# Data retention and destruction policy > **Covers Washington and Rhode Island.** Delete the state you're not licensed in, and **verify the current citations for your license type** before adopting, since rules are amended. Licensed in both? Apply the longer period (for adults, both are 7 years). **Practice:** [Practice Name] **Effective:** [Date] **Last reviewed:** [Date] **Reviewed by:** [Your Name], Privacy & Security Officer **Review cadence:** Annual, and on any material change in state or federal law --- ## Purpose Sets how long client health records, HIPAA documentation, and administrative records are kept, where they're stored, and how they're destroyed, in line with: - **HIPAA** documentation retention (45 CFR §164.316(b)(2)): at least 6 years from creation or last effective date. - **Washington:** the Uniform Health Care Information Act (RCW 70.02) and the counselor record-keeping requirements for your credential (RCW 18.225 / WAC 246-809): at least **7 years** for clinical records. [Verify and cite the exact section for your credential.] - **Rhode Island:** the RI Department of Health (DOH)'s published standard of at least **7 years** from the most recent patient encounter (health.ri.gov). R.I. Gen. Laws § 5-37.3 (Confidentiality of Health Care Communications) governs *disclosure*, not retention, and the counselor licensing regulations (216-RICR-40-05-11) set no counselor-specific period, so the general DOH standard applies. [Verify.] - **Where requirements differ, the longest applicable period applies.** ## Scope All client protected health information (PHI) and practice records, electronic or physical. The practice is out-of-network with no insurance billing, so payer-contract retention requirements don't apply. --- ## Retention periods ### Clinical records **Adults:** all clinical records (intake, assessments, treatment plans, notes, signed consents, releases of information, termination summaries, secure messages, and billing tied to clinical service) for at least **7 years from the last session**. **Minors (under 18 at time of treatment):** the longer of **7 years after the client turns 18** or **[10] years after the last session**. [Verify.] ### Administrative and billing records **7 years** from date of service or transaction: invoices, superbills, payment records, late-cancel records, and billing correspondence. ### HIPAA documentation At least **6 years** from creation or last effective date: policies (all versions), risk analyses, notices of privacy practices and disclosure statements (all versions), business associate agreements (BAAs), the Process Log, breach assessments, and device disposal records. **Practical rule:** keep both clinical and HIPAA records **at least 7 years** as a single standard, extended for minors. ### Tax and business records Business formation documents, the employer identification number (EIN) letter, and the operating agreement: life of the business. Tax records: **7 years** from filing. These contain no PHI and are kept separately. --- ## Storage ### Electronic - Clinical electronic PHI (ePHI) lives in **[electronic health record (EHR) system]**, a Business Associate under BAA. - Administrative records that may reference clients live in **[BAA-covered email/drive]**. - **No PHI on local devices or in non-BAA cloud storage.** - Devices that access ePHI: passcode/biometric, auto-lock ≤ 5 minutes, disk encryption, and multi-factor authentication (MFA) on cloud services. ### Paper [The practice is fully paperless.] If paper PHI is ever created (handwritten notes, faxed records): - Transcribe into the EHR promptly. - Keep the original in a locked cabinet until destroyed. - Cross-cut shred once transcription is verified. - Log creation and destruction in the Process Log. ### Backups - Clinical records are backed up by the EHR vendor under its BAA and service agreement. - Administrative records are backed up by the email/drive provider. - **No independent local backups of PHI,** deliberately: a local backup is one more place PHI lives that needs safeguards, and vendor redundancy is sufficient for a solo practice. --- ## Destruction ### Electronic - **EHR:** delete expired records using the EHR's record-deletion workflow. Destruction mechanics are governed by the vendor's BAA. - **Email/drive:** delete, then empty trash. - **Local devices:** delete any downloaded PHI document and empty the trash. Consider automatic trash emptying (on Mac: System Settings → General → Storage → "Remove items from the Trash after 30 days"). - **Device disposal:** factory erase before selling, recycling, or giving away (on Apple devices, "Erase All Content and Settings," which destroys the encryption key). Log date, device, serial number, and method. ### Paper Cross-cut shred (P-3 or higher), or use a certified destruction service that issues a certificate. Log it. ### Destruction log Kept in the Process Log: date, record type and date range, approximate count, method, and verification ("trash emptied," "certificate received"). Retained with the rest of the HIPAA documentation. --- ## Notification Clients are not notified of routine destruction at end of retention. Destruction outside normal timelines (breach, device loss, disaster) follows the breach procedure. ## Exceptions Records are kept past the retention period when: - subject to a legal matter, subpoena, audit, or licensing complaint (legal hold); - a client has an open request for access or amendment; - the practice is on notice of a potential claim; - a client has asked in writing for longer retention. Otherwise, records are **not** kept past the minimum without a documented reason. ## Responsibilities The Privacy and Security Officer reviews records reaching end of retention annually, destroys them per this policy, logs destruction, and reviews this policy annually. --- *Template shared in the Private Practice Toolkit. Not legal, tax, clinical, or compliance advice. Confirm current retention rules in your state for your credential.*