Healthcare data security for the records you keep: retention, access logs and breach deadlines

Most writing on healthcare data security stops at firewalls and phishing training. The questions that reach a practice manager are narrower: how long do we keep this chart, who opened it last Tuesday, do we have to report the missing laptop, and how fast must we answer the patient who wants a copy?

This guide to healthcare data security answers those four. In the US, three parts of HIPAA cover them: the Security Rule (safeguards for electronic records), the Privacy Rule (disposal and the patient's right of access) and the Breach Notification Rule (who you tell, and by when). State law fills the gap HIPAA leaves on retention.

The catch is that the rules follow a record for its whole life. A consent form signed in 2026 may still be your responsibility in 2036.

Still choosing how patients sign their forms? Our guide to signing patient forms electronically covers that half, and the Chaindoc healthcare page lists the documents clinics send through us.

In the US, most of healthcare data security runs through one regulation, and the numbers above show where it gets tested. Four in five large breaches were hacking or IT incidents, and the data most often sat on a network server. So the HIPAA Security Rule requirements that matter most for stored records are about who can reach the server, whether you'd notice, and whether you could rebuild it.

Each implementation specification is labeled required or addressable. Addressable isn't a polite word for optional: you implement it, use a reasonable alternative, or document why neither fits.

Healthcare data security requirements for stored records

• Risk analysis (required) under 45 CFR 164.308(a)(1)(ii)(A): an accurate and thorough assessment of the risks to electronic protected health information (ePHI), covering every system that holds records.
• Information system activity review, also required: regular review of audit logs, access reports and incident tracking.
• Access authorization and termination (addressable). Someone decides who gets in, and access ends when the job does.
• Log-in monitoring, addressable: watch failed attempts and report what looks wrong.
• Backups and disaster recovery (required): "retrievable exact copies" of ePHI and a way to restore lost data.
• Unique user IDs (required), so every action traces back to one person.
• Audit controls under 164.312(b) and integrity protection under 164.312(c)(1).

Encryption of stored records is addressable too, and it pays off most after an incident. All of it goes in writing: under 164.316(b), policies and required assessments are documentation you keep six years from creation or last effective date, whichever is later.

Honestly, the backup line is the one practices underrate. A backup you've never restored from is a hope, not a plan.

Search for HIPAA retention requirements and you'll see "six years" everywhere. It's true, just about the wrong documents.

The six-year clock in 45 CFR 164.316(b)(2) and 164.530(j) covers HIPAA's own paperwork: policies, risk analyses, privacy notices, complaint files. It runs from creation or the date a document was last in effect, whichever is later, so a policy retired in 2026 stays archived until 2032.

The medical record is another matter. HHS states that the Privacy Rule has no medical record retention requirement and that state laws generally decide. What HIPAA demands is protection for as long as you hold the record, through disposal. Federal programs add floors: hospitals in Medicare keep medical records at least five years under 42 CFR 482.24(b)(1).

So several clocks run at once: the state's period for the chart, payer and program rules, HIPAA's six years for the paperwork, your malpractice insurer's expectations. The longest one wins. Our breakdown of how retention periods stack up shows how to build one schedule from all of them.

Retention is the part of healthcare data security people forget, because nothing breaks on the day you get it wrong. A habit worth borrowing from large hospitals: write the destruction date down when the record is created. It turns a judgment call ten years from now into a line item.

HIPAA audit log requirements come from two lines that only work as a pair. The audit controls standard, 45 CFR 164.312(b), has you record and examine activity in systems holding ePHI. The activity review specification, 164.308(a)(1)(ii)(D), has you review those records regularly. A log nobody reads meets the first and fails the second, and logs are where healthcare data security stops being a policy and becomes something you can prove.

What a useful access log captures

Picture the patient asking, "Who looked at my file?" Each entry needs:

1. 1.
   The person, by their own login. Shared accounts make this impossible.
2. 2.
   The record they touched.
3. 3.
   What they did: opened, edited, exported, printed or deleted.
4. 4.
   When, to the minute.
5. 5.
   Where from, and whether it worked. Failed attempts are often the interesting ones.

Integrity is the other half. Under 164.312(c)(1) you protect records against improper alteration. German law is blunter: under § 630f BGB a correction is allowed only if the original entry and the date of the change stay recognizable, in electronic files too. It's a good rule even where nobody requires it. Our guide to what a defensible audit trail records goes field by field.

HIPAA log retention requirements

No line in HIPAA says "keep audit logs for X years". The six-year rule covers documentation, including the record of your reviews. Our view: keep the logs on the same clock. It's the period an OCR investigator already thinks in, and a deleted log can't settle who opened a chart.

When healthcare data security fails, the HIPAA breach notification rule (45 CFR 164.400 to 164.414) decides what happens next. It starts from a presumption: any use or disclosure of PHI the Privacy Rule doesn't permit is a breach, unless a written risk assessment shows a low probability the information was compromised. The assessment weighs at least four factors:

• the nature and extent of the information, including how easily it could be re-identified;
• who used or received it;
• whether it was actually acquired or viewed;
• how far you've mitigated the risk.

Three narrow exceptions exist, such as a staff member who opens the wrong chart in good faith, within their role, and goes no further. Everything else gets the assessment, or you simply notify.

The deadlines, as HHS's summary of the Breach Notification Rule sets them out:

Patients. Written notice by first-class mail, or email if they agreed to it, without unreasonable delay and within 60 days of discovery: what happened, which information, what they should do, what you're doing, how to reach you. If 10 or more addresses are out of date, a substitute notice goes on your website for 90 days or in major media, with a toll-free number live for 90 days.

The media. More than 500 residents of one state or jurisdiction affected? Prominent outlets there hear from you on the same deadline.

HHS. For 500 or more people, report through the HHS portal within the same 60 days. For fewer, log it and report the year's breaches within 60 days after the year ends. That's where 2024's 74,299 small reports came from.

The covered entity, if you're the vendor. A business associate reports within 60 days of discovery, naming affected people where it can.

The burden of proof is yours: every notice sent, or the assessment showing none was needed. Keep that file as carefully as the records it's about.

A patient asking for their own record is a healthcare data security event too, just a friendly one. You confirm who's asking, find everything, and hand it over without leaking anyone else's data.

Under 45 CFR 164.524 you act within 30 days. One extension of up to 30 more days is allowed, and only if you tell the patient in writing, inside the first 30, why and by when. If the record is electronic and readily producible in the form they ask for, a PDF say, that's what they get. Fees must be reasonable and cost-based: copying labor, supplies, postage. Search and retrieval aren't on that list.

Other systems move faster. Article 15(3) GDPR makes the first copy free across the EU. In Germany, § 630g BGB gives patients access to their full file without undue delay, first copy free. France allows eight days, or two months for information over five years old, after a 48-hour reflection period.

What makes requests painless is knowing where every part of a record lives and being able to export it without retyping.

Shared drives are where healthcare document management quietly goes wrong: a referral scanned into a personal folder, a link set to "anyone with the link". Here's what each vendor's own help pages said when we read them on October 14, 2026.

Dropbox. Admins of certain team plans (Standard, Advanced, Enterprise and Education are among those listed) can sign a business associate agreement (BAA) electronically from the admin console. That's available only to US-based customers, and third-party apps connected to Dropbox aren't covered by it.

Google Drive. Administrators must review and accept a BAA in the Admin console before using PHI in Google services, and customers without one must not use PHI in Google Workspace or Cloud Identity. Which services the BAA covers sits on a separate Google list, so check Drive is on it for your edition. The page speaks to Workspace and Cloud Identity customers only; nothing on it extends the BAA to a personal account.

Credit where it's due: both make the BAA a self-service step that takes minutes, not a sales call. Still, "is Dropbox HIPAA compliant" has the usual answer. No product is compliant by itself; an account becomes usable for PHI once the BAA is signed, sharing defaults are locked down and attached apps are reviewed.

Apply the same test to healthcare data security companies selling backup or monitoring: what do they log, who on their side can read your data, and which products does their BAA name?

Chaindoc covers one slice of healthcare data security, the documents that need a signature: consent forms, intake packets, referral agreements, staff and supplier contracts. It isn't an electronic health record and shouldn't be the only place a chart lives. For what it does hold:

• Certification. ISO 27001 for information security management and ISO 9001 for quality management; the ISO 27001 certification audit is our only external audit.
• Transport over TLS, and no end-to-end encryption. Our servers read files to convert, scan and sign them; what we encrypt with AES-256 is the private signing keys. If your risk analysis needs a vendor that can't read stored files, that's not us.
• Who can open what. Roles in team workspaces keep intake forms with the front desk and invoices with billing.
• A signing audit trail for each document, exportable as a PDF for your own archive.
• On chain, and only this. A document's version fingerprint when you publish it, and each signer's proof when they complete. Files, contents, identities and views stay off chain.
• Optional identity checks for signers, never a required step.

Files live in Chaindoc's own library, with no connector to your Drive or S3, so your retention schedule needs an export step. Plan it now rather than in a contract's last week.

What we won't do is call Chaindoc "HIPAA compliant". Whether HIPAA applies depends on whether you're a covered entity, a business associate or neither; if you're one of the first two, raise the BAA question with us in writing before any patient data goes in.

Abroad, the same questions come with different deadlines. Under Article 33 GDPR, a breach goes to the supervisory authority within 72 hours of becoming aware of it, unless it's unlikely to put anyone at risk. That's twenty times faster than HIPAA's outer limit. Brazil's LGPD asks for security measures against unauthorized access (art. 46) and for incident reports to the ANPD and the patient when there's a risk of relevant harm (art. 48). Mexico's NOM-004-SSA3-2012 treats what patients tell their care team as confidential under medical secrecy. Retention periods for each country are in the table above.

Short on time this quarter? Spend it where the 2024 numbers point.

1. 1.
   Access first. Four in five large breaches were hacking or IT incidents. Own logins for everyone, access that ends the day someone leaves, and multi-factor sign-in wherever your systems allow it.
2. 2.
   Backups you've actually restored from, out of reach of an attacker on your network.
3. 3.
   A log review with a name on it: who reads the access logs, how often, where the notes go.
4. 4.
   A retention schedule listing every clock (state, program, HIPAA documentation) and the date each record can go.
5. 5.
   A breach file ready before the breach: the four-factor template, a draft patient letter, the HHS portal steps, and the 60-day date written down on day one.
6. 6.
   A record-request routine that finds everything about one patient and exports it in a format they can open.

None of it needs new software. It needs one person with the time and the authority to do it. That's what healthcare data security comes down to: dull jobs done on schedule, written down, repeatable when an auditor or a patient asks.