- Citation
45 CFR 164.316- Standard
- 164.316(a) and (b)
- Safeguard
- Documentation requirements
- Type
- Standards, with three required specifications
What the rule says
(i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and (ii) if an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment. [164.316(b)(1)] Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later. [164.316(b)(2)(i)]45 CFR 164.316, as currently in force
In plain English: Write your security policies down, write down the things the rule makes you do, keep all of it for six years after it stops being current, make it available to the people who need it, and update it when things change.
What it means in practice
- Policies and procedures (a): written, reasonable and appropriate, and changeable as long as changes are documented.
- Documentation (b)(1): policies, plus records of required actions, activities and assessments: the risk analysis, risk management plan, training records, log reviews, access reviews, restore tests, incident records, BAAs.
- Time limit (R): six years from creation or from the date the document was last in effect, whichever is later.
- Availability (R): the people responsible for implementing a procedure can get to it.
- Updates (R): review periodically and update in response to environmental or operational changes.
Six years is how long the hippo remembers. That's the short version of this requirement.Your engineer
What OCR looks for
If an investigation touches this requirement, the data request will ask for some or all of the following.
- A policy register with approval dates and versions.
- A documentation index showing where each required record lives and its retention.
- Superseded versions, retained.
- Evidence of periodic review.
Where entities get caught
Shen Smiles, $140,000, 2026: no written privacy policies the practice could produce. Every corrective action plan requires six-year retention of the documents it generates.
In many investigations the finding isn't that a control was absent; it's that the entity couldn't produce the document that showed the control existed on the relevant date.
How to meet it at a small organization
Keep one folder structure, physical or digital, that mirrors the Security Rule: a section per standard, the current policy on top, superseded versions behind it, and the records that prove activity in each. Date everything. Never delete a superseded policy within six years of replacing it. The platform can be that folder.
Under the proposed Security Rule update
The proposal would require written documentation of all policies, procedures, plans and analyses, reviewed at least every 12 months, with the retention rule unchanged. The update was proposed in January 2025 and remains a proposal as of October 2026; see what's changing.
This page explains a federal regulation in plain language. It isn't legal advice, and AccuSights doesn't certify compliance; no one can. For every standard and specification, see the Security Rule, clause by clause.
With AccuSights: The documentation pack in the platform is indexed to the Security Rule, versions are kept automatically, and each record carries its retention date, so the six-year rule stops being something anyone has to remember.