According to the proposed privacy regulation, documents relating to uses
and disclosures, authorization forms, business partner contracts, notices
of your information practice, responses to a patient who wants to amend or
correct their information, the patient's statement of disagreement, and a
complaint record must be maintained for 6 years. (See 64 Fed. Reg. 59994).

One can assume that you must also retain records proving that your
employees and former employees were trained in HIPAA awareness for 6 years
under this regulation.

As far as the actual medical data, as long as it can be resurrected in a
coherent manner (pc file, microfiche, printed report, etc.) for a period of
6 years you are in compliance.

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *