A dental record retention policy should assign a rule to each record type, identify the authority behind that rule, define when its clock starts, and prevent disposal while an applicable hold remains active. Begin by separating patient charts from required HIPAA documentation and other business records.
HIPAA's six-year documentation rule is not a universal patient-chart retention period. HHS states that the HIPAA Privacy Rule does not set medical-record retention periods; state laws generally govern them. Privacy safeguards still apply for as long as the practice maintains protected information, including through disposal. HHS explanation of medical-record retention
Have qualified counsel and the practice's records, privacy, clinical, and financial owners approve the schedule for the jurisdictions and obligations that actually apply. The manager's job is to turn those decisions into a process staff can follow and verify.
Classify records before assigning a number of years
Create an inventory by function and content. A folder name, file extension, or software platform does not necessarily establish the legal category.
| Record class | Examples | Question for the schedule reviewer |
|---|---|---|
| Patient clinical record | History, examination and treatment notes, clinical correspondence | Which dental-record rules and trigger dates apply? |
| Clinical attachments | Radiographs, photographs, scans, reports, and linked amendments | Which items form part of the patient record, including those stored elsewhere? |
| Required HIPAA documentation | Applicable privacy policies, notices, complaint dispositions, and required documented actions | Which specific documentation rule and effective dates control? |
| Patient financial and claim records | Ledgers, claims, EOBs, payment and adjustment support | Which patient-record, payer, financial, or other obligations apply? |
| Employment and general business records | Personnel files, payroll support, contracts, and tax records | Which separate schedules and access restrictions apply? |
| Communications and temporary copies | Recordings, transcripts, exports, scanned intake forms, and downloads | Is the material an official record, required evidence, or a temporary copy? |
Do not assume a transcript is disposable because it is text, or permanent because it mentions a patient. Determine its purpose, content, relationship to the official record, and applicable obligations.
Likewise, a financial document can belong to more than one relevant category. The approved schedule should resolve the overlap instead of allowing each department to apply an unrelated deletion date.
Apply the six-year rule to the documentation it covers
The Privacy Rule requires covered entities to retain specified documentation, including privacy policies and procedures, privacy notices, complaint dispositions, and other required documented actions. The period is six years after creation or the date the document was last in effect, whichever is later. HHS Privacy Rule documentation summary
The later-date condition matters. In a hypothetical example, a privacy policy is created on January 1, 2025, remains in effect through December 31, 2027, and is replaced on January 1, 2028. Adding six years to the last-in-effect date gives December 31, 2033. Counting only from creation would point to January 1, 2031 and miss the later trigger.
That example concerns the superseded privacy-policy version. It supplies no retention date for a patient's chart. Other applicable requirements or a hold can also affect disposal eligibility.
Keep policy versions and their effective periods identifiable. If the office overwrites the old policy without preserving its version history, staff may be unable to establish what was in force or calculate the appropriate period.
Write a schedule that a manager can execute
For each class, document:
Scope: Included records, exclusions, and authoritative location. Authority: Specific law, board rule, contract, or approved policy, with review date. Trigger: The event that begins the period and where its date comes from. Period: The approved duration and any special conditions. Exceptions: Minors, unresolved matters, conflicting obligations, and holds requiring review. Custodian: Role responsible for accuracy, access, retrieval, and disposal preparation. Disposition: Approved action and the person who authorizes it.
Avoid entries such as “charts: seven years” without a jurisdiction, trigger, and approved basis. The same number can produce different dates when calculated from creation, last treatment, a patient's age, or another legally defined event.
Have the reviewer resolve competing rules explicitly. A vendor's default setting is a technical configuration, not evidence that the practice has selected a valid retention period.
Map the places where the record survives
List the practice-management system, imaging platform, paper archive, scanned-document repository, exports, vendor-held copies, and backup arrangements. Identify which system holds the authoritative record and which copies support recovery or another approved purpose.
Test retrieval before retiring a system or discarding source material after migration. Confirm that notes, images, attachments, dates, and record relationships remain available in the required form. A folder of unreadable files is not a usable archive.
Keep retention separate from the records-release workflow. Archiving a chart should not make an access request disappear into a vendor support queue. Assign retrieval responsibility and maintain the approved request process.
Also preserve the relationship between original information and record corrections or amendments. Moving an amended record should not detach the amendment or silently replace its history.
Make holds visible to every affected custodian
Define who can issue and release a hold, how its scope is recorded, and how staff and vendors acknowledge the instruction. When counsel or the authorized reviewer identifies a preservation need, suspend the affected ordinary disposal process under that direction.
The hold record should identify the matter, relevant record classes, date range, systems, custodians, instruction date, and review owner. Keep access limited; a general team board does not need sensitive dispute details.
Do not resume disposal simply because a complaint seems quiet or a manager believes the issue is finished. Obtain the authorized release and recheck the underlying schedule. A hold changes disposal handling; it does not authorize editing the preserved records.
Approve disposal from a candidate list
Generate a list of records potentially eligible under the approved schedule. Before authorizing action, check the classification, trigger dates, exceptions, holds, and affected copies.
HHS requires reasonable safeguards during disposal and does not prescribe one universal method. Protected information cannot simply be abandoned in publicly accessible waste. Choose an appropriate process for the medium and circumstances with the responsible privacy and technical owners. HHS guidance on disposing of protected information
Record the authorization, scope, date, method, responsible party, and available completion evidence. Explain any backup or vendor exceptions instead of claiming that every copy vanished immediately.
Review the schedule after a legal change, new record system, acquisition, closure, or material contract change. Periodically sample both retained and disposed records to check that the approved rules work in practice.
