Your referral coordinator runs a doctors NPI number search, confirms the cardiologist's taxonomy code and practice address, prints the registry page, staples it to the referral packet, and scans the whole thing into the patient's chart. That printout is now part of a designated record set. It has a retention clock. It has a destruction requirement. And in most practices, nobody has ever written down what either one is.

This post is for the person who owns records policy — the practice administrator, privacy officer, or compliance lead who has to answer when a state surveyor, a payer auditor, or an OCR investigator asks how long you keep things and how you get rid of them. It covers what a doctors NPI number search actually generates in your files, the three separate retention clocks that apply, and what "secure destruction" means when the media is a scanned PDF instead of a manila folder.

What a Doctors NPI Number Search Actually Creates in Your Files

The lookup itself takes eleven seconds. The paperwork it spawns lives for years.

Walk through a single referral. Your coordinator queries the NPI registry to verify a specialist's identifier before sending records. She saves a screenshot to the referral folder on the shared drive. She logs the referral in the EHR, which writes the receiving provider's NPI into a directory table. She sends the records, which creates a disclosure entry. If the specialist is out of network, she also files a note in the prior-authorization packet. If the specialist later joins your group, that same NPI shows up in a credentialing file with a primary source verification printout attached.

One search, five artifacts, four different systems, and at least three different retention obligations. That is the administrative reality nobody diagrams during onboarding.

The five places lookup artifacts accumulate

  • Referral and care coordination folders — screenshots, faxed cover sheets, provider directory printouts
  • Credentialing and enrollment files — primary source verification records, CAQH attestations, payer enrollment packets keyed to the NPI
  • Claims and billing workpapers — rendering and referring provider NPI on every claim, plus denial and appeal correspondence
  • Release of information logs — the record of what you disclosed, to whom, and under what authority
  • EHR provider master tables — structured data that persists after the human-readable printout is shredded

If your retention schedule only lists "medical records" and "billing records," you have three of these five categories floating without an owner.

The Public Registry Is Not PHI. Your Search Log Might Be.

This distinction drives everything else, so get it right before you write policy.

The National Plan and Provider Enumeration System data published at the CMS NPI Registry is public. Provider name, NPI, taxonomy, practice location, and enumeration date are disclosable to anyone with a browser. A bare printout of a registry page, sitting alone on a desk, contains no protected health information and carries no HIPAA retention obligation.

The moment that printout is stapled to a referral for Mrs. Alvarez, it becomes part of a record that identifies an individual and relates to the provision of care. Same paper, different legal status. Your staff will not intuit this, which is why the policy has to state it plainly.

Rule of thumb for the front desk: registry data on its own is public. Registry data attached to a patient name, an encounter, a claim, or a referral is PHI and follows chart rules.

The same logic applies to credentialing files. An NPI and a taxonomy code are public. The background check report, the malpractice history, and the Social Security number in the enrollment packet are not, and some of that material falls under the FTC Disposal Rule if you pulled a consumer report during credentialing. Two federal disposal standards can apply to a single folder.

Short answer, for the person who searched this exact question:

  • HIPAA policies, procedures, and required documentation: six years from creation or from the date last in effect, whichever is later (45 CFR 164.316(b)(2)(i)).
  • Accounting of disclosures: six years, per 45 CFR 164.528.
  • The medical record itself: HIPAA sets no period. Your state licensing statute does, and periods commonly run five to ten years for adults and longer for minors.
  • Payer and program records: governed by your participation agreements and federal program rules, which frequently run longer than state chart minimums.
  • Credentialing files: governed by accreditation standards and payer contracts, typically retained through at least one full recredentialing cycle plus the applicable claims lookback.

The operating principle: the longest applicable clock governs the whole artifact. You do not get to shred a referral packet on the state chart schedule if a payer contract requires ten years of supporting documentation for the associated claim.

Three Retention Clocks That Run at Different Speeds

Clock one: the six-year HIPAA documentation clock

This one is federal, uniform, and the one most practices get wrong because it applies to documents people do not think of as records. Your sanction policy, your risk analysis, your workforce training rosters, your disclosure accounting, your business associate agreements — all six years, and the clock on a policy restarts when the policy is superseded. A privacy policy written in 2019 and replaced in 2024 is retained until 2030. Full text of the requirement sits in the HHS regulatory library.

Clock two: the state chart clock

Set by your medical practice act or health department regulation, not by HIPAA. It varies by state, by patient age at the time of service, and sometimes by record type. The practical failure mode is a multi-state group applying the shortest state's schedule everywhere because it is simpler. That is a compliance finding waiting to happen, and it is also a records-request problem when a patient who was seen in two states asks for a complete chart.

Clock three: the payer and program clock

Participation agreements set their own documentation retention terms, and federal health program rules impose their own. Pull the actual contract language rather than relying on what your billing manager remembers. CMS publishes program manuals and record requirements through cms.gov; when contract terms and state minimums conflict, the longer period wins in your schedule.

Secure Destruction: What "Cannot Be Reconstructed" Actually Requires

HHS guidance on disposal of protected health information does not prescribe a single method. It requires that PHI be rendered essentially unreadable, indecipherable, and otherwise incapable of reconstruction. Placing paper in a dumpster, a recycling bin, or an unlocked bin awaiting pickup does not meet that bar — improper disposal remains a recurring category in reported breaches on the OCR breach portal.

For paper artifacts — the stapled registry printouts, the faxed referral confirmations, the credentialing packets — cross-cut shredding or pulping performed on site or by a bonded vendor under lock-and-key chain of custody. For electronic media, NIST Special Publication 800-88 Revision 1 is the reference your IT vendor should already be citing. It distinguishes clear, purge, and destroy, and it tells you which is appropriate for a given media type and risk level.

The three destruction gaps I find most often

  1. The scanner cache. Multifunction copiers store images on internal drives. When the lease ends and the device goes back, that drive leaves with it unless someone purges or destroys it. Put device return in your offboarding checklist and get a certificate.
  2. The shared drive folder. Referral screenshots saved to \\shared\\referrals\\2019 are backed up, replicated, and never purged. Deleting the folder does not touch the backups. Your retention schedule needs a matching backup expiration policy or the two work against each other.
  3. The EHR provider directory. Structured NPI records in the provider master table survive every paper purge you run. Decide whether that table is in scope for your schedule and document the answer either way.

Your Shredding and Records Vendors Are Business Associates

A document destruction company that picks up bins containing PHI creates, receives, maintains, or transmits PHI on your behalf. So does your release-of-information vendor, your offsite storage facility, your scanning bureau, and the credentialing verification organization that processes packets keyed to a doctors NPI number search. Every one of them needs a signed business associate agreement on file before the first pickup, not after the first incident.

Check the agreements you already have. The common defects are agreements signed by an entity that no longer exists after an acquisition, agreements with no termination-and-return-or-destroy provision, and agreements that predate the current breach notification requirements. If a vendor cannot produce a countersigned copy within a business day, treat that as an unsigned agreement.

If you are papering a new shredding contract or a records storage renewal this quarter, you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription, which matters when you need three agreements this month and none next quarter.

Building the Destruction Log Your Auditor Will Ask For

Destruction without documentation is indistinguishable from loss. When a plaintiff's attorney requests a chart you destroyed on schedule, the log is your defense; without it, you are explaining an absence.

Every destruction event, paper or electronic, should capture:

  • Description of the records or media, including date range and record type
  • Volume — box count, file count, or device serial numbers
  • Authorizing retention rule, cited by policy section
  • Method used and standard applied
  • Date, location, and the vendor or workforce member who performed it
  • Certificate of destruction, filed with the log entry
  • Approving signature from the privacy officer or designee

Keep the log for at least the six-year HIPAA documentation period. Some practices keep destruction logs permanently, which is a defensible choice because the log itself contains no PHI when it is written at the batch level.

A 90-Day Cleanup Plan

Days 1–15. Inventory. List every location where lookup artifacts land: shared drives, EHR modules, credentialing folders, offsite storage, fax servers, scanner queues. Name a single owner for each location. Do not skip the fax server.

Days 16–40. Build the schedule. One row per record type. Columns for state minimum, payer contract minimum, HIPAA documentation requirement, governing period, destruction method, and owner. Have counsel review the state column.

Days 41–60. Reconcile vendors. Match every entry on the schedule to a vendor and every vendor to a current, countersigned agreement. Close the gaps.

Days 61–75. Train by role. The referral coordinator needs the PHI-versus-public-registry rule. The credentialing specialist needs the dual-standard rule for consumer report material. The office manager needs the destruction log. Fifteen minutes each, documented on a roster you retain for six years.

Days 76–90. Run one destruction cycle end to end and audit your own paperwork. If the log is missing a certificate or a policy citation, fix the process now rather than during an investigation.

The practices that handle this well treat a doctors NPI number search as the first step in a records lifecycle, not a throwaway lookup. If your retention schedule, policies, and risk analysis need to be rebuilt rather than patched, automated HIPAA policy and risk analysis document generation will get you a defensible baseline faster than starting from a blank template — and when the vendor agreements come due, the BAA generator handles the paperwork in an afternoon.