HIPAA Data Retention & Backup [Requirements & Compliance]

How long should you retain medical records? It can vary and, while there are no set HIPAA requirements for HIPAA data retention, there are policies you must follow.

For example, while email archiving is not required by HIPAA’s Security Rule, healthcare providers still need to keep communications, including emails, that contain protected health information (PHI) for a minimum of six years, during which time those records cannot be altered or deleted.

What Is HIPAA and the Privacy Rule?

The Health Insurance Portability and Accountability Act (HIPAA) covers patient information accountability across various healthcare providers and insurance companies. The letter of the law organizes HIPAA and regulations contained therein into three distinct rules:

1. The Privacy Rule, which defines PHI and the responsibilities Covered Entities (CEs) and Business Associates (BAs) have in controlling secure content access.
2. The Security Rule outlines the minimum effective security measures that CEs and BAs have when securing data, including physical, administrative, and technical safeguards.
3. The Breach Notification Rule, which dictates how a CE or BA must notify affected patients and the public more broadly in the event of a data breach.

In terms of protecting medical record storage and data retention, CEs and BAs must adhere to both the Privacy and Security Rules. The Privacy Rule, however, specifically details the requirements for both retaining and destroying PHI.

It is important to note that the time periods specified in the Privacy Rule only address non-medical records (emails, communications, and so on). Instead, medical record retention is outlined by individual states.

Who Can Access Information Under HIPAA?

It is important to note that HIPAA applies not only to healthcare providers and insurance companies, but also to other entities that may handle PHI. Generally speaking, any healthcare provider, including hospitals, doctors, dentists, and pharmacies, is considered a covered entity under HIPAA and is allowed to access PHI to carry out treatment, payment, and other healthcare operations.

In addition to healthcare providers, health plans, including health insurance companies, HMOs, and employers providing self-insured health coverage, are also considered covered entities and have access to PHI. Other entities included in HIPAA are healthcare clearinghouses, business associates of covered entities, and state and federal agencies under certain circumstances.

Patients also have access to their own PHI, and may authorize another person to access their records. In certain cases, family members and friends can also access PHI with the patient’s permission. Finally, authorized public health officials can also access PHI when necessary to control the spread of communicable diseases.

HIPAA File Storage Under the HIPAA Privacy Rule

HIPAA File Storage is the secure storage of PHI in an electronic or physical medium, according to the HIPAA Privacy Rule. This includes the safekeeping of patient medical records, employee health records, billing information, and other healthcare information. PHI must be safeguarded against unauthorized access.

When deciding on a method to store PHI, it is important to consider both the security measures needed to protect the data, as well as the cost of implementing and maintaining the necessary technology. Organizations should implement security measures that protect against both intentional and unintentional access, use, or disclosure of PHI. Depending on the type of data that is being stored and the potential risks it may pose, organizations should consider encryption and other security measures, such as firewalls, access control measures, and other authentication methods, to prevent unauthorized access.

Organizations should also identify where PHI should be stored and how it should be protected. PHI should be stored on systems that have been tested for HIPAA compliance and are consistently monitored for security updates. Organizations should also have a well-defined procedure for data backup, data retention, and data destruction.

Organizations should thoroughly evaluate available file storage solutions to ensure they meet the organization’s specific needs. Choosing an appropriate solution is an important step in ensuring the security of PHI and the organization’s compliance with HIPAA regulations.

Keep Your Cloud Storage and Backup HIPAA Compliant

If you are dealing with sensitive medical data, it’s crucial to ensure that your cloud storage complies with HIPAA regulations. Failing to do so can lead to severe consequences, including hefty penalties and fines, litigation, and reputational damage. Therefore, it’s paramount to work with a cloud storage provider (CSP) that offers HIPAA-compliant solutions. This means that the provider uses specific security measures to safeguard PHI and other sensitive content, such as encryption, access controls, and audit logs. Furthermore, the provider should sign a Business Associate Agreement (BAA) with you, which outlines their responsibilities regarding data protection in the context of HIPAA compliance. By choosing a HIPAA-compliant cloud storage solution, you can ensure that your data is safe and your business stays compliant with all relevant regulations.

Adopting a cloud backup solution that adheres to HIPAA requirements for data retention and backup not only helps healthcare providers demonstrate HIPAA compliance, but also enhances their data security posture and peace of mind.

What Are the HIPAA Data Retention Requirements for Covered Entities?

Under HIPAA regulations, CEs and BAs must retain medical records for a period of no fewer than six years from the date of creation or the last effective date, whichever is later.

This regulatory standard only applies to specific documents, including:

1. The written or electronic record that designates the organization either a CE or a BA.
2. All documentation of security and privacy procedures that demonstrate HIPAA compliance.
3. HIPAA-required assessment documentation.
4. Data use agreements and other forms required by HIPAA compliance.
5. Signed authorizations provided by patients allowing CEs or BAs to disclose PHI or documentation of efforts to receive those authorizations.
6. Notice of Privacy Practices.
7. Medical and billing records for patients.
8. Documentation of HIPAA compliance officers and any other individuals in the organization responsible for maintaining compliance. This includes names, titles, and contact information.
9. Accounting of any disclosures of any PHI.

Note individual states have their own retention laws that preempt HIPAA.

These data retention requirements are the same for both Covered Entities and Business Associates. Security standards for the storage of data under HIPAA are still the same for long-term data storage, so check with your provider or IT staff to determine your HIPAA compliance.

While online backup isn’t required under HIPAA, HITECH encourages it.

Is There a Difference Between a HIPAA Data Backup Plan and a Disaster Recovery Plan?

Yes. A HIPAA Data Backup Plan is focused on backing up PHI for long-term storage and access. This plan outlines how data is backed up, the media used for storage, and where the backups will be stored. The plan should also include information about when backups will be performed, who will verify the backups, and how to restore data in the event of a system failure or data loss.

A Disaster Recovery Plan, on the other hand, is a plan for responding to and recovering from an emergency or disaster event. This plan outlines the steps to be taken to restore normal operations, including how to get back up and running after a power outage, equipment failure, natural disaster, or other event. This plan will also include emergency contact information, procedures for data recovery, and the steps to take to ensure business continuity.

What Should I Consider When Developing a HIPAA Data Backup Plan?

When it comes to creating a HIPAA-compliant data backup strategy, several factors should be taken into account. First, it is essential to determine the type of data that needs to be backed up, where it will be stored, and who will have access to it. Second, you must conduct an analysis of the security risks involved in storing the data to identify potential vulnerabilities. Third, the backup strategy should incorporate specific measures like encryption and access controls to mitigate the risk of a PHI data breaches. It is also crucial to establish a disaster recovery plan to ensure that the data can be easily restored in the event of a data breach, cyberattack, or natural or man-made disaster. Further, you should regularly test and update the backup strategy to ensure that it remains relevant, effective, and compliant with HIPAA regulations.

HIPAA-compliant PHI Record Disposal Methods That Comply With HIPAA

Data protection requirements don’t end when CEs and BAs dispose of medical records.

This is because:

• Disposed data storage devices can be recovered, thus disclosing PHI illegally.
• Improperly wiped or erased data storage media can still retain PHI that can be illegally accessed.

HIPAA outlines specific methods for medical record disposal that comply with HIPAA data retention regulations:

1. Any paper records must be either burned, shredded, pulled, or pulverized so that any PHI is rendered unreadable.
2. Prescription bottles containing labels with PHI must be properly destroyed, usually through a third-party BA that can destroy physical objects.
3. Electronic media must be cleared or wiped using special software that removes data. Electronic media can also be physically destroyed through pulverizing or rendered unreadable through degaussing.

Achieve HIPAA-compliant Data Retention and Backup Requirements With Kiteworks

The Kiteworks Private Content Network protects PHI from unauthorized access to effectively meet the HIPAA Data Retention and Backup requirements. Key features, including complete visibility into all file activity, supported by a detailed audit log, ensure that a record of every action is kept, facilitating accountability and compliance.

With Kiteworks, organizations have the flexibility to customize the retention periods for different types of sensitive data, like PHI, aligning them with the specific requirements mandated by HIPAA. This capability allows for efficient and tailored data retention, enabling organizations to adhere to HIPAA and other compliance regulations and standards. Kiteworks provides automated, end-to-end encryption to ensure PHI remains protected for the entire duration of its email journey, even through sender and recipient firewalls, bolstering data security.

Kiteworks also offers granular access control mechanisms, enabling administrators to define user permissions and restrict access to PHI based on roles and responsibilities. This helps ensure that only authorized personnel can view, open, edit, or share sensitive content. Additionally, Kiteworks offers robust reporting capabilities, including a one-click HIPAA compliance report, allowing covered entities and their business associates to demonstrate they have adequate administrative, physical, and technical safeguards in place in compliance with HIPAA.

Kiteworks integrates with many of the solutions in your security infrastructure, like data loss prevention (DLP), advanced threat protection (ATP), security information and event management (SIEM), and content disarm and reconstruction (CDR), to prevent PHI data leaks and cyberattacks. In addition, digital rights management (DRM) features such as watermarking, file encryption, and permission-based access controls protect PHI and other sensitive data from unauthorized access or misuse.

To learn more about how Kiteworks can help you achieve HIPAA compliance including data retention and backup, schedule a demo tailored to your specific use cases and business requirements.

Additional Resources

• Blog Post Everything You Need to Know About HIPAA Compliance [Complete Checklist]
• Blog Post What Is a HIPAA Breach and What Should You Do if You Have One?
• Blog Post [HIPAA-compliant Cloud Storage] Secure & Private Storage
• Blog Post [HIPAA-compliant SFTP] Enterprise Servers and Solutions
• Blog Post HIPAA Encryption: Requirements, Best Practices & Software