Record Retention

Op10.03-7 Record Retention

Applies to the Administrative Requirements of the Health Insurance Portability and Accountability Act of 1996. 45 CFR Section 164.530(j)


The Employee Benefit Plan has implemented a record retention policy to ensure the required documents are maintained as specified in HIPAA’s Privacy Rules.


  • The Employee Benefit Plan retains the required records and documentation for a period of six (6) years from the date it was created or was last in effect, whichever is later.
  • The records or documentation are retained in written or electronic form.
  • The following records or documentation are retained:
    • Signed authorization forms,
    • Copy of the Employee Benefit Plan’s Notice and any subsequent revisions,
    • Business Associate Contracts,
    • Plan Document Amendments,
    • Plan Sponsor Certifications,
    • Adequate Separation Documentation,
    • Any restrictions on uses/disclosure of a participant’s PHI to which the Employee Benefit Plan has agreed,
    • The designated record set to which participants have a right of access,
    • The titles of persons or offices designated as responsible for receiving complaints; requests for access, amendment and an accounting of disclosures; and questions related to privacy concerns,
    • Any written accounting of disclosures provided in response to requests by participants,
    • Privacy policies and procedures and any revisions to them,
    • Privacy training documentation that has been provided to workforce members,
    • Sanctions that have been applied related to privacy violations, and
    • All participant complaints received including disposition.

Effective Date: April 14, 2003