Documentation and record retention policy

Granite City Family Dental — Documentation and record retention. Version 1.0. Effective November 1, 2026. Approved by Dr. Maria Lindqvist, Owner.

Authority: 45 CFR 164.316(b) (Security Rule documentation); 45 CFR 164.530(j) (Privacy Rule documentation); 45 CFR 164.105(c) (organizational documentation).

1. Policy

Granite City Family Dental keeps every HIPAA policy, procedure, designation, assessment, log, form and communication that the rules require in written form (paper or electronic), keeps it for at least six years, and makes it available to the people who need it. Documentation is how the practice proves it did what the rules require; if it is not written down, OCR treats it as not done.

2. What is retained

The following are retained for six years from the date they were created or the date they were last in effect, whichever is later:

• Every version of every policy and procedure in this binder, with its approval signature page.
• Privacy Officer and Security Officer designation letters and annual re-confirmations.
• The security risk analysis, the risk management plan and all remediation evidence, including closed items.
• Annual review minutes, evaluation reports and the owner's attestation.
• Training rosters, course records and signed workforce acknowledgments and confidentiality agreements.
• Sanction records.
• The Notice of Privacy Practices (every version), signed acknowledgments and good-faith-effort notes.
• Signed authorizations, Minnesota consents, restriction agreements, confidential-communication requests and the responses to access, amendment and accounting requests.
• The accounting-of-disclosures log (disclosures must be available for six years on request).
• Complaint log, complaint files and mitigation notes.
• Security incident log, incident reports, four-factor breach risk assessments (including "not a breach" conclusions), breach notices and the under-500 HHS submissions.
• Business associate agreements and the register, including expired agreements for six years after expiry.
• User access list, access reviews, termination checklists, information system activity (log) reviews.
• Device and media inventory, disposal certificates, maintenance records for facility security.
• Contingency plan, restore test records and tabletop exercise notes.

Patient medical records themselves are kept under the practice's clinical record-retention schedule and state law, which run separately from this six-year HIPAA documentation rule. Where the two overlap, the longer period applies.

3. Where documentation is kept

This binder (CRU HIPAA Binder Builder, exported yearly) and a printed copy in the administrator's locked office.

Documentation is available to the workforce members responsible for the procedures it covers (164.316(b)(2)(ii)). The Privacy Officer, the Security Officer, the owner and the backup designee (Dr. Maria Lindqvist) can each retrieve the complete set within one business day. A copy of the current binder export is kept where it would survive the loss of the office (the same off-site or cloud location as the practice's backups).

4. Version control

• Each policy carries a version number and an effective date on its first page. The current policy set is version 1.0, effective November 1, 2026.
• A change that alters a requirement is a new version (1.0 to 2.0). A correction of wording, names or contact details is a point release (1.0 to 1.1).
• Every version is approved and signed by Dr. Maria Lindqvist, Owner before it takes effect. The signed page is kept with that version.
• Superseded versions are marked "Superseded on <date> by version <n>" and kept for six years from the date they stopped being in effect. They are never destroyed early and never edited after the fact.
• When a policy changes in a way that affects the workforce, the Privacy Officer records the change in the revision history below, re-trains the affected workforce members and updates the training roster.
• The binder is regenerated at least once a year after the annual review; each yearly edition is retained as a complete set.

5. Review

All documentation is reviewed at least annually in October and whenever there is a change in law, technology, a security incident, or the practice's operations (164.316(b)(2)(iii)). The review is recorded in the annual review minutes.

6. Destruction after the retention period

When a record has passed its retention period and no investigation, complaint, litigation hold or audit requires it, it is destroyed so it cannot be read or reconstructed:

Cross-cut shredding for paper; secure deletion of electronic copies after the retention period.

Destruction is recorded with the date, what was destroyed, the method and who did it. Records involved in an open complaint, incident, breach, OCR inquiry or legal matter are kept until the Privacy Officer releases the hold in writing.

7. Revision history

8. Approval

Policy approver: Dr. Maria Lindqvist, Owner

Signature: ______________________________ Date: ______________

Privacy Officer: Janelle Okafor

Signature: ______________________________ Date: ______________