# policies and procedures implemented to comply with this subpart, and written records of required actions, activities, or assessments — How long federal regulations require records to be kept: retention periods, what starts the clock, and who they bind

For policies and procedures implemented to comply with this subpart, and written records of required actions, activities, or assessments, regulation is 45 CFR 164.316; regulator / programme is HHS (HIPAA); retention period is 6 years; when the clock starts is from the date of its creation or the date when it last was in effect, whichever is later; who it binds is a covered entity or business associate, recorded from its source on 2026-08-11.

- **Regulation:** 45 CFR 164.316 _(verified: appears in the quote below)_
- **Regulator / programme:** HHS (HIPAA) _(our reading, not quoted from the source)_
- **Record type:** policies and procedures implemented to comply with this subpart, and written records of required actions, activities, or assessments _(verified: appears in the quote below)_
- **Retention period:** 6 years _(verified: appears in the quote below)_
- **When the clock starts:** from the date of its creation or the date when it last was in effect, whichever is later _(verified: appears in the quote below)_
- **Who it binds:** a covered entity or business associate
- **Exceptions and notes:** documentation must be reviewed periodically and updated as needed in response to environmental or operational changes affecting the security of the electronic protected health information

## What the source says

> ( i ) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and ( ii ) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment. ( 2 ) Implementation specifications: ( i ) Time limit (Required). Retain the documentation required by <https://www.ecfr.gov/current/title-45/section-164.316#p-164.316(b)(1)> paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.

## Source

- https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.316

Last verified: 2026-08-11. Review by: 2027-08-11.
Part of [How long federal regulations require records to be kept: retention periods, what starts the clock, and who they bind](https://referencesource.org/record-retention-periods-federal/).