> ## Documentation Index
> Fetch the complete documentation index at: https://handbook.helendelovely.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Records Retention

> How long client records and practice documents are kept, and why.

## Client records

Utah's rule for mental health professionals (Utah Admin. Code R156-60e-502.1(10)(d)) requires client records, including assessment, treatment, progress notes, and billing information, to be kept for at least **10 years from the documented end of services**. That's our standard for every client record.

Utah has no separate rule for clients who were minors. As practice policy, we keep a minor's record for 10 years from the end of services or until the client turns 28, whichever is later, so the record is still available for the years after they reach adulthood when a claim or request is most likely.

## The retention schedule

| Record                                                                                                 | Kept for                                                              | Why                                                            |
| ------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------- | -------------------------------------------------------------- |
| Client clinical and billing records                                                                    | 10 years from end of services                                         | Utah Admin. Code R156-60e-502.1(10)(d)                         |
| Client records, minors                                                                                 | 10 years from end of services or until age 28, whichever is later     | Practice policy                                                |
| Medicaid-related service and billing records                                                           | At least 10 years (exceeds the Utah Medicaid manual's 5-year minimum) | Utah Medicaid Provider Manual, Section I                       |
| HIPAA policies, training records, business associate agreements, risk analyses, incident documentation | 6 years from creation or last effective date                          | 45 CFR § 164.316(b)(2) and § 164.530(j)                        |
| Personnel files                                                                                        | 3 years after separation                                              | Practice policy, exceeding federal minimums                    |
| Payroll records                                                                                        | 3 years; time records 2 years                                         | 29 CFR Part 516; Utah Code § 34-28-10 requires at least 1 year |
| Form I-9                                                                                               | 3 years after hire or 1 year after separation, whichever is later     | 8 CFR § 274a.2                                                 |
| Workers' compensation injury records                                                                   | 5 years                                                               | Practice policy                                                |
| Contracts and legal documents                                                                          | Life of the agreement plus 6 years                                    | Practice policy                                                |
| Supervision logs and contracts                                                                         | 10 years, alongside the client record standard                        | Practice policy; DOPL may request them                         |

The practice manager owns this schedule. It has been reviewed by the practice and is on the attorney list for confirmation before adoption, but it is in effect as policy now.

Client records are never destroyed early, never removed from practice systems, and never taken by a clinician who leaves. See [What survives employment](/leaving/what-survives-employment).

## Where records live

The clinical record lives in PracticeOS and the care portal. That's the record. Anything you write elsewhere, including personal notes, isn't the record and shouldn't contain client information beyond what [Devices, mobile, and texting](/privacy-and-security/devices-mobile-and-texting) allows.

## HIPAA documentation

HIPAA doesn't set a retention period for medical records; that's state law. What HIPAA does require is that our privacy and security policies, training records, business associate agreements, risk analyses, and incident documentation be kept for **six years** from when they were created or last in effect. The practice manager maintains those. Your signed training and acknowledgment records are part of them.

## Substance use disorder records

The federal confidentiality rule for substance use disorder records (42 CFR Part 2) applies to programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral. The practice does not, so Part 2 does not apply to our records; HIPAA and Utah law do. If the practice ever adds a substance use disorder program, this page changes first.

## Disposal

When a record reaches the end of its retention period, the practice disposes of it in a way that makes it unrecoverable: secure deletion for electronic records, shredding for paper. Disposal is documented. Nobody disposes of a client record on their own.

## Legal holds

If the practice is notified of litigation, an investigation, or a records request, relevant records are frozen until the matter is resolved, regardless of their retention date. You'll be told if a hold affects records you handle. Don't delete anything you've been told to hold.