How long do medical offices need to keep insurance

The HIPAA Privacy Rule requires covered entities to maintain protected health information (PHI) for at least six years from the date the PHI is created or received, unless a longer retention period is required by another law or regulation or unless a shorter retention period is permitted by applicable federal, state, or local law or regulation.