Retention Rules That Actually Apply to Home Health Records

Retention Rules That Actually Apply to Home Health Records

Start with the correction that fixes most retention policies: HIPAA does not set a medical record retention period. It sets a documentation retention period. Those are different obligations covering different material, and conflating them is how an agency ends up with a policy that is simultaneously too short for its clinical records and too vague about everything else.

45 CFR 164.530(j)(2) requires a covered entity to retain the documentation required by the Privacy Rule for six years from the date of its creation or the date when it last was in effect, whichever is later. That covers your policies and procedures, required written communications, and records of actions and designations the rule requires you to document. The Security Rule imposes the same six-year clock on its own documentation at 45 CFR 164.316(b)(2). Neither provision says anything about how long you keep a patient's chart.

The chart is governed elsewhere, and home health record retention requirements end up running on four separate clocks at once.

The four clocks

What	How long	Running from	Authority
Home health clinical records	5 years	Patient discharge	42 CFR 484.110(c)
Hospice clinical records	6 years	Patient death or discharge	42 CFR 418.104(d)
HIPAA Privacy and Security Rule documentation	6 years	Creation or last in effect, whichever is later	45 CFR 164.530(j)(2), 164.316(b)(2)
Documentation supporting ordered, certified, referred, or prescribed Part A/B services	7 years	Date of service	42 CFR 424.516(f)
Medicare Advantage books, records, and evidence of accounting procedures	10 years	End of the final contract period or completion of audit, whichever is later	42 CFR 422.504(d), (e)(4)

Read that table once and the practical rule falls out: the longest applicable clock governs the record. A home health episode billed to a Medicare Advantage plan does not become a five-year record because 484.110(c) says five years. Both obligations attach.

The three provisions people get wrong

484.110(c) is a floor, not a period

The home health condition of participation requires clinical records to be retained for five years after the patient's discharge, unless state law stipulates a longer period of time. The deference to state law is in the regulation itself. The same construction appears in the hospice rule at 418.104(d): six years after death or discharge, unless state law stipulates a longer period.

This is where retention genuinely varies, and it varies by state rather than being a settled federal number. State licensure and state records statutes set longer periods in a number of jurisdictions, and some run from different events — the age of majority for minor patients being the most common divergence. There is no federal source that will resolve this for you. Your state survey agency and your counsel are the authorities, and a national template that prints "five years" without a state overlay is wrong for some of its readers by construction.

484.110(c) also carries a provision agencies forget until they sell or close: the agency's policies must provide for retention of records even if it discontinues operation, and if it closes it must notify the state agency where the records will be kept. That obligation survives the entity.

424.516(f) reaches further than most agencies assume

This one is frequently filed under "physician problem." It is not. 42 CFR 424.516(f) obligates a provider or supplier that furnishes covered Part A or B services, items, or drugs that were ordered, certified, referred, or prescribed to maintain documentation for seven years from the date of service and to provide access on request from CMS or a Medicare contractor. The records must include the NPI of the ordering, certifying, referring, or prescribing practitioner. The parallel obligation at (f)(2) falls on the physician or eligible professional.

Seven years from date of service is a longer clock than five years from discharge for essentially every episode. If your retention schedule is built on 484.110 alone, this is the provision that quietly extends it.

The Medicare Advantage clock flows downstream by contract

42 CFR 422.504(d) requires the MA organization to maintain for 10 years books, records, documents, and other evidence of accounting procedures. The inspection right runs through 10 years from the end of the final contract period or completion of audit, whichever is later, under (e)(4).

Here is the nuance worth getting right rather than overstating: paragraph (d) binds the MA organization, not you directly. What reaches you is (i)(2), which requires the MA organization to make all first tier, downstream, and related entities agree that the government has audit, evaluation, and inspection rights, and (i)(2)(iv), which extends that right through the same ten-year window. In other words, your ten-year obligation is contractual, and it lives in your payer agreement. Pull the agreement and read the records clause rather than assuming either that the rule binds you directly or that it does not reach you at all.

Where call recordings fall

None of the authorities above requires you to record calls. That is worth stating flatly, because retention discussions drift toward the assumption that a federal rule compels capture. It does not.

What the rules do is govern material you have chosen to create. The relevant question is whether a given recording is part of the clinical record, and that turns on content and on your own policy. A call in which a clinician takes a verbal order, documents a change in condition, or resolves a patient complaint produces clinical documentation; if your policy defines the audio as part of the record, you have attached the clinical record clock to the audio.

That decision has a second consequence most agencies miss. 484.110(e) requires the patient's clinical record, whether paper or electronic, to be available to the patient free of charge on request, at the next home visit or within four business days, whichever comes first. If your policy says recordings are part of the clinical record, you have placed yourself on a four-business-day production clock for audio. If your policy says they are a separate operational record retained on a defined schedule, you have not. Either position is defensible. Having no written position is not, and the choice should be made deliberately rather than discovered during a request.

484.110(d) applies regardless: records must be safeguarded against loss or unauthorized use, and the agency must comply with the HIPAA rules at 45 CFR parts 160 and 164. Retention without access control is its own exposure — we covered the internal side of that in minimum necessary applies to your QA team, and the capture-and-consent side in our HIPAA call recording compliance guide.

What to do this week

1. Build a one-page schedule with a row per record class and a column for each clock that touches it. Set the retention to the longest applicable clock, not the first one you found.
2. Look up your state's retention period and its starting event, including the minor-patient rule. Write the citation into the schedule so the next person does not have to re-derive it.
3. Pull your largest payer agreements and find the records clause. Note the actual number and the event it runs from.
4. Write a single sentence stating whether call recordings are part of the clinical record at your agency, and make sure your retention schedule and your patient-access procedure both match that sentence.
5. Confirm you have a written provision for record custody if the agency ceases operation, and that it names where records would go.

Our home care call compliance checklist walks the adjacent decisions on what to record, redact, and retain.

Where conversation data fits

Retention schedules fail in practice less from choosing the wrong number than from not knowing what exists. Interaction intelligence platforms, SurfacerIQ among them, cover the category of making the conversation layer inventoried and searchable, which is a precondition for applying any schedule to it at all.

Consider a hypothetical: an agency with a five-year clinical record policy and no stated position on audio discovers during a records request that three years of call recordings exist in a telephony vendor's storage under a 90-day default. Both halves of that are policy failures, and neither is about the number five.

This post is general information, not legal advice. Retention periods interact with state law, payer contracts, and litigation holds; confirm your schedule with your own counsel. To talk through the interaction side of it, talk to us.