A patient walks into your urgent care on a Saturday with a wood splinter in the heel. Fifteen minutes later they walk out. What stays behind is a procedure note, a wound photograph on a staff-issued tablet, a tetanus status lookup in the state immunization registry, a superbill, and — if the fragment was retained — a referral packet faxed to a hand surgeon. That's five record artifacts from one of the cheapest encounters your practice bills. This article is about how long you keep each of them and how you destroy them when the clock runs out. If your retention policy says "7 years" and stops there, a routine how to get a splinter out visit is exactly the kind of encounter that will expose the gaps.

What a Minor Foreign Body Visit Actually Leaves in Your Systems

Retention policy fails when the inventory is wrong. Administrators write schedules against "the medical record" and then discover that half the encounter lives outside it.

For a low-acuity foreign body removal, walk the artifacts in order:

  • The procedure note in the EHR, including consent documentation if your policy requires it for minor procedures.
  • Photographs. Wound images captured before and after, often on a device with a camera roll, sometimes on a personal phone that nobody approved.
  • Imaging. If a radiograph or bedside ultrasound was ordered to look for retained material, you now have a DICOM study, a report, and possibly a copy sitting in a PACS run by a third party.
  • Registry queries. A tetanus status check against a state immunization information system creates an access log on their side and often a printed or PDF copy on yours.
  • Billing and clearinghouse data. Claim, remittance, and any coding-audit worksheet.
  • Referral correspondence. Fax confirmations, secure-message threads, and the specialist's return note.

Six systems, six owners, six retention answers. Your policy needs to name each one.

How Long Should You Keep Records From a Splinter Removal Visit?

Keep the medical record for the longest period required by your state medical records statute, your payer contracts, and your malpractice carrier — commonly six to ten years from the date of the last encounter for adults, and for minors, until a set number of years after the patient reaches the age of majority. Separately, HIPAA requires six years of retention for compliance documentation: policies, authorizations, risk analyses, and accounting-of-disclosure logs. A five-minute procedure is retained on the same clock as a complex visit; acuity does not shorten it. Destroy only after the longest applicable clock expires, and destroy using a method that renders PHI unreadable and unreconstructable.

HIPAA's Six Years Is Not a Medical Record Rule

This is the most common misreading in practice policies. The Privacy and Security Rules set a six-year documentation retention requirement at 45 CFR §164.316(b)(2)(i) and §164.530(j)(2) — that applies to your written policies, your risk analysis, your signed authorizations, your NPP acknowledgments, and your breach risk assessments. HIPAA does not set a retention period for the chart itself. HHS publishes the rule text and related guidance on its Security Rule laws and regulations page.

The chart clock comes from state law, payer contracts, and program participation rules. If your policy conflates the two, you will either shred a chart too early or hold six years of authorizations you thought were covered by the chart schedule.

The Minor Patient Problem

Splinter removals skew pediatric. That single fact reshapes your retention schedule more than anything else in this article.

Most states tie retention for minors to the age of majority plus a fixed period, not to the date of service. A record created for a four-year-old may need to survive until that patient is in their mid-twenties. If your EHR purge routine is date-of-service based and blind to patient age, it will destroy pediatric records years before you are permitted to.

Assign one person — usually the privacy officer or records manager — to confirm that every automated purge job carries an age-of-majority hold. Test it with a dummy record before you trust it.

Payer, Program, and Carrier Clocks

Medicare and Medicaid participation, managed care contracts, and grant conditions all carry their own retention terms, frequently longer than state medical record law. Pull the actual contract language rather than relying on a summary. Your malpractice carrier may also require retention beyond the statute of limitations because of tolling and discovery rules.

Build the schedule as a maximum, not an average. One retention table per record type, one column for each source of obligation, and the governing number in bold at the right.

Where the "How to Get a Splinter Out" Chart Escapes Your Retention Schedule

Retention policy assumes records sit in systems you control. Minor procedure encounters generate more shadow copies than almost any other visit type, because they move fast and staff improvise.

The recurring leaks:

  1. Camera rolls. A wound photo taken on a device stays on that device after it is uploaded. Your purge job deletes the EHR copy in year eight; the tablet still has it in year twelve, and the tablet gets sold.
  2. Fax confirmation sheets. Printed referral cover pages with patient name and body-site description, sitting in a tray at the front desk.
  3. Scanning queues. Paper intake forms that were scanned and never shredded, boxed "temporarily" in a back room in 2019.
  4. Shared drives. A folder named "procedure photos" on a network share that no retention rule touches.
  5. Departed-staff mailboxes. Secure messages with the specialist, preserved indefinitely because nobody set a mailbox disposition policy.

Run a quarterly sweep against this list. Ten minutes per location, documented, signed. That documentation is itself six-year retained material under §164.316.

Destruction That Actually Counts

HHS has been explicit that leaving PHI in dumpsters or unsecured containers violates the Privacy Rule, and improper disposal remains a recurring category on the OCR breach reporting portal. The agency's FAQs on disposal of protected health information lay out the expectation: PHI must be rendered essentially unreadable, indecipherable, and otherwise not reconstructable.

Translate that into method-by-media requirements in your policy:

  • Paper: cross-cut shred, pulp, or incinerate. Strip-cut is not adequate for names and dates of service.
  • Photographic media and film: shred or incinerate; do not toss into general recycling.
  • Electronic media: follow NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization, and specify which of clear, purge, or destroy applies to each device class. Solid-state drives in tablets and laptops need cryptographic erase or physical destruction, not a file delete.
  • Cloud-hosted copies: your vendor performs the deletion. Get their process in writing before you sign, not after you terminate.

What to Log Every Time

Your destruction log should record: date of destruction, description of the records or media, the retention rule that authorized it, the method, the person or vendor performing it, and the witness. Certificates of destruction from a shredding vendor go into the same file. Retain the log itself for six years minimum — most practices simply keep it permanently, since it is small and it is the only proof you did this correctly.

The Vendor Layer: Who Touches These Records After You Do

Every organization on this list handles PHI from that splinter visit and needs a Business Associate Agreement in place before the first pickup or the first byte transfers:

  • Document shredding and secure destruction companies, including mobile shred trucks.
  • Offsite paper storage facilities.
  • Media sanitization and IT asset disposition vendors handling retired tablets, laptops, and copiers.
  • Cloud image storage or PACS providers.
  • Billing companies, clearinghouses, and coding auditors.
  • Release-of-information vendors handling records requests.

The copier is the one administrators miss. Multifunction devices store scanned images on internal drives; a leased copier returned at end of term without sanitization is a disclosure. Put the leasing company under agreement and require documented drive handling at return.

If any of those relationships is running on a handshake or an outdated template, close the gap this week. You can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export — one-time purchase, no subscription — which is usually faster than routing a redline through counsel for a shred vendor you are onboarding on Monday.

Two Contract Terms Worth Insisting On

First, chain of custody: locked collection containers, tamper-evident seals, named drivers, and destruction within a stated number of business days. "Secure" is not a term; a 72-hour destruction window is.

Second, return or destruction at termination. Your BAA should specify what happens to residual copies when the relationship ends, including backups, and require written confirmation. This is where a records request three years after a vendor switch turns into an incident.

Building the Schedule: A Worked Example

Take the Saturday encounter from the opening. Patient is seven years old, state majority is eighteen, state medical records statute requires retention until majority plus seven years.

  • Procedure note and chart: hold until patient turns 25. Purge rule: age-based, not date-based.
  • Wound photographs: same clock as the chart, because they are part of the designated record set. Delete the device camera roll copy within 24 hours of upload — this belongs in your staff procedure, not just your policy binder.
  • Radiograph and report: chart clock, plus confirm your imaging vendor's deletion practice matches.
  • Claim and remittance: longest of state law, payer contract, and federal program requirement. CMS program participation terms drive this; check the actual contract, and consult CMS regulations and guidance for the program you participate in.
  • Signed authorization for the referral disclosure: six years from the date created or last in effect, per §164.530(j)(2).
  • Fax confirmation sheet: shred same day; it is a transient artifact, not part of the record set.

One encounter, five different end dates. That is the point of a schedule.

The Fifteen-Minute Audit You Can Run Tomorrow

Pull three closed encounters that look like a routine how to get a splinter out visit — one adult, two pediatric. For each, answer in writing:

  1. Which systems hold a copy right now? Name them.
  2. What is the governing destruction date for each copy?
  3. Who is responsible for executing that destruction?
  4. Is there a signed BAA with every third party holding a copy?
  5. If the record were destroyed today by mistake, what would your log show?

If you cannot answer question one in under five minutes, your inventory is the problem, not your policy language. Fix the inventory first.

Retention and disposal policy is one component of a document set that also includes your risk analysis, sanction policy, and workforce training records — all of them subject to the same six-year documentation clock. If assembling that set by hand is what has kept this project on the shelf, automated HIPAA policy and risk analysis generation will get you a defensible baseline you can then tailor to your state's clocks.

Start With the Vendors

Retention schedules take a few weeks to build correctly because you have to read contracts. Business Associate Agreements take an afternoon and they close the loudest gap. Inventory every organization that picks up your paper, wipes your devices, stores your images, or bills your claims, then put a signature-ready BAA in front of each one before the next scheduled shred pickup.