Record retention schedule
A record retention schedule is a written policy that lists each type of record a practice holds and states how long it is kept and when it is destroyed. It turns the several overlapping retention rules that apply to medical and billing records — state law, Medicare and Medicaid requirements, payer contracts, and claim-review windows — into a single instruction staff can follow, setting each record type's period to the longest authority that reaches it and specifying secure disposal at the end.
Updated
A record retention schedule is a practice's written plan for how long it keeps each kind of record and when that record is destroyed. It names the record types the practice holds — clinical records, billing and claim records, remittances, signed authorizations, the HIPAA compliance file, and any specially protected categories — and assigns each a retention period and a disposal trigger.
Its purpose is to resolve, once and in advance, a question that otherwise has to be re-decided every time: several authorities set retention floors and they do not agree, so the schedule fixes each record type's period at the longest applicable one and records it, rather than leaving a staff member to reason through the rules at the moment of disposal.
In practice
A schedule is built by inventorying the record types, finding every authority that applies to each (the state medical-record statute, Medicare's seven-year documentation rule at 42 CFR 424.516(f) for practices that bill Medicare, the state Medicaid period under 42 CFR 431.107, the terms of each payer contract, and the overpayment and False Claims Act windows in which a claim can still be reopened), and setting the period to the longest of them. The specific state and payer figures are confirmed from the source — the statute, the state Medicaid manual, the actual agreement — not from a general reference.
The schedule does not end at retention. Because HIPAA requires protected health information to be safeguarded for as long as it is held and destroyed securely, the schedule specifies a disposal method that renders information unreadable and a destruction log that records what was destroyed and when.
Commonly confused with
- HIPAA six-year documentation retention: HIPAA's six-year rule (45 CFR 164.316, 164.530(j)) applies to compliance documentation — policies, procedures, notices, authorizations, and risk analyses — not to the clinical record. A retention schedule covers both, but the clinical record's period comes from state law and program rules, not from HIPAA's six-year clock.
- Statute of limitations / lookback period: A limitations or lookback period (the six-year overpayment window at 42 CFR 401.305, the False Claims Act's ten-year outer limit at 31 U.S.C. 3731) sets how long a claim can be challenged, not how long a record must be kept. A retention schedule uses those windows as a floor — a record should outlive the period in which the claim it supports can be reopened — but the schedule itself is the retention instruction.