a documentation rule, not a rule for patient charts or raw system logs.
What the text requires
Section 164.316 has two standards. The first, policies and procedures, requires reasonable and appropriate written policies to comply with the Security Rule. You may change them at any time, provided the changes are documented and implemented.
The second, documentation, requires you to keep policies and procedures in written form, which may be electronic. If the rule requires an action, activity or assessment to be documented, you must keep a written record of it. Three required specifications follow:
- Time limit: retain the documentation for six years from creation or last effective date, whichever is later.
- Availability: make it available to the people responsible for the procedures it covers.
- Updates: review it periodically and update it in response to environmental or operational changes.
What falls inside the six years
In practice that covers the artifacts a Security Rule review looks for:
- Security policies and procedures, including superseded versions.
- Risk analyses and risk management decisions.
- Decisions on addressable specifications and the alternatives chosen.
- Incident response records and outcomes.
- Records of information system activity reviews.
- Training records and sanction actions.
- Business associate agreements and contingency plan tests.
The retention clock starts at the later of creation or the last date the document was in effect. A policy replaced in 2026 stays on file until six years after it stopped applying.
What the rule does not say
Be careful not to over read the text:
- It does not set a retention period for medical records. Those are governed by state law and other rules, which vary.
- It does not set a period for raw audit logs. Choose one based on risk and cost, and keep the records of your review for the full six years. See audit controls and log review.
- Other parts of HIPAA, such as the Privacy Rule, have their own documentation provisions. Check them separately.
A practical retention setup
- Keep documents in a system with version history, so past versions are retrievable.
- Record the effective start and end date on each policy, so the six year point is easy to compute.
- Do not auto delete security records on a short cycle. Set the minimum on the longest applicable rule.
- Make sure departing staff do not take the only copy.
- Store evidence for required actions where an auditor can find it, ideally linked to the requirement it supports.
Automating evidence collection reduces the risk that a record is lost when a person leaves. Safeguard offers compliance and evidence automation for this kind of record keeping, and you can run a free scan of a repository at https://gold.safeguard.sh/scan to see what dependencies are in your codebase.
Quick check
Does six years apply to patient medical records?
Not under this section. It covers Security Rule documentation. Medical record retention depends on state law and other requirements.
When does the six years start?
From the date of creation or the date the document last was in effect, whichever is later.
Sources
Last reviewed: 19 October 2026.
