Skip to main content

Record Retention, Destruction & Legal Holds

Duration: 45 min · Level: Advanced · Module: 9. Quality Reporting & Compliance · Focus: retention, destruction, legal-hold, compliance, HIPAA

Health records cannot be kept forever, and they cannot be thrown away whenever a filing cabinet gets full. Federal and state laws each set a minimum period a record must survive, those periods frequently disagree, and on top of all of it a legal hold can freeze everything in place indefinitely. The CEHRS specialist is the person who implements and monitors this machinery — knowing how long to keep a record, how to destroy it when the time comes, and how to prove afterward that it was destroyed correctly. The exam treats retention as a numbers-and-rules domain, so this lesson is about memorizing the right figures and the logic that resolves conflicts between them.

The federal minimums: CMS and HIPAA​

Two federal sources set baseline retention periods, and the exam expects you to keep them separate.

The first is CMS, which requires medical records to be retained for 5 years from the date of service. For a minor, the clock works differently: the record is kept for 5 years after the minor reaches the age of majority. Separately, Medicare cost reports must be retained for 5 years from the date of settlement. Notice the pattern — CMS is built around the number five, but the trigger changes depending on whether you are counting from service, from majority, or from settlement.

The second source is HIPAA, and here is a distinction the exam loves to test: HIPAA's 6-year requirement applies to documentation of policies and procedures — not the medical records themselves. A covered entity must keep its privacy policies, risk analyses, training records, and similar compliance paperwork for six years. If a question asks how long HIPAA requires you to keep patient records, the trap answer is "6 years"; the correct framing is that HIPAA's six-year rule governs the compliance documentation, while the records' retention is driven by CMS and state law.

State law and the longer-requirement rule​

States impose their own retention requirements, and they often exceed the federal minimums. California, for example, requires 7 years for adults and, for minors, retention until age 19 or 7 years from the date of service, whichever fits the rule.

This sets up the single most important operating principle in the lesson: always follow the longer requirement. When federal and state periods conflict, you do not average them, pick the federal one because it is federal, or choose whichever is most convenient — you keep the record for the longer of the two. The memory hook: when retention periods collide, the longest one wins. This rule appears across HIM topics, and the exam rewards candidates who apply it reflexively.

Destroying records the right way​

A record that has outlived its retention period must be destroyed in a manner that prevents reconstruction — destruction is not optional once retention ends, and "prevents reconstruction" is the standard the exam wants. The method depends on the medium:

  • Paper is destroyed by shredding, ideally through a NAID AAA certified vendor — the certification that signals the destruction met industry standards.
  • Electronic records are destroyed by secure overwriting or physical destruction of the media itself.

In every case, the destruction must be documented. That documentation takes the form of a certificate of destruction — a record retained permanently that shows what records were destroyed, when, by whom, and how. The reason it is kept forever is defensive: if someone later requests a record you destroyed, the certificate proves due diligence and shows the disposal followed policy rather than being an attempt to make evidence disappear.

The final concept is the one that trumps every retention schedule. A legal hold suspends routine destruction when litigation is reasonably anticipated. It is issued by legal counsel, and once it is in force, all potentially relevant records are preserved indefinitely for the duration of the hold — even records that would otherwise be eligible for destruction that very day.

The CEHRS role here is immediate and concrete: when a hold is issued, the CEHRS specialist is notified immediately to halt destruction. The exam scenario to watch for is a record that has passed its retention period but is covered by a hold — the correct action is always to preserve it, because the legal hold overrides the schedule. Retention says you may destroy; a legal hold says you must not.

Putting it into practice​

Build a retention reference card and rehearse the conflict-resolution logic until it is automatic.

  1. Write the federal numbers in a column: CMS records = 5 years from service (minor = 5 years after majority); Medicare cost reports = 5 years from settlement; HIPAA policies/procedures = 6 years (not the records).
  2. Add a state example — California: 7 years adult; minor until age 19 or 7 years from service — and write the governing rule beside it in capitals: FOLLOW THE LONGER REQUIREMENT.
  3. Sketch the destruction workflow: paper → shred (NAID AAA vendor); electronic → secure overwrite or physical destruction; both → certificate of destruction kept permanently (what, when, who, how).
  4. Self-test with a trap scenario: a record is past its CMS retention period but a legal hold is in place. State the correct action (preserve indefinitely) and explain why (legal hold overrides the schedule). If you answer instantly, you own this lesson.

Key takeaways​

  • CMS requires medical records for 5 years from date of service (minors: 5 years after reaching majority); Medicare cost reports for 5 years from settlement.
  • HIPAA's 6-year rule covers documentation of policies and procedures, not the medical records themselves — a frequently tested distinction.
  • State laws often exceed federal minimums (e.g., California: 7 years adult, minor until age 19 or 7 years from service); when periods conflict, always follow the longer requirement.
  • Destruction must prevent reconstruction: paper by shredding (NAID AAA certified vendor), electronic by secure overwriting or physical media destruction — and it must be documented.
  • A certificate of destruction (what, when, by whom, how) is kept permanently to prove due diligence if records are later requested.
  • A legal hold, issued by counsel when litigation is reasonably anticipated, suspends all destruction and preserves records indefinitely; CEHRS must halt destruction immediately.

← Previous: C9.1 HEDIS, MIPS & Quality Measure Documentation · Next: C9.3 Clinical Decision Support & Alert Fatigue →

Part of Module 9: Quality Reporting & Compliance.