A storage vendor emails your office manager a renewal quote for 480 boxes. Somewhere in those boxes are the paper charts from a stretch of years when your practice still ran on paper, including workups for meckel's diverticulum disease — the kind of encounter that generates a referral packet, an imaging report, an operative note from a facility you don't own, and a pathology report from a lab you contracted with. You are being asked to pay for another year of storing records nobody has requested since 2016.

This post is about the administrative half of that problem: which retention clock actually governs those records, when the clock starts, how to destroy the records defensibly, and what your shredding and storage vendors owe you in writing. No clinical guidance here. The point is that a single episode of care scatters paper and bytes across four organizations, and your disposal policy has to account for all of them.

How Long Should You Keep Meckel's Diverticulum Disease Records?

There is no HIPAA medical record retention period. HIPAA sets a six-year retention requirement for compliance documentation — policies, risk analyses, BAAs, authorizations, sanctions records — not for the chart itself. Chart retention is set by state law, payer contracts, and federal program participation rules.

Practically, a record from a meckel's diverticulum disease encounter is governed by whichever of these runs longest:

  • Your state's medical record retention statute or board rule — commonly five to ten years from the last date of service for adults.
  • Minor tolling — many states require retention until the patient reaches the age of majority plus a period of years. Because this condition is frequently identified in children, minor tolling is the controlling clock more often than not.
  • Payer and federal program rules — Medicare and Medicaid participation and cost-report obligations commonly push documentation retention to six or seven years, and some managed care contracts go longer.
  • Your malpractice carrier's recommendation — often the longest number in the room, and often the one your policy quietly adopts.

Pick the longest applicable period, write it into a single retention schedule, and stop making case-by-case judgment calls. Discretionary retention decisions made by whoever answers the phone are how practices end up with both illegal early destruction and thirty years of unnecessary risk in a storage unit.

The Three Clocks Running on One Encounter

Clock one: last date of service

Most state retention periods run from the last date of service, not the date of the initial visit. If the patient returned to your practice four years after the surgical episode for an unrelated complaint, and your state ties retention to the last encounter in the record, your disposal date moved. Your practice management system must be able to report last-service-date, not just chart-creation-date, or your purge list will be wrong.

Clock two: age of majority

For a pediatric patient, the clock generally does not begin until the patient turns 18, then runs the statutory period on top. A chart created when a child was six may not be destructible for two decades. Tag pediatric records at creation with a computed destruction-eligible date. Doing this retroactively across a legacy paper archive is a project; doing it at intake is a checkbox.

Clock three: HIPAA's six-year documentation requirement

Separate from the chart, the paperwork that surrounds the chart carries its own six-year clock under the Security and Privacy Rules — including the authorization the patient signed to release the record to the surgical group, the accounting-of-disclosures entry, and the BAA with your record storage vendor. See the HHS overview of the Security Rule requirements. A destroyed chart with a missing authorization form is still an audit finding.

Why Meckel's Diverticulum Disease Records End Up in Four Places

Administratively, this condition behaves like most conditions that route through specialty and surgical care: the primary practice initiates, a specialist evaluates, a facility performs a procedure, and a pathology or imaging vendor produces a report. Each hand-off creates a copy, and each copy has its own custodian and its own retention obligation.

That matters for disposal in two ways. First, destroying your copy does not destroy the record — patients and attorneys can and will obtain it elsewhere, so early destruction on your side creates a gap you cannot explain. Second, records you received from another organization become part of your designated record set and fall under your retention schedule, not theirs.

Build an inventory answering, for each meckel's diverticulum disease-type episode: which systems hold a copy, who is the custodian of each, and what the destruction trigger is. Typical entries:

  • EHR chart notes and problem list — indefinite in the live system, purged only on schedule
  • Scanned referral packet and outside operative note — inside the EHR document module, same schedule
  • Imaging received on disc or through an exchange — often stored in a separate archive with a separate vendor
  • Fax server or secure-message archive holding the original transmission
  • Paper charts in offsite storage boxes
  • Backups and disaster-recovery snapshots that contain deleted records

That last line is the one practices forget. If your retention policy says records are destroyed at year ten and your backup retention says snapshots are kept for eleven, your policy is not accurate. Reconcile the two numbers in writing.

Secure Destruction: What "Shredded" Has to Mean

HHS has been explicit that leaving PHI in a dumpster or an unlocked bin is a violation, and that covered entities must implement reasonable safeguards to limit incidental disclosure during disposal. The department's guidance on disposal of protected health information is short and worth circulating to your whole staff, because most disposal failures are front-desk failures, not IT failures.

Paper

Cross-cut shredding, pulverizing, or incineration. Locked collection consoles in every area that generates paper PHI — front desk, back office, billing, the fax machine, the printer nobody claims. Bins emptied on a schedule, not when they overflow. Staff trained that a recycling bin is not a shred bin.

Electronic media

Follow NIST Special Publication 800-88, Guidelines for Media Sanitization. It gives you the vocabulary auditors expect — clear, purge, destroy — and maps each to media type. Deleting a file is none of the three. Drives leaving your building in a copier, a retired workstation, an imaging server, or a backup tape need a documented sanitization method and a certificate.

The copier problem

Multifunction copiers and scanners store images of everything they process. When a lease ends, the hard drive goes back to the leasing company unless someone stops it. Put copier lease termination on your offboarding checklist and require either drive removal or documented sanitization before the machine leaves the parking lot.

Your Shredding Vendor Is a Business Associate. Get the Paper.

Any vendor that picks up, transports, stores, or destroys PHI on your behalf is a business associate. That includes the shredding company, the offsite box storage company, the IT firm that wipes your retired drives, and the scanning vendor that digitized your legacy charts. Each needs an executed BAA before the first pickup, not after.

Check your current agreements for four things:

  1. Method and standard. The contract names the destruction method and references a standard (cross-cut particle size, NIST 800-88 purge or destroy).
  2. Chain of custody. Locked containers, sealed transport, named handlers, and whether destruction happens on-site in the truck or at a downstream facility.
  3. Subcontractors. If your shredder hands material to a downstream processor, that processor is a subcontractor and must be bound by equivalent terms.
  4. Certificates of destruction. Issued per pickup, listing date, container count or media serial numbers, method, and the signature of the person who performed the work.

If you are renegotiating with a storage vendor at renewal, or bringing on a scanning vendor to eliminate the box inventory entirely, the agreement has to be in place before any material moves. You can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export — a one-time purchase, no subscription — which is faster than waiting three weeks for the vendor's legal department to send back a redline of their own template. Read whatever you sign; a vendor-supplied BAA that omits subcontractor flow-down is worth less than the PDF it arrives in.

The Destruction Log Nobody Builds Until They Need It

When a records request arrives for a chart you destroyed four years ago, the answer "we don't have it" is not sufficient. You need to show the record existed, was retained for the required period, and was destroyed under policy on a specific date.

Maintain a permanent destruction log — permanent, meaning it outlives the records it describes. Minimum fields:

  • Patient identifier or record range (box numbers, date ranges, or account numbers)
  • Record type and format (paper chart, imaging disc, drive serial number)
  • Date range of service covered
  • Retention rule applied and the computed eligibility date
  • Date of destruction and method
  • Vendor name and certificate of destruction reference number
  • Name and role of the staff member who authorized the purge

Keep the certificates attached. Storing the log in the same building as the boxes and nowhere else defeats the purpose.

The moment your practice receives notice of litigation, a subpoena, a board complaint, an OCR inquiry, or a payer audit touching a patient, all scheduled destruction for that patient stops. Not "is reviewed" — stops.

Assign one person the authority to issue a hold and one place to record it. The hold list must be consulted before any purge runs. A practice that destroys a chart on schedule two weeks after receiving a preservation letter has a spoliation problem no retention policy will cure.

Because meckel's diverticulum disease workups often involve emergency presentation and surgical intervention, these are exactly the charts most likely to draw a records request years later. Flag surgical-episode charts for a manual review step before purge rather than letting them flow through an automated batch.

A 60-Day Plan to Get This Off Your Risk Register

Days 1–10. Inventory every location holding PHI: EHR modules, imaging archive, fax server, backups, offsite boxes, on-site closets, copier fleet. Name a custodian for each.

Days 11–20. Confirm your state retention rule and minor-tolling provision in writing. Pull your payer contracts and your carrier's recommendation. Adopt one governing number per record class.

Days 21–35. Audit BAAs against the four-point checklist above. Execute what's missing. Terminate vendors who won't sign.

Days 36–45. Write the policy: retention schedule, destruction methods by media type, legal hold procedure, log format, and role assignments by title. Practices that need the full policy set alongside a documented risk analysis can automate the compliance document build rather than starting from a blank page.

Days 46–60. Train staff on bins, copiers, and the hold list. Run the first documented purge. File the certificates.

Then calendar an annual review. Retention rules change, vendors change, and the storage invoice arrives every year whether or not anyone opened the boxes.

Start With the Contract

You cannot defensibly destroy records with a vendor you have not papered. Before the next pickup, build the Business Associate Agreement your shredding and storage vendors should have signed, export it as PDF or DOCX, and get it countersigned. It takes about ten minutes and it is the single piece of documentation an investigator will ask for first.