Missouri State University

Record Retention

Applies to the Administrative Requirements of the Health Insurance Portability and Accountability Act of 1996. 45 CFR Section 164.530(j)

Policy

The Employee Benefit Plan has implemented a record retention policy to ensure the required documents are maintained as specified in HIPAA’s Privacy Rules.

Procedure

  • The Employee Benefit Plan retains the required records and documentation for a period of six (6) years from the date it was created or was last in effect, whichever is later.
  • The records or documentation are retained in written or electronic form.
  • The following records or documentation are retained:
    • Signed authorization forms,
    • Copy of the Employee Benefit Plan’s Notice and any subsequent revisions,
    • Business Associate Contracts,
    • Plan Document Amendments,
    • Plan Sponsor Certifications,
    • Adequate Separation Documentation,
    • Any restrictions on uses/disclosure of a participant’s PHI to which the Employee Benefit Plan has agreed,
    • The designated record set to which participants have a right of access,
    • The titles of persons or offices designated as responsible for receiving complaints; requests for access, amendment and an accounting of disclosures; and questions related to privacy concerns,
    • Any written accounting of disclosures provided in response to requests by participants,
    • Privacy policies and procedures and any revisions to them,
    • Privacy training documentation that has been provided to workforce members,
    • Sanctions that have been applied related to privacy violations, and
    • All participant complaints received including disposition.

Effective Date: April 14, 2003