EOB and Patient Records Retention Guide for NH Medical Practices

The Three Retention Clocks Every Practice Runs

The biggest mistake we see in New Hampshire medical practices is treating all records under one retention rule. Three different rules apply, and each has its own start date.

Clock 1: The HIPAA documentation clock. The HIPAA Privacy Rule at 45 CFR 164.530(j) requires covered entities to retain HIPAA-related documentation for six years from the date of creation or the date when it was last in effect, whichever is later. This applies to policies, procedures, authorizations, notices of privacy practices, business associate agreements, accounting of disclosures, complaints, and security incident reports. It does not apply to the underlying patient medical records.

Clock 2: The patient medical record clock. HIPAA itself does not set a retention period for the underlying medical record. State law does. New Hampshire generally requires retention of adult patient records for 7 years from the last date of service under various professional licensing rules. For minors, the clock runs until the patient reaches age of majority plus the applicable adult retention period. Hospital records often run longer under N.H. Code Admin. Rules He-P.

Clock 3: The CMS Medicare and Medicaid clock. Practices that bill Medicare must retain claim documentation, cost reports, and supporting records for periods set by the Centers for Medicare and Medicaid Services. Most claim documentation runs at least 10 years for Medicare cost report-related records. Medicaid retention follows state contract terms and federal regulations under 42 CFR 431.17.

Different record types fall under different clocks. A signed HIPAA authorization is documentation under Clock 1. The medical record it authorized release of is under Clock 2. A Medicare claim for that same encounter is under Clock 3. Your retention schedule needs to identify which clock applies to which document type and apply the longest clock when more than one is in play.

What an EOB Is and Why Retention Matters

An Explanation of Benefits, or EOB, is the document a health plan sends to a patient after processing a claim. It explains what the plan paid, what the patient owes, what was denied, and why. Providers also receive a parallel document called the Explanation of Payment or Remittance Advice, which contains essentially the same information from the provider side.

EOBs and remittance advice documents are protected health information under HIPAA because they identify the patient, the provider, the date of service, and the medical service rendered. They fall under HIPAA’s general handling and destruction rules. They are also financial records tied to your accounts receivable, which subjects them to additional retention requirements under IRS and state tax authorities.

The retention period for EOBs is generally the longer of:

• 6 years under HIPAA documentation rules if the EOB is treated as HIPAA-related documentation
• 7 years under IRS rules if the EOB supports a tax-deductible business expense or income item
• 10 years under Medicare cost report rules if the EOB relates to Medicare claim documentation
• The applicable medical record retention period if the EOB is filed as part of the patient’s chart

Practices that file EOBs separately from the medical chart tend to land on a 7 to 10 year retention period. Practices that file EOBs in the patient chart inherit the medical record retention period, which in New Hampshire generally runs 7 years from last service for adults. Either approach is defensible if documented in your written retention policy. The mistake to avoid is destroying EOBs at 6 years without checking the longer applicable clocks first.

The HIPAA Six-Year Rule Explained

HIPAA’s six-year retention requirement is one of the most misunderstood rules in healthcare compliance. The rule at 45 CFR 164.530(j) requires covered entities to retain specified documentation, not all records, for six years from the date of creation or last effective date.

Documentation covered by the six-year rule includes:

• Written and electronic policies and procedures
• Notices of Privacy Practices
• Patient authorizations and revocations of authorization
• Business associate agreements and amendments
• Accounting of disclosures logs
• Patient complaints and resolution documentation
• Security incident reports and breach notifications
• Risk assessments and remediation plans
• Workforce training records
• Sanction documentation for HIPAA violations

Documentation not covered by the six-year rule includes the underlying patient medical record itself. The medical record is governed by state law and professional licensing rules, not HIPAA. This distinction matters because some practices destroy patient charts at six years thinking they have satisfied HIPAA, when in fact they have violated New Hampshire’s longer medical record retention requirement.

The HHS Office for Civil Rights has issued guidance clarifying that HIPAA documentation retention is a floor, not a ceiling. Practices may retain documentation longer when other laws require it. The most defensible approach is to map each document type to the longest applicable retention rule and retain the entire category to that period.

When the six-year clock expires, destruction must follow HIPAA’s secure disposal requirements. Cross-cut shredding with a Certificate of Destruction from an AAA-Certified third party satisfies the standard. Our HIPAA-compliant shredding service includes the documentation auditors look for.

New Hampshire State Medical Record Retention Rules

New Hampshire law sets retention requirements for medical records through several sources. The applicable rule depends on the type of provider and the type of record.

Physicians and physician assistants. The New Hampshire Board of Medicine under N.H. RSA 329 and Med 502.04 expects physician records to be retained for a minimum of 7 years from the date of last entry for adult patients. For minor patients, records are retained until the patient reaches age 19 plus 7 years.

Hospitals. Hospital records are governed by He-P 802 administrative rules. Inpatient records generally require longer retention, often 10 to 20 years depending on the specific record type. Emergency department records, operative reports, and pathology reports often follow extended retention windows.

Dentists. The New Hampshire Board of Dental Examiners under N.H. RSA 317-A typically expects records retained for 7 years from the last date of treatment, with longer periods for minor patients.

Mental health professionals. Mental health records under N.H. RSA 330-A often have longer retention periods, especially for inpatient psychiatric records. Practitioners should consult their specific licensing board rules.

Other licensed providers. Chiropractors, physical therapists, occupational therapists, optometrists, and other licensed professionals have retention rules set by their respective boards. Most align with the 7-year-from-last-service standard, but each board has slight variations.

Records that fall under multiple rules require the longest applicable retention period. A physician practice that bills Medicare for elderly patients needs to follow CMS rules in addition to the state 7-year rule. A pediatric practice needs to track minor age-of-majority retention extensions for every patient under 18.

CMS Medicare and Medicaid Retention Requirements

Medical practices that bill Medicare or Medicaid face additional retention requirements set by federal regulation. These rules apply on top of state retention laws and HIPAA documentation rules.

Medicare cost report records. Hospitals and other Medicare providers subject to cost reporting must retain cost report records and supporting documentation for at least 5 years after the period covered by the cost report under 42 CFR 413.20. The practical retention period runs closer to 10 years when accounting for audit windows.

Medicare claim documentation. Records supporting Medicare claims, including patient charts, EOBs, and supporting documentation, are subject to a five-year minimum retention under the Medicare Program Integrity Manual, with longer periods for records involved in fraud and abuse investigations under the False Claims Act.

Medicare Advantage and Part D records. Records supporting Medicare Advantage and Part D plans are subject to a 10-year retention requirement under 42 CFR 422.504 and 42 CFR 423.505.

Medicaid records. Medicaid retention varies by state contract. In New Hampshire, Medicaid claim documentation generally runs at least 6 years under state Medicaid Manual provisions, with longer periods for records under fraud investigation.

OIG and False Claims Act considerations. The Office of Inspector General False Claims Act audit window runs up to 10 years. Records destroyed during an active investigation, even if the retention clock has expired, create severe legal risk. Any practice under audit notice should suspend routine destruction until the matter is resolved.

The practical answer for most New Hampshire practices is to set a 10-year retention period for Medicare-related claim documentation. This satisfies the CMS rules, the OIG audit window, and the state retention requirement in one policy. Records past 10 years can be destroyed through a documented process with Certificate of Destruction.

Building a Written Retention Policy

HIPAA, state licensing boards, and CMS all expect medical practices to maintain a written retention policy. The policy serves three purposes. It guides staff on what to keep and for how long. It defends the practice in audit and litigation. And it documents the decision to destroy records at the end of the retention period.

A defensible retention policy includes:

• Record types and the retention period for each
• Retention start date for each record type (creation date, last service date, end of fiscal year, etc.)
• Storage location and format during the retention period
• Destruction method at the end of the retention period
• Documentation requirements for destruction events
• Exception procedures for litigation hold, audit notice, or breach investigation
• Annual review schedule and policy update process
• Designated staff role responsible for retention compliance

The retention policy should be signed by the practice owner or compliance officer and reviewed annually. Staff training on the policy should be documented under the HIPAA workforce training requirement at 45 CFR 164.530(b). When records are destroyed under the policy, the Certificate of Destruction should be filed with the policy documentation as evidence of compliance.

Many New Hampshire practices we work with use a simple two-page retention schedule that lists every common document type, the applicable retention rule, and the retention period. The schedule is posted in the records area, included in new-hire training, and reviewed at the annual HIPAA risk assessment.

Destroying Records at the End of the Retention Period

The destruction step is where most practices get tripped up at audit. HIPAA at 45 CFR 164.310(d)(2)(i) requires implementation of policies and procedures to address the final disposition of protected health information. The disposal must render PHI unreadable, indecipherable, and otherwise cannot be reconstructed.

Acceptable destruction methods for paper records include:

• Cross-cut shredding by an AAA-Certified third party (the industry standard)
• Pulping or pulverizing to render the record unreadable
• Incineration in a controlled facility (uncommon and increasingly regulated)

Office shredders are not sufficient for HIPAA compliance for high-volume destruction. The shred particle size from a typical office shredder often exceeds HIPAA standards. The chain of custody is unclear. And the documentation does not survive an OCR audit. The defensible approach is to use a third-party destruction service with BNBA A+ Certification.

The destruction event should produce a Certificate of Destruction listing the date, weight or volume destroyed, method of destruction, and the certifying credentials of the destruction provider. The Certificate should be filed with the practice’s HIPAA documentation for at least six years from the destruction date.

Our medical shredding program in New Hampshire serves practices in Manchester, Nashua, Concord, Portsmouth, and across the state with locked consoles for ongoing destruction, scheduled pickups, and annual purge service for retention-end records. For practices in the Manchester area, see our shredding Manchester NH page for service area details. Every job includes a Certificate of Destruction and runs under AAA-Certified protocols.

Common Retention Mistakes and How to Avoid Them

Over nearly two decades serving New Hampshire medical practices, we have seen the same retention mistakes repeat across hundreds of offices. Avoiding them is straightforward once you know what to look for.

Mistake 1: Destroying medical records at six years thinking it satisfies HIPAA. HIPAA’s six-year clock applies to documentation, not the underlying medical record. The medical record follows state law, which in NH runs 7 years for most adult records and longer for minors. Map each record type to the right clock.

Mistake 2: Ignoring the minor patient age-of-majority extension. A pediatric chart from 10 years ago for a patient who was 8 at last service is still under retention. The clock did not start running until the patient turned 19. Practices that purge based on chart age alone often destroy records they should still hold.

Mistake 3: Destroying records during an active audit or litigation hold. Once a practice receives audit notice, subpoena, or litigation hold, routine destruction must pause for the affected records. Continued destruction can produce sanctions, evidence-tampering charges, or False Claims Act exposure. Build a hold procedure into your written policy.

Mistake 4: Using an office shredder for high-volume destruction. The shred particle size often fails HIPAA standards. The chain of custody is undocumented. The Certificate of Destruction does not exist. An OCR audit response built on office shredding history is hard to defend.

Mistake 5: Failing to document destruction events. Without a Certificate of Destruction filed in the HIPAA documentation, the practice has no proof that records were destroyed compliantly. The Certificate is your audit defense. File it, keep it for six years, and reference it in the annual HIPAA risk assessment.

Mistake 6: Treating EOBs as low-priority paperwork. EOBs are PHI and often financial records subject to longer retention. Filing EOBs in a stack on someone’s desk creates exposure. Treat EOBs with the same handling care as patient charts and destroy them through the same secure destruction service.

2026 Pricing

Transparent rates with flat fees on every job. Use this table when budgeting your shredding job.

Frequently Asked Questions