HIPAA Does Not Require You to Keep Call Recordings for Six Years

HIPAA Does Not Require You to Keep Call Recordings for Six Years

Somewhere along the way, "six years" turned into folklore. A vendor says it, a checklist repeats it, an auditor nods, and a home health agency ends up warehousing every call from every extension for six years, indexed and searchable, because someone decided that was the rule. It is not the rule. There is no HIPAA provision that requires you to retain call recordings at all, let alone for a fixed number of years. There are provisions that touch what you do with recordings once you have them, and there is a documentation retention rule that gets misapplied to the recordings themselves. Sorting those out is worth an hour of your compliance team's week.

Where "six years" actually comes from

The six-year figure lives at 45 CFR 164.530(j)(2): "A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later." The catch is what "documentation" refers to. Paragraph (j)(1) covers your written policies and procedures, records of designations and authorizations, complaint dispositions, sanctions applied to workforce members, and other formal HIPAA administrative records. It does not cover the underlying protected health information you handle in the ordinary course of care. A recorded intake call is PHI in a container, not administrative documentation of your Privacy Rule program.

The subtle version of the same mistake shows up in vendor sales decks that treat the entire Privacy Rule as if it were a records-retention schedule. It is not. Read the section again next to your recordings policy and note what it actually mandates: keeping evidence that you had a policy, that you trained on it, that you sanctioned a person who violated it. The recording of the patient's daughter asking why the aide missed a visit is not that evidence. Your incident file is.

The retention rule that does apply — and it is not six years

If your agency is a Medicare-certified home health agency, the clinical-record retention rule that binds you sits in a different title of the CFR entirely. 42 CFR 484.110(c) is direct: "Clinical records must be retained for 5 years after the discharge of the patient, unless state law stipulates a longer period of time." Five years, not six. Measured from discharge, not from creation. And only for records that qualify as clinical records under the Condition of Participation — the assessments, orders, care plans, visit notes, and communications that document the episode of care.

Whether a specific call recording is a clinical record is a judgment call and, on many calls, the honest answer is no. A caller confirming a Tuesday-versus-Wednesday visit is not documenting care in the way a visit note does. A scheduler's confirmation of a start-of-care date probably is not either. A clinician taking a change-in-condition report by phone might well be. The question your policy has to answer is which categories of calls, by content and by role of the taker, become part of the record — and how you preserve the substance of those calls into the clinical record itself. A time-stamped call summary attached to the chart usually meets that duty better than an unindexed audio file that no surveyor will ever be able to search.

State law is the reason you cannot copy a policy from a peer

Both federal rules explicitly defer to state law where state law is stricter. Home health clinical-record retention is one of the areas states most commonly extend: several set seven, ten, or (for pediatric records) age-of-majority-plus-a-margin as the minimum. State medical-records laws generally apply to whatever is part of the medical record under state definitions, which do not neatly overlap with CoP definitions. And the wiretap regime that governs consent for the recording itself is state-by-state; that is a separate analysis, but it interacts with retention, because a recording your policy would not have permitted you to make in the first place is one you should not be storing for six years to prove you did not.

The practical implication is that a retention policy written for a Texas agency will not survive a move into Massachusetts without changes. Pull your state's home health licensure regulation, your state's medical-records statute, and any relevant Medicaid manager contract terms before you finalize a duration.

What a defensible policy actually looks like

The shape of a workable policy is not "we keep everything for X years." It is a set of categories with different rules and clear ownership:

• Administrative HIPAA documentation — policies, sanctions, complaint dispositions, workforce authorizations, notices of privacy practices — retained six years under 164.530(j)(2), owned by your Privacy Officer, stored in the HIPAA program file, not the phone system.
• Clinical records — assessments, orders, care plans, visit notes, and the clinical portions of calls documented into the chart — retained five years post-discharge under 484.110(c), or the longer state-mandated period, owned by clinical records.
• Call recordings that are not clinical records — routine scheduling, general inquiries, marketing calls — retained for a defined operational period tied to the reason you have them (quality monitoring, dispute resolution, training), then purged. That period is a business decision constrained by state law, not by 164.530(j)(2).
• Sales and enrollment calls under other federal programs — if you touch Medicare Advantage marketing or third-party marketing on behalf of an MA plan, the CMS TPMO recording rule imposes its own ten-year window separately from anything HIPAA says.

Every category needs a written justification, a documented purge cadence, and evidence the purge actually happens. Auditors do not fault agencies for having a bounded retention period. They fault agencies whose written policy says one thing and whose S3 bucket says another.

A one-week action list

You do not need a project to fix this. In one week, an operations lead and a compliance officer can:

• Pull the current recordings retention policy and identify which sentence, if any, cites a CFR paragraph. If it cites 164.530(j)(2) as the basis for keeping recordings, the citation is wrong; fix it.
• Ask your telephony vendor and any AI subprocessor how long they actually retain recordings, transcripts, and derived data, and whether "retention" is measured from call date or last access. Get the answer in writing and reconcile it with your policy.
• Confirm which categories of calls, if any, your policy treats as part of the clinical record — and whether the substance of those calls flows into the chart within a defined SLA, not just into an audio file.
• Look up your state's clinical-record retention statute and any additional Medicaid contract language. If your policy period is shorter than the strictest applicable rule, extend it. If it is materially longer without a documented reason, shorten it.
• Document the purge — the fact that recordings past their retention window are actually being deleted, on schedule, is what a surveyor will want to see.

The goal is not a longer number. It is a defensible number, matched to your state and your category of call, that you can point to with a straight face.

Why the AI layer changes the picture

Retention conversations that stopped at "the recording" used to be adequate. They are not anymore. If you are running speech analytics or an AI QA system on your calls, the derived artifacts — transcripts, redacted transcripts, taxonomy tags, sentiment scores, coaching notes — are also PHI or derived from PHI, and they carry their own retention questions. A short recording-retention window paired with a long transcript-retention window is not a shorter window. It is the same window with a different name.

SurfacerIQ is a call and interaction intelligence platform built for healthcare contact centers, and one of the reasons category-specific retention exists as a first-class concept in the product is that a policy that treats every call the same rarely survives a real audit. If you want to see how your call inventory would look under distinct retention categories rather than a single window, talk to us.

For more on how call recording, retention, and consent fit into the broader home care compliance stack, see The Home Care Call Compliance Checklist and HIPAA Call Recording Compliance: A 2026 Guide for Healthcare Operators.

This post is general information about federal HIPAA and Medicare Conditions of Participation, not legal advice. State law and your specific facts control the answer for your agency.