Document policies, procedures, actions, activities or assessments implemented by Health Insurance Portability and Accountability Act of 1996 (HIPAA) covered entities and business associates to comply with the Security Standards for the Protection of Electronic Protected Health Information provided at 45 CFR Subpart C, including 45 CFR § 164.306. These records, found in all media (paper, digital, or other), must include:
These records may also include, but not limited to:
6 years from the date of creation or the date last was in effect, whichever is later, purge.
Exception: In the event of a subpoena, audit, legal hold, public records or similar state or federal information request, halt until further instructed any scheduled disposal activities, including purging or transferring material to University Archives.
