45 CFR 164.316(b)(2)(i) (HIPAA Security Rule): documentation retained for 6 years (45 CFR 164.316(b)(2)(i))
An industry rule on top of the general ones: a company covered by HIPAA keeps its security policies and the records of actions taken under them for 6 years.
Dated 31 Oct 2026Source checked 31 Oct 2026Basis: primary text
Selling a company's data? This is one of the rules a sale has to meet, and the guide beside the button reads it in plain words.
- No data upload
- About two minutes
- No email needed
In the source's own words
“(i) Time limit (Required). Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide