HIPAA Privacy Rule 164.530j: Documentation and record retention (six years)

A covered entity must maintain the policies and procedures, communications, actions, activities and designations required to be documented under the Privacy Rule in written or electronic form, and retain them for six years from the date of creation or the date it last was in effect, whichever is later, per 164.530(j).