Data Retention and Destruction Policy – Center for Wellness International

Effective Date: June 3, 2025

1. Purpose and Scope

This Data Retention and Destruction Policy outlines the procedures for the Center for Wellness International (“we,” “us,” or “our”) regarding the retention and secure destruction of records and information, including Protected Health Information (PHI) and other personal or sensitive data. This policy applies to all data, regardless of its format (e.g., paper, electronic, audio, video), created or maintained by our staff, therapists, trainees, and business associates.

The purpose of this policy is to:

• Ensure compliance with federal and state laws and regulations, including HIPAA (Health Insurance Portability and Accountability Act) and North Carolina state laws governing record retention for healthcare providers.
• Protect the privacy and security of client and organizational information.
• Manage data efficiently and minimize risks associated with retaining data beyond its necessary and legally required timeframe.
• Ensure that data is destroyed in a secure and appropriate manner.

2. Definitions

• Protected Health Information (PHI): As defined by HIPAA, individually identifiable health information related to an individual’s past, present, or future physical or mental health or condition, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
• Client Record: Any record, regardless of medium, that documents the assessment, planning, provision, and/or evaluation of services provided to a client. This includes, but is not limited to, intake forms, progress notes, treatment plans, psychological assessments, billing records, and correspondence related to client care.
• Business Records: Records related to the administrative, financial, and operational aspects of the Center for Wellness International, not including client-specific PHI unless directly related to billing or payment for services.
• Data Custodian: Individuals or departments responsible for the creation, maintenance, and eventual destruction of specific types of data (e.g., therapists for their client records, administrative staff for billing records). The designated Privacy Officer oversees the overall implementation of this policy.
• Retention Period: The specific length of time data must be kept.
• Destruction: The process of permanently and irreversibly destroying data so that it cannot be reconstructed or retrieved.

3. Record Retention Schedules

The following retention schedules are based on applicable legal requirements and professional standards. If federal and state laws differ, the longer retention period will apply.

• Client Clinical Records (Adults):
  • Minimum Retention Period: [E.g., 7 years from the date of last service, or longer if required by specific North Carolina law or payer contracts. North Carolina law (10A NCAC 26C .0103) generally requires adult client records to be retained for 7 years after the last date of service, or if the client is deceased, 2 years after death, whichever is longer. Verify specific requirements.]
  • Rationale: Compliance with state licensing board regulations, HIPAA, and statute of limitations for potential legal actions.
• Client Clinical Records (Minors):
  • Minimum Retention Period: [E.g., Until the client reaches the age of [e.g., 21 or 22, typically age of majority plus a specified number of years], or 7 years from the date of last service, whichever is longer. North Carolina law (10A NCAC 26C .0103) generally requires minor client records to be retained until the client reaches age 20, or for 7 years after the last date of service, whichever is longer. Verify specific requirements.]
  • Rationale: Compliance with state licensing board regulations, HIPAA, and considerations for the statute of limitations extending beyond the age of majority.
• Billing and Financial Records (Related to Client Services):
  • Minimum Retention Period: [E.g., 6 years from the date of creation or last entry, as required by HIPAA for records related to accounting of disclosures, or longer if required by state financial regulations or payer contracts. North Carolina may have specific requirements for financial records.]
  • Rationale: HIPAA compliance, financial auditing, and tax purposes.
• Business and Administrative Records (Non-PHI):
  • Minimum Retention Period: Varies depending on the record type (e.g., contracts, personnel files, general ledger). Generally, [e.g., 3 to 7 years], unless a longer period is required by law or for operational needs.
  • Rationale: Legal, operational, and financial requirements.
• Psychotherapy Notes (If Maintained Separately from the Client Record):
  • Minimum Retention Period: While psychotherapy notes have special protections under HIPAA, their retention should align with the client’s clinical record unless specific legal counsel advises otherwise. [E.g., Same as client clinical record].
  • Rationale: Professional practice, potential future reference if authorized by the client.
• Research Data (If Applicable):
  • Minimum Retention Period: As specified by institutional review board (IRB) protocols, funding agency requirements, or publication agreements.
• Superseded Policies and Procedures:
  • Minimum Retention Period: [E.g., 6 years from the date the policy was superseded, per HIPAA requirements for policy documentation].

4. Data Storage and Security During Retention Period

• All records, whether paper or electronic, will be stored securely to protect against unauthorized access, use, disclosure, loss, or damage.
• Electronic Records: Stored on secure servers with appropriate access controls, encryption (where feasible and appropriate), and backup procedures.
• Paper Records: Stored in locked cabinets or rooms with restricted access.
• Access to records will be limited to authorized personnel based on their roles and responsibilities.
• Our Privacy Policy and Security Policy provide further details on data protection measures.

5. Data Destruction Procedures

Once the applicable retention period has expired, records will be destroyed in a secure and confidential manner that renders the information irretrievable.

• Electronic Data Destruction:
  • Methods may include: overwriting, degaussing, cryptographic erasure, or physical destruction of the storage media (e.g., shredding hard drives, pulverizing).
  • Simply deleting files may not be sufficient. Secure deletion utilities or physical destruction will be used.
  • Data stored on backup media will be destroyed according to the same schedule as the original data.
• Paper Record Destruction:
  • Methods include: cross-cut shredding, pulverizing, or incineration by a bonded and reputable professional document destruction service.
  • Records should not be placed in regular trash or recycling bins without prior secure destruction.
• Documentation of Destruction:
  • A log or certificate of destruction will be maintained for all PHI and other sensitive records destroyed. This documentation should include:
    • Date of destruction.
    • Method of destruction.
    • Description of the records destroyed (e.g., client name/ID range, date range of records).
    • Signature of the individual(s) supervising or performing the destruction.
    • If a third-party service is used, a certificate of destruction from the vendor.
  • This destruction log will be retained for [e.g., 6 years].

6. Legal Holds and Exceptions to Destruction

• If we are notified of any pending or reasonably foreseeable litigation, audit, government investigation, or other legal matter that may involve certain records, those records will be placed under a “legal hold.”
• A legal hold suspends the normal destruction schedule for the identified records. These records will be preserved until the legal hold is lifted by legal counsel or the designated authority.
• The Privacy Officer will be responsible for managing and communicating legal holds.

7. Roles and Responsibilities

• Privacy Officer: Responsible for overseeing the implementation and enforcement of this policy, providing guidance on retention periods, managing legal holds, and ensuring staff are trained.
• Therapists and Staff: Responsible for understanding and complying with this policy, managing records under their control according to the established schedules, and participating in secure destruction processes as directed.
• IT Department/Personnel (if applicable): Responsible for implementing secure destruction methods for electronic data and ensuring the security of stored electronic records.

8. Policy Review and Updates

This Data Retention and Destruction Policy will be reviewed [e.g., annually] or as needed to reflect changes in legal, regulatory, or operational requirements. Any updates will be communicated to all relevant personnel.

9. Training

All staff with access to or responsibility for records will receive training on this policy upon hiring and periodically thereafter.

10. Contact Information

For questions regarding this policy, please contact:

Privacy Officer Center for Wellness International [Insert Physical Address] [Insert Phone Number] [Insert Email Address for Privacy Inquiries]

Note to the Center for Wellness International:

• Fill in the bracketed information (e.g., specific retention periods based on your legal counsel’s advice and North Carolina law, contact details).
• Crucially, verify North Carolina specific laws: State laws for medical record retention, especially for mental health records and records of minors, can be very specific and may differ from general HIPAA guidelines. Consult with legal counsel licensed in North Carolina specializing in healthcare law to confirm all retention periods.
• Payer Contracts: Review contracts with insurance companies, as they may stipulate longer retention periods for records related to their members.
• Psychotherapy Notes: The retention of psychotherapy notes (if kept separate from the main clinical record) should be carefully considered with legal counsel. While they have special privacy protections, their destruction timeline often aligns with the main record.
• Destruction Log: Emphasize the importance of maintaining a detailed destruction log.
• Training: Ensure staff are thoroughly trained on these procedures.
• Consistency: Ensure this policy is consistent with your other policies, such as the Privacy Policy and Security Policy.