There are eleven banker's boxes in the storage closet behind your billing office, and nobody in the building can tell you what year they close out. One of them is labeled "DERM REFERRALS 2016–2018." Inside are intake forms, printed photo sheets, and faxed consult letters from a dermatology group that no longer exists. If you are the person who signs the shredding vendor's work order, those boxes are your problem.

This article is about the records side of a routine finding like nail pitting — how long you keep the chart, the photos, and the referral packet; when the destruction clock actually starts; and what "secure destruction" has to look like when a regulator asks. It is not clinical guidance. The only clinical fact that matters here is administrative: findings like nail pitting frequently move a patient between primary care, dermatology, and rheumatology, which means the record fragments across organizations and formats. Fragmented records are the ones that outlive their retention schedule.

What a Nail Pitting Encounter Actually Leaves Behind

Before you can retire anything, you have to know what exists. A single visit involving a nail finding typically produces more discrete artifacts than staff expect:

  • The encounter note in your EHR, plus any scanned intake or symptom questionnaire.
  • Clinical photographs — often several per digit — captured on a practice device, a personal phone, or a dedicated imaging system.
  • A referral packet: demographics, insurance card scans, the note, and the images, sent by fax, direct message, or portal.
  • The specialist's consult letter coming back to you, plus any pathology or lab report if tissue or specimen work was ordered.
  • Prior authorization correspondence and payer appeal documentation.
  • Telephone messages, portal messages, and fax transmission confirmations that name the patient.

Every item on that list is protected health information. Six of them commonly live outside the EHR — in a fax log, a shared drive, a photo app, a payer portal export folder on someone's desktop. Your retention policy probably covers the first item and ignores the rest.

Build the inventory before you build the schedule

Assign one person — usually the privacy officer or practice manager — to produce a one-page artifact map for your highest-referral service lines. Column one: artifact. Column two: system of record. Column three: who owns deletion. Column four: retention trigger. If column three is blank for any row, that row is where your next incident comes from.

How Long Must You Keep Nail Pitting Records?

Short answer: HIPAA does not set a medical record retention period. HIPAA requires six years of retention for Privacy and Security Rule documentation — your policies, Notices of Privacy Practice, authorizations, risk analyses, business associate agreements, and disposition records — measured from the date of creation or the date it was last in effect, whichever is later (45 CFR 164.316(b)(2)(i) and 164.530(j)(2)).

The chart itself is governed by state law, payer contracts, and your professional liability carrier. State minimums for adult records commonly run five to ten years from the last date of service. Records for minors typically run to the age of majority plus a state-specified number of years. Medicare and Medicaid participation obligations and managed care contracts frequently impose longer periods than your state floor. Your operative retention period is always the longest applicable clock, not the average.

The Three Clocks That Govern Nail Pitting Charts

Clock one: the HIPAA six-year documentation clock

This one is misquoted constantly. Staff hear "HIPAA says six years" and apply it to charts. It does not apply to charts. It applies to the compliance paperwork surrounding them — including, importantly, your certificates of destruction and your log of what was destroyed. When you shred the 2016 referral boxes, the record of that shredding becomes a six-year document in its own right.

Clock two: the state record clock, measured from last date of service

Note the trigger. It is not the date of the nail pitting visit. It is the last date of service in the chart. A patient seen once in 2019 for a nail finding, then again in 2024 for something unrelated, has one chart with one clock, and that clock reset in 2024. Practices that purge by encounter date rather than by patient last-activity date destroy records they were required to hold.

Clock three: minors, and the start date that isn't the visit

For pediatric patients, the clock typically does not begin until the patient reaches the age of majority. A chart created for a 6-year-old may need to survive into the 2040s. Your EHR's automated purge rules must read date of birth, not date of service, or you will lose records you are legally obligated to produce.

The moment your practice receives a subpoena, a records request from a plaintiff's attorney, a notice of intent to sue, a board complaint, or an OCR investigation letter, scheduled destruction for the affected records stops. Not "after we check with counsel" — immediately.

Write the hold procedure down and rehearse it. The steps are simple and they fail anyway: front desk routes the notice to the privacy officer same day; privacy officer flags the chart in the EHR with a hold indicator; privacy officer emails the offsite storage and shredding vendors to suspend pickup for the identified boxes; privacy officer logs the hold with a date and a release condition. Destroying records under hold is a discovery problem and a credibility problem at the same time.

Clinical Photographs Are the Retention Problem Nobody Schedules

Nail findings get photographed. Photographs are where retention discipline collapses, because the image usually exists in more places than the chart does.

Run this check this quarter. Pick three staff devices used for clinical photography and ask: does the camera roll still hold patient images? Is the device backed up to a personal cloud account? Did anyone text an image to a referring physician? Was the photo emailed to a specialist's office and left in a sent folder indefinitely?

Every one of those copies inherits the same retention obligation and the same destruction obligation as the original. If your policy says charts are destroyed at year ten and a copy of the same nail pitting image sits in a personal photo library at year fourteen, your policy is a document, not a control.

The fix is procedural, not technical: images move from the capture device into the designated system of record within one business day, and the capture device is wiped on a schedule that a named person signs off on. Practices that allow personal-device photography without an enforced ingest-and-wipe step should stop allowing it.

What "Secure Destruction" Legally Means

HHS guidance is direct: PHI must be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed." Read the agency's guidance on proper disposal of protected health information and hand it to whoever manages your storage closet.

In practice, that means:

  • Paper: cross-cut shredding, pulping, or incineration. Not a recycling bin. Not a locked bin that is emptied into a dumpster. OCR has resolved multiple enforcement matters involving paper records left in unsecured containers or on open ground — including an $800,000 settlement with a health system over records left unattended in a physician's driveway.
  • Hard drives, laptops, copiers, and imaging workstations: sanitization consistent with NIST Special Publication 800-88, Guidelines for Media Sanitization. Note that copiers and multifunction fax machines store images on internal drives. Leased equipment returned without sanitization is a breach waiting to be discovered by the next lessee.
  • Cloud and EHR data: deletion per your vendor's documented process, with written confirmation. "We deleted it" in a support ticket is thin. Ask for the vendor's data destruction attestation in writing.

Improper disposal is reportable. If shredded-but-legible records blow across a parking lot, run the four-factor breach risk assessment and check the HHS breach portal to see how many of your peers have already filed under "Improper Disposal."

Your Shredding Vendor Is a Business Associate

A document destruction company that takes custody of PHI — on site or off — is a business associate. So is your offsite storage facility. So is the IT firm that wipes and resells your old imaging workstations. So is the scanning bureau that digitized those eleven boxes.

Each needs a signed business associate agreement before the first pickup, and each agreement needs a real termination clause covering return or destruction of PHI at the end of the relationship (45 CFR 164.504(e)(2)(ii)(J)). If you inherited a vendor list with missing paperwork — and most practice managers do — you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX. One-time purchase, no subscription, which matters when you need four agreements this month and none next month.

What to demand from a destruction vendor beyond the BAA

  • A certificate of destruction for every pickup, listing date, container count or weight, and method. File it; it is six-year HIPAA documentation.
  • Named, background-checked personnel and a chain-of-custody log from your closet to the shredder.
  • Written notice if they subcontract. A subcontractor handling your PHI needs its own downstream agreement.
  • Breach notification terms with a specific number of days, not "promptly."

A Destruction Calendar You Can Actually Run

Annual purges fail because nobody owns them. Quarterly ones with named roles work. Here is a workable cycle:

  1. January, privacy officer: pull a report of charts whose last date of service falls outside the longest applicable retention period. Exclude minors under the age-of-majority rule. Exclude anything under legal hold.
  2. February, records clerk: pull the corresponding paper boxes and imaging exports. Reconcile the list against physical inventory. Discrepancies get investigated, not shrugged at.
  3. March, practice manager: approve the destruction list in writing. This signature is the control that keeps a well-meaning employee from clearing a closet unilaterally.
  4. March, vendor: destruction executed; certificate returned within ten business days.
  5. April, privacy officer: file certificates, update the disposition log, and confirm that corresponding EHR and image-archive records were purged in the same cycle. Paper and digital must move together or you will produce a partial chart under subpoena and look like you are hiding something.

Worked example

Adult patient, single visit in March 2015 for a nail pitting evaluation, referred out to dermatology, consult letter returned June 2015, no further contact. State minimum is ten years from last date of service. Payer contract requires seven. Liability carrier recommends holding through the statute of repose. Longest clock governs: the chart becomes eligible for destruction in the 2026 quarterly cycle — but only after confirming the returned consult letter, the referral fax log, and the four clinical photographs in the image archive are all included in the same destruction batch. One artifact left behind means the record still exists, still must be produced, and still must be protected.

Write the Policy So a New Hire Can Follow It

Your retention and disposal policy needs five named elements: the retention period for each record type, the trigger date, the destruction method by media type, the person who authorizes destruction, and the documentation retained afterward. If any of those is described as "as applicable" or "per regulation," rewrite it with an actual number and an actual job title.

If you are building the surrounding document set from scratch — retention schedule, sanitization procedure, vendor management policy, and the risk analysis that ties them together — you can automate the full HIPAA policy and risk analysis set rather than assembling it from templates of unknown provenance. However you produce it, review it annually and date the review.

Start here this week: inventory your destruction and storage vendors, confirm a signed BAA exists for each one, and fill the gaps with an agreement you can send for signature today. Then go count the boxes in the closet.