Quick answer
A SNF retention schedule must distinguish resident medical records from HIPAA policy and other required documentation. Apply the relevant state and federal periods, minor provisions and holds to each class. Preserve access and context while records are retained. Reaching a calculated date should create a disposition review, not an automatic purge that bypasses unresolved obligations.
An archive purchase is incomplete until the facility can explain which records must remain, for how long and in what usable form. A single “retain six years” setting can mix unrelated obligations and delete material whose clock has not started or whose destruction is on hold.
The nursing-facility rule addresses medical records: the state-law period, a five-year period after discharge where state law supplies no requirement, and a minor provision of three years after reaching legal age under state law. It also requires accessible, organized and safeguarded records. The official 2025 edition places these requirements in paragraph (h). 42 CFR 483.70(h).
The current CMS survey resource package reproduces the same retention passage at F842. CMS Appendix PP in Survey Resources.
HIPAA separately requires specified privacy documentation to be retained for six years from creation or the date last in effect, whichever is later. That is not a universal six-year medical-chart rule. 45 CFR 164.530(j).
Construct a schedule that records its assumptions
For each record class, capture the responsible entity, governing requirements, trigger event, calculated earliest review date, systems containing it and hold status. Have counsel and HIM reconcile state law, resident age, applicable program or contract requirements and current regulatory changes before approving the schedule.
Distinguish a resident chart from a privacy policy, signed authorization, financial record, system log and convenience copy. A duplicate may still contain annotations or unique metadata; calling it a copy does not establish that it is disposable.
Work four conditional examples
| Synthetic record | Stated assumption | Retention review result |
|---|---|---|
| Adult chart; discharge June 30, 2026 | No state retention requirement; no other longer duty | Federal fallback reaches five years on June 30, 2031; assess disposition only after the required period and final checks |
| Minor's chart | Applicable legal-age date is September 1, 2028 | Minor provision reaches three years on September 1, 2031; reconcile all other applicable requirements |
| Privacy policy created in 2020, last effective December 31, 2026 | HIPAA documentation provision applies | Six-year clock runs from the later date, reaching December 31, 2032 |
| Otherwise eligible chart with an active hold | Counsel has not released the hold | Preserve the scoped material; no purge based on schedule alone |
These are arithmetic examples, not state-specific retention advice. The minor example assumes the legal-age determination has already been made. A longer applicable rule or preservation obligation changes the result.
Keep the retained record usable
A storage object is not a usable archive if staff cannot identify its resident, reconstruct dates or open attachments. Test a discharged record containing corrected notes, scanned documents and external reports. Verify retrieval by the authorized team, readable chronology, access restrictions and the relationship between originals and amendments.
Document which elements remain in the live system, an archive, a supplier's backup and local exports. A legal hold must reach the relevant locations. A contract ending does not itself end the record obligation; designate the custodian and retrieval route before a closure or system transition.
For backup copies, define how retention and holds interact with backup rotation, restoration and subsequent deletion. Do not assume deleting a live record removes all copies, or promise selective backup deletion that the architecture cannot perform.
Require reviewed disposition
At the scheduled review date, produce a candidate list with governing rule, trigger, hold check and approving authority. Test a mixed batch containing one held record. The system should exclude it without silently preventing review of all unrelated candidates.
After approval, preserve a disposition record identifying scope and method without unnecessarily retaining the content scheduled for destruction. Media sanitization is the later execution step; it cannot decide whether records were eligible for destruction.
Ease's skilled nursing offering is planned. Retention, archive and hold behavior would need demonstrated scope, including supplier-held copies and access after the active subscription ends.
Questions & answers
Does HIPAA require every SNF medical chart to be kept for six years?
The six-year HIPAA provision discussed here covers required privacy documentation, measured from creation or last effective date, whichever is later. Medical-chart retention requires a separate analysis of nursing-facility, state and other applicable rules.
Should an expired retention date override an active legal hold?
No. Keep the hold and its scope linked to the records, suspend affected disposition and obtain authorized release of the hold before reevaluating deletion eligibility under the remaining requirements.
Primary sources
- 42 CFR 483.70(h): Medical records, official 2025 edition
- 45 CFR 164.530(j): HIPAA documentation retention
- CMS Survey Resources: Appendix PP, F842
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.