HIPAA Record Retention: How Long Must Medical Offices Keep Insurance Information?

The HIPAA Privacy Rule requires covered entities to maintain protected health information (PHI) for at least six years from the date the PHI is created or received, unless a longer retention period is required by another law or regulation or unless a shorter retention period is permitted by applicable federal, state, or local law or regulation.