Data retention: Selected requirements by data type

Area

Information description

Source of requirement

Audit/Tax

Audit documentation, including reviews of financial statements.

Retention:  7 years after the audit or review is completed.

SEC (Sarb-Ox 802)

17 CFR 210

Audit/Tax

Employment tax records, claims and other tax-related documentation.

Retention:  4 years after tax due date or when paid, whichever is later; for claims, 4 years after date of the filing.

IRS (IRC/FICA)

26 CFR 31.6001

Education

Education records, such as transcripts.

Retention:  No federally-mandated period.   Best practice is forever.  State law may set a minimum.

Education

Education records transactions covered by the Family Education Rights and Privacy Act (FERPA) including requests for and disclosures of transcripts.

Retention:  As long as the student record is maintained.

DOEd (FERPA)

34 CFR 99.32

Education

Records of education grants and other financial awards, including documentation, statistical and financial records.

Retention:   3 years after submission of final report.

DOEd

34 CFR 74.53

34 CFR 80.42

Employment

Employment records (including requests for reasonable accommodation, application forms submitted by applicants and other records having to do with hiring, promotion, tenure, demotion, transfer, layoff, or  termination, rates of pay or other terms of compensation, and selection for training).

Retention:  1 year for general employers, 2 years for institutions of higher education (from date of action or record involved, whichever is later)

EEOC (ADA et al)

29 CFR 1602.14,21,28,40,49

Employment

Payroll records, contracts or collective bargaining agreements, plans, trusts, sales and purchase records (summary).

Retention:  3 years

DOL (FLSA)

29 CFR 516.5

Employment

Basic employment and earnings records (including time and earnings “cards,” wage rates, work time schedules).  Order, shipping, and billing records which an employer retains or makes in the usual course of business operations including originals or true copies of all customer orders or invoices received, incoming or outgoing shipping or delivery records, bills of lading and all billings to customers (but not including individual sales slips, cash register tapes or the like).

Retention:  2 years

DOL (FLSA)

29 CFR 516.6

Employment

Reports under Welfare and Pension Plan Disclosure Act (WPPDA), including plan documents and financial statements.

Retention:  5 years.

DOL (WPPDA)

20 CFR 10.410

Employment

Employment records relating to pension and benefit plans, including plan summaries and individual payments.

Retention:  6 years after last activity.

DOL (ERISA)

29 CFR 4007.10

Hazardous materials and exposures

Employee exposure records (if any), material safety data sheets for each hazardous chemical used in the workplace, or records identifying substances used, when and where used.

Retention:  30 years.

DOL (OHSA)

29 CFR 1910.1020

Health care

Medical records in hospitals, clinics, home health agencies, psychiatric hospitals and specialized providers participating in Medicare, in their original or legally reproduced form, with authenticated and dated entries sufficient to justify the diagnosis and treatment provided (including radiologic/nuclear medicine reports and printouts, films, scans and other image records as appropriate, discharge plans, and so on).

Retention:  5 years from last entry or change, unless state law requires longer.

DHHS (Medicare)

42 CFR 482.24,26,52

42 CFR 485.48,60

Health care

Medical records in nursing and other long-term care facilities participating in Medicare and Medicaid

Retention:  5 years from date of discharge, unless state law requires longer; for minors, 3 years after patient reaches majority.

DHHS (Medicare, Medicaid)

42 CFR 483.75

Health care

Medical records in rural health clinics participating in Medicare and Medicaid.

Retention:  6 years from last entry, unless state law requires longer.

DHHS (Medicare, Medicaid)

42 CFR 491.10

Health care

Medical  record transactions covered by the Health Insurance Portability and Accountability Act (HIPAA), including authorizations for information disclosures, patient requests for access to records, requests for amendment, requests for accounting of disclosures, requests for additional protections or confidential communications, complaints about practices, records of workforce training on information practices, business associate contracts, and Notices of information practices.

Retention:  6 years from last transaction or when last in effect, 2 years after death of a patient.

DHHS (HIPAA)

45 CFR 164.530

Research

Records associated with contract or grant-funded research.

Retention:  Varies by institution, but 3 to 5 years is modal.

Local policies, based on NIH, EPA GLP, FDA GLP, FDA GCP et al

Research

Animal research records, including Institutional Animal Care and Use (IACUC) records and reports, training files, etc.

Retention:  3 years after end of activity.

NIH, USDA, PHS

Research

Research data generally including all data, notebooks, supporting documentation, financial records.

Retention:  3 years after research completed or until any claim or audit is completed, whichever is later.

OMB-A110.53

2 CFR 215

Research

Records related to research or marking permit from EPA, including specimens, samples of test, control or reference groups.

Retention:  5 years for some research and marketing applications, 2 years for others, following approval or from when investigation is discontinued.

EPA (GCP/GLP)

21 CFR 160.195

Research

Records related to new drug or device application to FDA, including raw data and specimens.

Retention:  5 years for some research and marketing applications related to biologics, 3 years for others, and 2 years for remainder, following approval or from when investigation is discontinued.

FDA (GCP/GLP)

21 CFR 58.195

21 CFR 312.57,62

21 CFR 812.140

Research

Financial records, supporting documents, statistical or other records pertinent to a National Science Foundation (NSF) grant.

Retention:  3 years after the end of the award period, submission of required reports, or after an audit, appeal, litigation or claim is ended.

NSF Grant Policy

NSF 02151, sec. 350a

Research

Data related to patent application.

Retention:  No specified in regulation, but best practice is patent term plus any extensions.

USPTO

37 CFR