How Long Should You Retain Incident Reports?

A phishing email is reported, an employee opens the wrong attachment, or a vendor account is discovered with unnecessary access. The immediate work is clear: contain the issue, investigate it, and protect ePHI. But once the situation is resolved, a practical question remains: how long retain incident reports and the evidence behind them?

For healthcare practices, the safest answer is usually not to delete incident documentation after the immediate problem is closed. HIPAA establishes a six-year federal documentation retention baseline, but an incident may also involve medical record rules, state breach requirements, payer obligations, litigation risk, or contractual duties that require longer retention. The goal is to maintain a defensible record without creating another unmanaged pile of sensitive data.

How Long to Retain Incident Reports Under HIPAA

HIPAA generally requires covered entities to retain required documentation for six years from the date the documentation was created or the date it was last in effect, whichever is later. This requirement applies to documentation required by the HIPAA Privacy Rule and Security Rule, including policies, procedures, risk analyses, training records, sanctions, and actions taken in response to security incidents.

For a typical cybersecurity or privacy incident report, six years is the practical federal minimum to use when the report documents a HIPAA-required security process or response. That includes reports involving suspected unauthorized access to ePHI, malware, lost devices, misdirected communications, inappropriate employee access, or vendor-related security events.

The key word is minimum. HIPAA does not create a universal six-year deletion date for every document connected to an incident. A report may need to remain available longer because it is tied to a patient record, a breach investigation, a legal hold, an insurance claim, or a state-specific retention period.

Why the Incident Report Is More Than a One-Time Record

An incident report is evidence that your practice identified, evaluated, and addressed a security concern. If OCR investigates a complaint or breach, the question is not simply whether an event happened. Regulators may ask what your practice knew, when it knew it, who was responsible for the response, and what corrective actions followed.

A complete report helps answer those questions. It should show the incident date, the people or systems involved, the type of ePHI affected, containment steps, investigation findings, notification decisions, and remediation. It should also connect to supporting records, such as access logs, screenshots, correspondence with a business associate, risk assessment documentation, employee retraining, and updates to policies or technical controls.

Without that paper trail, a practice may have taken appropriate action but struggle to prove it. Scattered email threads and informal notes are difficult to locate, difficult to protect, and difficult to explain during an audit.

When You May Need to Keep Records Longer Than Six Years

A six-year HIPAA baseline does not override other obligations. Before destroying an incident report, determine whether another rule sets a longer timeline.

State laws and medical record retention

States often require healthcare providers to retain patient records for periods longer than six years. If an incident report becomes part of, or is closely tied to, a patient’s designated record set or clinical documentation, the longer applicable requirement may control. Retention rules can vary by state, patient age, provider type, and the nature of the record.

Keep the operational distinction clear: an internal security incident report is not automatically a medical record. However, the report may reference an affected patient, a disclosure, or follow-up care that is documented in the medical record. Your practice should retain each record according to the rule that applies to it rather than applying one blanket schedule to everything.

Breach notification documentation

If an incident becomes a reportable breach, retain the breach risk assessment, notification letters, mailing records, media notice documentation when applicable, business associate communications, and evidence of corrective action with the incident file. HIPAA’s documentation retention requirement supports keeping this material for at least six years.

Because breach claims or regulatory questions can arise well after notification, many practices choose a longer internal retention period for breach files. The right duration should reflect applicable state law, insurance requirements, and advice from qualified legal counsel.

Litigation holds, investigations, and insurance claims

Do not follow a routine destruction schedule when records may be relevant to litigation, a government inquiry, an active patient complaint, or a cyber insurance claim. A legal hold pauses normal deletion. Deleting records after a hold is issued, or when your practice reasonably expects a dispute, can create a separate and serious problem.

The same caution applies when law enforcement, a state attorney general, OCR, or a payer requests information. Preserve the original report and relevant supporting evidence, including logs that might otherwise expire under normal system settings.

Business associate agreements and contracts

Your business associate agreements may require specific cooperation, notification, or record retention practices after a security event. Review contracts with your EHR vendor, managed IT provider, billing partner, cloud provider, and cybersecurity insurer. Contractual requirements do not replace HIPAA obligations, but they can extend the documentation your practice needs to maintain.

Build a Retention Schedule You Can Defend

The most effective approach is to create a written retention schedule that separates incident documentation from the logs, patient records, and supporting materials connected to it. A practical schedule prevents employees from making inconsistent decisions based on folder space or personal judgment.

Your policy should define what counts as an incident record, identify the standard retention period, and state which events trigger extended retention. It should also assign responsibility. In a small practice, the HIPAA Security Officer or compliance lead may own the record, while your IT partner supplies technical evidence and your Privacy Officer manages any patient notification documentation.

A workable policy might establish a six-year minimum for HIPAA security incident reports and related compliance documentation, then require a longer period when state law, patient record rules, contracts, insurance, or legal holds apply. The specific schedule should be reviewed with legal counsel familiar with your state and practice type.

Just as important, define when the retention clock starts. For HIPAA documentation, the six-year period generally runs from creation or from the date the document was last in effect, whichever is later. If your investigation leads to updated procedures, revised policies, or ongoing corrective action, preserve the report and clearly document those dates.

Keep Incident Evidence Organized and Protected

Retention is only useful if records can be located and trusted. An incident folder on one employee’s desktop is not an audit-ready process. Neither is a shared drive with unrestricted access to sensitive investigation notes.

Store incident records in a controlled location with role-based access, version history, and a clear naming convention. Limit access to the people who need it to investigate, manage compliance, or provide legal oversight. Incident files can contain ePHI, employee information, security vulnerabilities, passwords accidentally captured in logs, or details that could increase risk if broadly exposed.

For each event, maintain one complete record that includes the original report, investigation notes, evidence collected, decision-making documentation, notifications, and closure approval. If records are stored in multiple systems, document where the authoritative version lives and who is responsible for preserving it.

A centralized compliance platform such as Veri-Hub can help practices keep incident records, access evidence, training follow-up, policy changes, and audit documentation connected rather than dispersed across spreadsheets, inboxes, and paper files.

Avoid Two Common Retention Mistakes

The first mistake is deleting incident reports too early because the incident appears minor. A failed phishing attempt may not become a breach, but it can still demonstrate a recurring security weakness, support employee retraining, or provide context for a later investigation. Retain the report according to your established schedule.

The second mistake is keeping everything forever without controls. Indefinite retention increases storage costs, creates more sensitive material to protect, and makes it harder to find what matters. A documented retention schedule, applied consistently and suspended when a legal hold applies, gives your practice a far stronger position than either ad hoc deletion or unlimited accumulation.

When an incident occurs, treat the report as part of your compliance evidence from the start. A clear record, a defined retention period, and secure storage give your practice more control when questions arise months or years later.