You have eleven bankers boxes in a storage unit off the highway, and you are paying $180 a month for them. Six of those boxes came from the vestibular therapy program your practice absorbed in 2019. When your office manager opened one last week, she found treatment flow sheets for a positional vertigo maneuver epley series, printed infrared goggle stills, a stack of outside ENT consult faxes, and two unlabeled DVDs. Nobody knows which of it you are still required to keep, and nobody wants to be the person who throws out the wrong thing. This article is the retention and destruction workflow that resolves that — clocks, roles, vendor paperwork, and the log you will need if OCR ever asks.

What a Positional Vertigo Maneuver Epley Encounter Leaves Behind in Your Records

Repositioning procedures for benign positional vertigo are short, frequently repeated, and routinely performed across organizational lines — primary care, ENT, audiology, and vestibular physical therapy all touch them. That referral pattern is the administrative problem. A single patient's course of care produces record fragments in three or four systems owned by two or three legal entities.

Before you can write a retention schedule, inventory what actually accumulates. In most practices, a positional vertigo maneuver epley episode generates:

  • A short procedural note in the EHR, sometimes as a template with a checkbox series rather than narrative text
  • Therapy flow sheets or home-exercise handouts, often printed and scanned back in — meaning both a paper copy and an image exist
  • Video or infrared recordings from eye-movement testing, stored on a diagnostic cart, a network share, or removable media rather than in the chart
  • Inbound faxes and CD-ROMs from referring or receiving providers
  • Scheduling and billing artifacts, including prior authorization correspondence for therapy visits

The media nobody puts on the inventory

Diagnostic carts are where retention policies go to die. A goggle-equipped testing cart with a local hard drive is protected health information storage, and it falls under your device and media controls at 45 CFR 164.310(d). If it was purchased in 2016 and has never been reimaged, it holds records older than any policy you have written. Put every such cart on your asset inventory with a serial number and a named owner before you write another line of retention policy.

HIPAA Sets a Six-Year Clock — But Not on the Chart

This is the single most common misunderstanding in practice administration, so state it plainly for your team:

HIPAA does not establish a medical record retention period. The six-year requirement at 45 CFR 164.316(b)(2)(i) and 45 CFR 164.530(j)(2) applies to compliance documentation — policies and procedures, Notices of Privacy Practices, signed authorizations, business associate agreements, risk analyses, sanction records, and accounting-of-disclosure logs — for six years from the date of creation or the date it was last in effect, whichever is later. How long you keep the clinical chart itself is set by state law, payer contracts, professional licensure rules, and applicable CMS requirements.

So the DVD of a repositioning session is governed by your state's medical record statute. The signed authorization that let you send that DVD to an outside ENT is governed by HIPAA's six-year rule. Two different clocks, two different destruction dates, and they belong in two different columns of your schedule.

The Three Clocks You Overlay to Get a Real Destruction Date

Clock one: state medical record retention

Every state sets its own floor, and the ranges vary widely — commonly somewhere between five and ten years from the last date of service for adult patients, with separate rules for hospitals, therapy providers, and individual licensees. Pull the statute and the licensing board rule for every license type you employ. A practice that runs both a physician clinic and a therapy program may be subject to two different periods for the same episode of care.

Clock two: minors and the age of majority

Pediatric records almost never run from the date of service. They typically run from the patient's age of majority plus a statutory tail. If your practice sees adolescents for vestibular complaints, your document management system needs a date-of-birth-driven purge rule, not a service-date rule. Set the field, test it, and confirm it does not silently default back to the adult schedule when a chart is merged.

Clock three: payer, program, and contract obligations

Medicare Conditions of Participation impose their own retention floors on facilities, and your payer contracts frequently contain audit and records clauses that outlast state law. Managed care and government program contracts routinely require ten years of supporting documentation. Read the records clause of every payer contract you have signed and record the longest number in a single spreadsheet column labeled "contractual floor."

Your rule: destruction date = the latest of all applicable clocks, never the earliest. Write that sentence into the policy. It removes judgment from the front line.

The moment your practice receives a subpoena, a preservation letter, a board complaint, an OCR investigation notice, or credible notice of a claim, the routine destruction schedule stops for the affected records. Assign one person — usually the privacy officer — the authority to issue a hold and one place to record it.

Practically, that means three things. First, a flag in the EHR or document management system that blocks purge. Second, a written hold notice to anyone who touches those records, including your scanning vendor and your storage company. Third, a documented release when the matter closes. Destroying records under hold on schedule is not a defense; it is the fact pattern that turns a manageable dispute into a spoliation argument.

What "Secure Destruction" Actually Requires

The standard is that PHI must be rendered unreadable, indecipherable, and otherwise unable to be reconstructed. HHS has published specific guidance on disposal obligations that covered entities should hand directly to whoever supervises records purges.

Paper

Cross-cut shredding, pulverizing, or incineration. Not strip-cut. Not a recycling bin. Not "the locked closet until we get around to it." Between the moment a chart leaves the shelf and the moment it is destroyed, it must stay in a locked, tamper-evident container in an area with controlled access. OCR has settled cases involving paper records left in an unlocked dumpster and boxes of charts left unattended outdoors — the failure in both was custody during the gap, not the shredding method.

Electronic media

Deleting a file is not destruction. Reformatting a drive is not destruction. Use NIST Special Publication 800-88 Revision 1 as your operating standard and pick the appropriate level — clear, purge, or destroy — based on whether the media leaves your control. For the diagnostic cart hard drive, the retired laptop, the backup tapes, and the unlabeled DVDs in the storage unit, the answer is almost always physical destruction with a certificate.

The FTC angle most practices miss

If your practice pulls consumer reports — credit checks for payment plans, background screening for new hires — the FTC Disposal Rule applies on top of HIPAA. Review the FTC's guidance on disposing of consumer report information and confirm your shredding contract covers HR files, not just clinical ones.

Your Shredding Vendor Is a Business Associate. Get the Paperwork.

A document destruction company that picks up bins of charts from your office has access to PHI, which makes it a business associate. So does the offsite storage company holding those eleven boxes, the ITAD firm that wipes your retired testing cart, and the scanning service that digitized the vestibular therapy files. Each one needs an executed business associate agreement before the first pickup — not after, not "we have their standard terms in the service contract."

Check three things in each agreement: that it obligates the vendor to destroy PHI per your specified method, that it requires notice to you of any security incident within a defined number of days, and that it addresses subcontractors, because most shredding companies use them for routes they do not cover. If a vendor hands you a two-paragraph clause buried in an invoice, replace it. You can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription — which is faster than waiting three weeks for a shredding company's legal department to respond.

Also collect certificates of destruction. Every pickup, every batch, filed by date. A certificate that lists container counts and a destruction date is the difference between "we have a policy" and "we can prove it happened."

The Destruction Log: Eight Fields, No More

Keep it simple enough that it actually gets filled in. Your log should capture:

  1. Batch identifier
  2. Record type and date range (e.g., "vestibular therapy flow sheets, 2014–2016")
  3. Volume — box count, media count, or linear feet
  4. Retention rule applied and the date it expired
  5. Legal hold check performed, by whom, on what date
  6. Destruction method
  7. Vendor name and certificate number
  8. Staff member who authorized and staff member who witnessed

Retain the log itself indefinitely. It is small, and it is the only artifact proving that a chart you no longer have was destroyed lawfully rather than lost.

A Worked Example: Clearing the Vestibular Therapy Boxes

Take the storage unit. Here is the sequence a well-run practice follows, with owners named.

Week 1 — Inventory. The records supervisor opens every box and logs contents by record type and date range. No destruction decisions yet. Media items are pulled and listed separately.

Week 2 — Apply the clocks. The privacy officer maps each date range against the state statute, the minor-patient rule, and the longest contractual floor. Anything within any active window goes back in the box with a new retention-until date on the label.

Week 3 — Hold check. The privacy officer cross-references the open matters list. Any patient name on that list is pulled and flagged, even if the retention window expired.

Week 4 — Vendor readiness. Confirm an executed BAA with the destruction vendor, confirm the method is cross-cut or better for paper and physical destruction for media, and schedule a witnessed pickup rather than a drop-off.

Week 5 — Destroy and log. Two staff members present. Log completed the same day. Certificate filed within ten business days of receipt. Storage unit downsized, and the $180 a month becomes $60.

Five Failure Modes Auditors Find First

  • Policy exists, schedule does not. A retention policy that says "as required by law" without a table of record types and years is unusable at the front line.
  • Shadow copies survive the purge. Scanned charts destroyed on schedule while the source PDFs remain on a shared drive, a fax server, or a departing clinician's laptop.
  • No BAA with the storage or destruction vendor. Or one signed in 2013 that never addressed subcontractors or breach notification timing.
  • Diagnostic devices excluded from the inventory. Testing carts and imaging workstations retired without documented sanitization.
  • No destruction log. The records are gone and nobody can prove why.

Put It on the Calendar Before It Becomes a Breach Report

Retention and disposal is one of the few compliance areas where doing the work reduces both risk and cost at the same time. Fewer boxes, fewer drives, fewer places a record can walk out of. Pick a quarter, run the five-week sequence above on your oldest storage location, and repeat annually.

If your vendor file is thin, start there — a destruction or storage vendor without a current agreement is the fastest finding an investigator will write. Build the BAA you need for your shredding and storage vendors in an afternoon, and if your broader policy set and risk analysis are also overdue, the full compliance document set can be generated the same way. Then get the boxes out of the storage unit.