Health Information Compliance Alert

Question: We have been storing our patients' written acknowledgement that they received our notice of privacy practices (NPP) in patients' files. However, some of our compliance staff do not believe we need to keep acknowledgements for the same retention period as other documents. When can we dispose of acknowledgements without violating HIPAA?


Georgia subscriber


Answer: It depends on when you make changes to your NPP, says Robert Markette, an attorney with Gilliland & Caudill in Indianapolis. You're required to document that patients read your notice and the privacy rule mandates that you hold on to all required documentation for at least six years from the date of its creation or the date it was last in effect.

Example: You decide to change your policy for how patients can request confidential communications and your modified NPP's effective date is Aug. 30, 2005. You can dispose of the acknowledgement for the pre-Aug. 30, 2005 notice in six years (Aug. 30, 2011).

The Bottom Line: While this retention requirement seems burdensome, keep in mind that each acknowledgement is only one page. Unless you make frequent changes to your NPP, you should not find yourself swamped with outdated acknowledgements.