HIPAA's six-year retention rule applies to your compliance paperwork. It covers policies, procedures, and the records of actions, activities and assessments the rules tell you to document. It does not set a retention period for medical records. That period comes from state law and, for some providers and health plans, from Medicare rules. A Salesforce org that holds patient data needs a schedule that keeps these sources apart. They cover different records, start their clocks at different events, and can differ by decades.
Below, each section is labeled as what the law requires, what HHS guidance recommends, or what Salesforce and our product do. This is general information, not legal advice.
The short answer
| Question | Answer | Where it comes from |
|---|---|---|
| How long must we keep HIPAA policies, procedures and required documentation? | 6 years from creation or from the date it was last in effect, whichever is later | 45 CFR 164.316(b)(2)(i) and 164.530(j)(2) |
| How long must we keep medical records under HIPAA? | HIPAA does not say | HHS FAQ: state laws generally govern |
| How long must a hospital keep medical records? | At least 5 years under Medicare's hospital conditions of participation; often longer under state law | 42 CFR 482.24(b)(1); state statutes |
| Do safeguards apply while we keep PHI? | Yes, for as long as you keep it, including disposal | 45 CFR 164.530(c); HHS FAQ |
What the law requires: HIPAA documentation for six years
The Security Rule documentation standard, 45 CFR 164.316, applies to covered entities and business associates. It covers your security policies and procedures and a written record of any action, activity or assessment the rule requires you to document. The time limit reads "Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later."
The Privacy Rule's administrative requirements, 45 CFR 164.530(j), apply to covered entities. They cover privacy policies and procedures, required written communications, and records of required actions, activities and designations. The period is the same, "six years from the date of its creation or the date when it last was in effect, whichever is later."
The clock matters. A privacy policy adopted in 2019 and replaced in 2026 must be kept until 2032, six years after it was last in effect. Every superseded version of a policy needs its own end date.
What counts as required documentation
Examples that often end up in Salesforce:
- Risk analysis. The Security Rule requires "an accurate and thorough assessment of the potential risks and vulnerabilities" to electronic PHI (45 CFR 164.308(a)(1)(ii)(A)).
- Complaints. A covered entity "must document all complaints received, and their disposition, if any" (164.530(d)(2)).
- Sanctions and training. You must document sanctions applied to workforce members (164.530(e)(2)) and that privacy training was provided (164.530(b)(2)(ii)).
- Access requests. You must document "the designated record sets that are subject to access by individuals" and the titles of the people or offices who process access requests (45 CFR 164.524(e)).
- Accountings of disclosures. You must keep the information an accounting would include and each written accounting you provide (45 CFR 164.528(d)). Patients can ask for disclosures made "in the six years prior to the date on which the accounting is requested", so your disclosure log has to reach back that far.
- Breach decisions. Covered entities must keep documentation sufficient to meet their burden of proof under 45 CFR 164.414(b) (showing that notifications were made, or that an incident was not a breach).
The Security Rule also requires you to "review documentation periodically, and update as needed" (164.316(b)(2)(iii)). Treat your retention schedule as one of these documents.
What HIPAA does not require: a medical record retention period
HHS answers this in a published FAQ, Does the HIPAA Privacy Rule require covered entities to keep patients' medical records for any period of time? HHS's answer starts with "No, the HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained."
The same FAQ adds what HIPAA does require. Covered entities must apply safeguards to medical records and other PHI "for whatever period such information is maintained by a covered entity, including through disposal." That obligation comes from the safeguards standard in 45 CFR 164.530(c).
Two more HIPAA rules touch the end of a record's life:
- Disposal policy. The Security Rule requires policies and procedures "to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored" (45 CFR 164.310(d)(2)(i)). That policy is documentation, so it falls under the six-year rule.
- Business associates. A business associate contract must require the business associate, at termination and if feasible, to "return or destroy all protected health information" it still holds and "retain no copies" (45 CFR 164.504(e)(2)(ii)(J)). If return or destruction is not feasible, the contract's protections must continue for that data.
So if your schedule says "PHI: 6 years (HIPAA)", it has the wrong source for the wrong records. Six years may still be the right number for some records, but the reason will be a state statute or a Medicare rule.
What the law requires: Medicare rules for some providers and plans
Medicare's conditions of participation and contract rules set periods for the organizations they cover.
| Who | Rule | What it says |
|---|---|---|
| Hospitals | 42 CFR 482.24(b)(1) | "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years." |
| Critical access hospitals | 42 CFR 485.638(c) | Records retained "for at least 6 years from date of last entry, and longer if required by State statute, or if the records may be needed in any pending proceeding." |
| Rural health clinics and FQHCs | 42 CFR 491.10(c) | Records retained "for at least 6 years from date of last entry, and longer if required by State statute." |
| Medicare Advantage organizations | 42 CFR 422.504(d) | The organization agrees "to maintain for 10 years books, records, documents, and other evidence of accounting procedures and practices" that meet the listed audit purposes. |
| Part D plan sponsors | 42 CFR 423.505(d) | The sponsor agrees "to maintain, for 10 years, books, records, documents, and other evidence of accounting procedures and practices". |
The Medicare Advantage and Part D rules cover the records CMS needs for audits, which reach beyond clinical charts. If your org runs member services for a plan, some of those records may sit in Salesforce.
What the law requires: state medical record statutes
We checked four states on their legislatures' own sites. These are examples only. Many states set periods in regulations or licensing board rules, which we did not cover.
| State | Who it covers | What the statute says |
|---|---|---|
| Washington | Hospitals | "A hospital shall retain and preserve all medical records for a minimum period of 26 years from the date the record was created." (RCW 70.41.190, as amended in 2025) |
| Texas | Hospitals | A hospital "may authorize the disposal of any medical record on or after the 10th anniversary of the date on which the patient who is the subject of the record was last treated in the hospital." For patients last treated under 18, the later of the 20th birthday or the 10th anniversary. (Health and Safety Code §241.103) |
| New York | Physicians (professional misconduct rules) | "Unless otherwise provided by law, all patient records must be retained for at least six years. Obstetrical records and records of minor patients must be retained for at least six years, and until one year after the minor patient reaches the age of eighteen years." (Education Law §6530(32)) |
| California | Providers licensed under four listed sections, if the licensee ceases operation | Records must be preserved "for a minimum of seven years following discharge of the patient", with longer rules for unemancipated minors. (Health and Safety Code §123145) |
The clocks start at different events. Washington counts from creation, Texas from the last treatment. One "created date" field will not serve both.
Minors get longer periods. Texas, New York and California all extend them, so the schedule needs the patient's date of birth.
Rules change. Washington moved to 26 years in 2025, and the change applies to records hospitals still held on July 27, 2025. A schedule written in 2024 is now short.
What HHS guidance recommends on disposal
This section is guidance, not regulation. In its FAQ on disposal of PHI, HHS says "the Privacy and Security Rules do not require a particular disposal method." Covered entities should assess risk and consider "the form, type, and amount of PHI to be disposed." For electronic media, HHS gives examples of clearing (overwriting), purging (degaussing) and destroying the media. HHS also says workforce members who dispose of PHI, or supervise others who do, must be trained on the disposal policy.
In a Salesforce org, disposal means deletion inside the platform, so the media methods do not map directly. The point that carries over is that you choose the method, write it down, and can show it was followed.
What Salesforce does on its own
These are platform behaviors documented in Salesforce Help. None of them is a retention schedule.
| Feature | What Salesforce documents |
|---|---|
| Recycle Bin | "Deleted items remain in the Recycle Bin for 15 days, and during that time users can restore them." After that, Salesforce schedules permanent deletion and "doesn't guarantee the exact time." (Manage the Recycle Bin) |
| Field History Tracking | Without Field Audit Trail, "Salesforce retains field history data for up to 18 months, and up to 24 months via the API." (Field History Tracking Overview) |
| Field Audit Trail | Lets you "keep field history data indefinitely." By default it "archives data after 18 months in production and after one month in sandboxes, and stores all archived data until you delete it." Available with Salesforce Shield or Field Audit Trail licenses. (Field Audit Trail) |
| Setup Audit Trail | You can download "your org's complete setup history for the past 180 days." "After 180 days, setup entity records are deleted." (Setup Audit Trail) |
Two consequences follow. If you track PHI fields with Field Audit Trail on, their old values stay in the archive until you delete them, whatever the schedule says. And Setup Audit Trail keeps 180 days, so if it is your evidence of security configuration changes, export it on a schedule and file the exports with your HIPAA documentation.
How to build a HIPAA retention schedule in Salesforce
1. Split the org into two record classes
Inventory every object that holds patient or member data, including managed-package and custom objects. Put each object or record type into one of two classes:
- PHI records. Patient and member records, care or claims cases, clinical notes, files. Retention comes from state law, Medicare rules, contracts and your policy.
- HIPAA documentation records. Access requests, disclosure logs, complaints, sanctions, training records, risk assessments, policies and their versions, business associate agreements. Their floor is six years under 164.316 and 164.530(j).
Some records are both. An access-request case holds PHI and documents a required action. Give it the longer period.
2. Write one row per record type
| Record type (example) | Class | Retention driver | Clock starts | End action |
|---|---|---|---|---|
| Hospital patient record (WA) | PHI | RCW 70.41.190 | Record created | Eligible for deletion after 26 years unless on hold |
| Hospital patient record (TX), adult | PHI | HSC §241.103 | Last treatment | Eligible for disposal after 10 years unless in litigation |
| Physician practice record (NY), minor | PHI | Educ. Law §6530(32) | Statute does not say; patient's DOB for the minor test | Keep at least 6 years and until one year after age 18 |
| Access request case | Both | 164.524(e), 164.530(j) and state rule | Later of creation and closure | Keep the longer period |
| Disclosure log entry | Documentation | 164.528, 164.530(j) | Disclosure date | Keep at least 6 years |
| Privacy policy version | Documentation | 164.530(j)(2) | Date it was last in effect | Keep 6 years after it is superseded |
| Deletion log entry | Documentation (our recommendation) | Shows the disposal policy was followed | Deletion date | Keep at least 6 years |
Where more than one rule applies, use the longest and write down why. The schedule is documentation, so keep each version for six years after it is replaced.
3. Build legal hold in before deletion
Texas says a hospital "may not destroy medical records that relate to any matter that is involved in litigation if the hospital knows the litigation has not been finally resolved." The critical access hospital rule extends retention when records "may be needed in any pending proceeding." Your deletion job must check for a hold before it touches a record, and the hold needs an owner, a reason and a start date.
4. Decide what happens to the history
Deleting a record does not clear every copy. Decide whether PHI fields should be tracked at all, and delete archived field history when the record's period ends. Empty the Recycle Bin after scheduled runs so records are not restorable for 15 days. Sandboxes and backups need their own step. What survives a Salesforce delete lists every copy and the order to erase them in.
5. Keep deletion evidence
HIPAA requires a disposal policy. A deletion log shows the policy ran. Log what was deleted or anonymized, which rule applied, when, and by whom. If the log stores field values from deleted records, it contains PHI, so restrict access and give it its own retention period.
6. Review on a calendar
164.316(b)(2)(iii) requires periodic review. Re-check the statutes for each state you operate in at least once a year.
What our product does
Data Retention runs inside your Salesforce org and applies the schedule you define. Each policy names the target object, retention period, jurisdiction and deletion method (hard delete, anonymize or archive). The clock is set per policy, for example creation date, last activity date or a custom date field, and policies can filter by record type. Records under litigation hold are skipped, and each hold records its date, holder and reason. Every deletion is logged with the record ID, object, timestamp, user, rule, field values before deletion and status, and the log exports to PDF or CSV.
Data Retention enforces the periods your compliance team sets from the sources above. Personal Data Discovery can build the object inventory for step 1. For more on HIPAA in Salesforce, see our HIPAA page.
If you would like to see a retention policy run against your own org, book a demo.
Sources
- 45 CFR 164.316, Policies and procedures and documentation requirements (eCFR, current as of 30 October 2026)
- 45 CFR 164.530, Administrative requirements, paragraphs (b), (c), (d), (e) and (j) (eCFR)
- 45 CFR 164.308(a)(1)(ii)(A), Risk analysis (eCFR)
- 45 CFR 164.310(d)(2), Device and media controls (eCFR)
- 45 CFR 164.414, Administrative requirements and burden of proof (eCFR)
- 45 CFR 164.504(e)(2)(ii)(J), Business associate contracts (eCFR)
- 45 CFR 164.524(e) and 164.528, Access and accounting of disclosures (eCFR)
- HHS, FAQ: Does the HIPAA Privacy Rule require covered entities to keep patients' medical records for any period of time? (created 18 February 2009)
- HHS, FAQ: What do the HIPAA Privacy and Security Rules require of covered entities when they dispose of protected health information?
- 42 CFR 482.24, Condition of participation: Medical record services (eCFR)
- 42 CFR 485.638, Conditions of participation: Clinical records (critical access hospitals) (eCFR)
- 42 CFR 491.10, Patient health records (rural health clinics and FQHCs) (eCFR)
- 42 CFR 422.504(d) and 423.505(d), Maintenance of records (Medicare Advantage and Part D) (eCFR)
- Revised Code of Washington 70.41.190 (Washington State Legislature)
- Texas Health and Safety Code §241.103 (Texas Legislature)
- New York Education Law §6530(32) (New York State Senate)
- California Health and Safety Code §123145 (California Legislative Information)
- Salesforce Help: Manage the Recycle Bin in Lightning Experience; Field History Tracking Overview; Field Audit Trail; Monitor Setup Changes with Setup Audit Trail
- Cloud Compliance, Data Retention product page
All sources read on 3 November 2026.
Frequently Asked Questions
No. HHS says the HIPAA Privacy Rule does not include medical record retention requirements and that state laws generally govern how long medical records are kept. The six-year rule in 45 CFR 164.316(b)(2)(i) and 164.530(j)(2) applies to HIPAA documentation: policies, procedures, required written communications, and records of required actions, activities, designations and assessments.
From the date the document was created or the date it was last in effect, whichever is later. A policy adopted in 2019 and replaced in 2026 must be kept until 2032. Each superseded version of a policy has its own end date.
Examples named in the rules include security and privacy policies and procedures, the risk analysis, complaints and their disposition, sanctions applied, training records, the designated record sets subject to access and who handles access requests, accountings of disclosures, and documentation that supports breach notification decisions.
Medicare's hospital conditions of participation (42 CFR 482.24(b)(1)) require at least 5 years. State law often sets a longer period. For example, Washington requires hospitals to keep medical records for at least 26 years from creation, and Texas lets hospitals dispose of adult records on or after the 10th anniversary of the patient's last treatment.
No. Salesforce documents platform behaviors such as a 15-day Recycle Bin, 18 to 24 months of field history without Field Audit Trail, Field Audit Trail archives kept until you delete them, and 180 days of Setup Audit Trail. None of these is a retention schedule. You define the periods and run the deletions yourself or with a retention tool.
Check before you do. Texas law says a hospital may not destroy medical records that relate to litigation it knows has not been finally resolved, and the critical access hospital rule extends retention when records may be needed in a pending proceeding. A deletion job should check for a legal hold before it touches a record.
Related Resources
Salesforce Data Retention Requirements: What the Platform Keeps, and For How Long
Salesforce's native retention windows were designed for operational troubleshooting, not for regulatory evidence. Setup Audit Trail purges after 180 days; Field History Tracking holds 18 months. Regulatory retention mandates routinely run five to seven years. This guide maps the gap precisely and covers the four ways to close it.
What Is a Data Processing Agreement (DPA)?
A Data Processing Agreement is not optional paperwork. GDPR Article 28(3) requires a written contract whenever a processor handles personal data on your behalf, and it specifies eight things that contract must cover. Most DPA reviews check that one exists and skip what it says.
What Is a DPIA (Data Protection Impact Assessment)?
A Data Protection Impact Assessment is a documented risk assessment carried out before high-risk processing begins. GDPR Article 35 makes it mandatory in defined cases, and several of those cases are triggered by things Salesforce teams do routinely, including deploying AI features over customer data.
What Is a Record of Processing Activities (RoPA)?
The Record of Processing Activities is the document a regulator asks for first. Article 30 sets out exactly what it must contain. The under-250-employee exemption sounds broad and turns out to cover almost nobody, because it excludes any processing that is regular rather than occasional.
What Is a Sub-Processor?
Controller, processor, sub-processor is a chain of responsibility, and GDPR Article 28 governs how each link is authorised and contracted. Every vendor that touches personal data on your behalf becomes a link, which is why adding tools has a compliance cost that is separate from their licence fee.
Learn More About Cloud Compliance
Explore our native Salesforce data privacy products.