Data retention and destruction policy

Covers Washington and Rhode Island. Delete the state you're not licensed in, and verify the current citations for your license type before adopting, since rules are amended. Licensed in both? Apply the longer period (for adults, both are 7 years).

Practice: [Practice Name] Effective: [Date] Last reviewed: [Date] Reviewed by: [Your Name], Privacy & Security Officer Review cadence: Annual, and on any material change in state or federal law

Purpose

Sets how long client health records, HIPAA documentation, and administrative records are kept, where they're stored, and how they're destroyed, in line with:

HIPAA documentation retention (45 CFR §164.316(b)(2)): at least 6 years from creation or last effective date.
Washington: the Uniform Health Care Information Act (RCW 70.02) and the counselor record-keeping requirements for your credential (RCW 18.225 / WAC 246-809): at least 7 years for clinical records. [Verify and cite the exact section for your credential.]
Rhode Island: the RI Department of Health (DOH)'s published standard of at least 7 years from the most recent patient encounter (health.ri.gov). R.I. Gen. Laws § 5-37.3 (Confidentiality of Health Care Communications) governs disclosure, not retention, and the counselor licensing regulations (216-RICR-40-05-11) set no counselor-specific period, so the general DOH standard applies. [Verify.]
Where requirements differ, the longest applicable period applies.

Scope

All client protected health information (PHI) and practice records, electronic or physical. The practice is out-of-network with no insurance billing, so payer-contract retention requirements don't apply.

Retention periods

Clinical records

Adults: all clinical records (intake, assessments, treatment plans, notes, signed consents, releases of information, termination summaries, secure messages, and billing tied to clinical service) for at least 7 years from the last session.

Minors (under 18 at time of treatment): the longer of 7 years after the client turns 18 or [10] years after the last session. [Verify.]

Administrative and billing records

7 years from date of service or transaction: invoices, superbills, payment records, late-cancel records, and billing correspondence.

HIPAA documentation

At least 6 years from creation or last effective date: policies (all versions), risk analyses, notices of privacy practices and disclosure statements (all versions), business associate agreements (BAAs), the Process Log, breach assessments, and device disposal records.

Practical rule: keep both clinical and HIPAA records at least 7 years as a single standard, extended for minors.

Tax and business records

Business formation documents, the employer identification number (EIN) letter, and the operating agreement: life of the business. Tax records: 7 years from filing. These contain no PHI and are kept separately.

Storage

Electronic

Clinical electronic PHI (ePHI) lives in [electronic health record (EHR) system], a Business Associate under BAA.
Administrative records that may reference clients live in [BAA-covered email/drive].
No PHI on local devices or in non-BAA cloud storage.
Devices that access ePHI: passcode/biometric, auto-lock ≤ 5 minutes, disk encryption, and multi-factor authentication (MFA) on cloud services.

Paper

[The practice is fully paperless.] If paper PHI is ever created (handwritten notes, faxed records):

Transcribe into the EHR promptly.
Keep the original in a locked cabinet until destroyed.
Cross-cut shred once transcription is verified.
Log creation and destruction in the Process Log.

Backups

Clinical records are backed up by the EHR vendor under its BAA and service agreement.
Administrative records are backed up by the email/drive provider.
No independent local backups of PHI, deliberately: a local backup is one more place PHI lives that needs safeguards, and vendor redundancy is sufficient for a solo practice.

Destruction

Electronic

EHR: delete expired records using the EHR's record-deletion workflow. Destruction mechanics are governed by the vendor's BAA.
Email/drive: delete, then empty trash.
Local devices: delete any downloaded PHI document and empty the trash. Consider automatic trash emptying (on Mac: System Settings → General → Storage → "Remove items from the Trash after 30 days").
Device disposal: factory erase before selling, recycling, or giving away (on Apple devices, "Erase All Content and Settings," which destroys the encryption key). Log date, device, serial number, and method.

Paper

Cross-cut shred (P-3 or higher), or use a certified destruction service that issues a certificate. Log it.

Destruction log

Kept in the Process Log: date, record type and date range, approximate count, method, and verification ("trash emptied," "certificate received"). Retained with the rest of the HIPAA documentation.

Notification

Clients are not notified of routine destruction at end of retention. Destruction outside normal timelines (breach, device loss, disaster) follows the breach procedure.

Exceptions

Records are kept past the retention period when:

subject to a legal matter, subpoena, audit, or licensing complaint (legal hold);
a client has an open request for access or amendment;
the practice is on notice of a potential claim;
a client has asked in writing for longer retention.

Otherwise, records are not kept past the minimum without a documented reason.

Responsibilities

The Privacy and Security Officer reviews records reaching end of retention annually, destroys them per this policy, logs destruction, and reviews this policy annually.

Template shared in the Private Practice Toolkit. Not legal, tax, clinical, or compliance advice. Confirm current retention rules in your state for your credential.