“Keep It Forever” Is Not a Retention Policy

Ask most owner-doctors how long they keep patient records and the answer is a shrug and a phrase.

“We keep everything.”

It sounds responsible. Nothing gets lost, nothing gets thrown out that a patient might need later, no one has to make a decision.

But everything you keep is something you have to protect. And storage got cheap a long time before the cost of a breach did.

Here are four things to understand about retention before the pile gets any taller.

Forever is a liability, not a safeguard

Every record you hold is data that can be stolen, leaked, or demanded.

A patient from 2009 who hasn’t been back is still a patient whose information you would have to notify in a breach. Twenty years of X-rays on an old server is twenty years of images that need to be encrypted, backed up, and included in your risk assessment.

Retention without limits doesn’t reduce risk. It multiplies the number of people who can be harmed if something goes wrong, and it multiplies the notification letters, the credit monitoring, and the regulatory attention that follow.

Keeping what you need is diligence. Keeping everything is exposure.

What the rules actually expect

HIPAA itself sets a six-year retention requirement for documentation like policies, risk assessments, and agreements. The retention period for the medical or dental records themselves comes from state law, licensing boards, and payer contracts, and it varies.

The specifics are a conversation for your attorney or your state board, not this post. The point that matters here is simpler: the rules define a floor, not a ceiling. Nothing requires you to keep records indefinitely, and nothing rewards you for it.

Once a record passes its required period, keeping it is a choice. It should be a deliberate one.

Old data is breach data

Look at where practice breaches actually happen.

A retired server that was never wiped. A backup drive from a previous system that turned up in a storage closet. A cloud folder of scanned charts from an office move. An email archive going back a decade.

None of that data was in active use. All of it was still in scope. The incident wasn’t caused by the current system doing its job badly. It was caused by data that outlived its purpose and lost its owner.

This is also where AI adds a new wrinkle. Transcripts from scribe tools, chat histories in AI assistants, and drafts saved in cloud services accumulate quietly. If no one set a retention period, the default is usually indefinite.

A retention schedule you can actually follow

The document doesn’t need to be long. It needs to name the categories, set a period for each, and say who acts on it.

A starting point:

• Patient records and images: the period your state and payers require, then secure destruction
• Billing and financial records: the period your accountant and payers require
• Email: a defined window, with anything containing patient information handled by the records rule
• Backups: a defined number of versions and a defined age, then rotation
• AI transcripts and chat histories: the shortest period the tool allows, and never longer than the record they supported
• Retired hardware: wiped or destroyed before it leaves the building, with a certificate

Then put a date on the calendar, quarterly or annually, when someone runs the schedule and records that they did.

The goal is less to protect, not less to lose

A retention policy isn’t about throwing patient history away. It’s about making sure the practice holds what it should, protects all of it, and stops carrying the rest.

The practices that handle this well have a smaller attack surface, a faster answer when someone asks what they hold, and a breach notification list that reflects current patients instead of everyone who ever walked in.

It starts with knowing what you have, deciding what you need, and writing down the difference.

We help practices inventory what they’re storing, draft a retention schedule that fits their state and their payers, and securely retire the data and hardware that no longer belongs. It starts with a 10-minute discovery call.

Call us at 405-253-5101 or schedule a discovery call to get started.