How long do you have to keep faxes under HIPAA?

HIPAA names no period for the faxes themselves. A fax filed in a patient's chart follows the state's chart rule: at least 5 years from the last patient contact for a Florida physician, 6 years in New York, 7 years from the last treatment for a Texas physician. HIPAA's six years cover the practice's compliance records (45 CFR 164.316(b)(2)(i), 164.530(j)(2)).

Is the HIPAA retention period 6 years or 7 years?

Six. HIPAA sets six years from creation or from the date a record last was in effect, whichever is later, for the documentation its rules require (45 CFR 164.316(b)(2)(i), 164.530(j)(2)). Seven years comes from state law: Texas sets at least seven years from the last treatment for a physician's chart (22 Tex. Admin. Code 163.2(c)). The two numbers apply to different records.

How long do I keep a signed BAA?

Six years from the date it last was in effect. HIPAA requires the satisfactory assurances to be documented in a written contract or other arrangement (45 CFR 164.308(b)(3), 164.502(e)(2)), and the period in 164.316(b)(2)(i) and 164.530(j)(2) runs from creation or the date last in effect, whichever is later. A BAA that ends in 2031 is kept until 2037. Every Fax Pigeon plan includes a signed BAA, executed at signup.

Do I have to keep a fax delivery certificate under HIPAA?

HIPAA names no period for a delivery certificate, so the period follows where the practice files it. Kept with the fax in the chart, it follows the state's period. Relied on as evidence after a misdirected fax, it is documentation toward the breach burden of proof, which carries six years (45 CFR 164.414(b), 164.530(j)(1)(iv)). Every Fax Pigeon plan includes a delivery certificate for every delivered fax.

October 11, 2026

How long must you keep fax records under HIPAA?

Six years for HIPAA records such as a signed BAA. A fax filed in a patient's chart follows state law instead: 5 years in Florida, 6 in New York, 7 in Texas.

A padlock and a stethoscope resting on a keyboard against a teal background

HIPAA sets six years for the records that prove a practice's compliance and no period for medical records. A fax filed in a patient's chart follows state law instead: a physician's chart is kept at least 5 years in Florida and 7 in Texas. The six years run from the date a record was created or last was in effect, whichever is later (45 CFR 164.316(b)(2)(i), 164.530(j)(2)). The signed business associate agreement (BAA) with a fax service is one of those records.

Does HIPAA say how long to keep a fax in the chart?

No. HHS says the Privacy Rule "does not include medical record retention requirements" and that state laws generally govern how long medical records are kept (HHS FAQ). A fax filed in a patient's chart becomes part of that record, so the state's period reaches it.

HIPAA's own duties last as long as the practice holds the fax. HHS adds that the safeguards rule (45 CFR 164.530(c)) applies for whatever period the information is maintained, through disposal. A patient's right of access reaches the fax for as long as it stays in the designated record set, which includes the medical and billing records a provider keeps about patients (164.524(a)(1); 164.501).

Which rule sets which period?

Two clocks run side by side. The chart follows the state, and the practice's HIPAA records follow six years.

Record	How long	Source
A fax filed in a patient's chart	The state's period; HIPAA sets none	HHS FAQ
Any fax with protected health information (PHI) the practice still holds	Safeguards apply while it is held, through disposal	HHS FAQ; 45 CFR 164.530(c)
Florida: a physician's patient records	At least 5 years from the last patient contact	Fla. Admin. Code r. 64B8-10.002(2)
New York: patient records of physicians, psychologists, social workers and other licensed professions	At least 6 years; a minor's until 1 year after age 21	8 NYCRR 29.2(a)(3)
Arizona: a health care provider's patient records	At least 6 years after the last service; a child's, the later of 3 years after age 18 or 6 years after the last service	A.R.S. 12-2297(A)
Texas: a physician's patient records	At least 7 years from the last treatment; a patient under 18, until age 21 or 7 years, whichever is longer	22 Tex. Admin. Code 163.2(c); Texas Medical Board
Policies and procedures, the risk analysis, workforce training records	6 years from creation or last in effect	45 CFR 164.316(b); 164.530(i), (j) and (b)(2)(ii)
A signed BAA	6 years from creation or last in effect	45 CFR 164.308(b)(3); 164.502(e)(2)
A signed patient authorization	6 years from creation or last in effect	45 CFR 164.508(b)(6)
Breach assessment records, such as for a misdirected fax	6 years from creation or last in effect	45 CFR 164.414(b); 164.530(j)(1)(iv)

Each state figure is a minimum, and each rule covers particular providers. Florida's Board of Medicine says its five years "may well be less than the length of time necessary for protecting the physician" (r. 64B8-10.002(1)). Other licenses answer to their own rules, which can differ.

Does 45 CFR 164.316 require keeping fax records?

No. Section 164.316(b) covers two things: the written policies and procedures a covered entity or business associate uses to meet the Security Rule, and a written record of any action, activity or assessment that rule requires to be documented. Section 164.530(j) does the same for the Privacy Rule. It adds any writing that rule requires, such as a signed authorization, and the documentation a practice needs to meet its burden of proof under 164.414(b) after a possible breach. The six years run on those records. Neither section uses the words fax, medical record or chart.

HHS says the Security Rule "requires the risk analysis to be documented" (HHS), which puts the risk analysis in the six-year group.

When does the six-year clock start?

At creation, or on the date the record last was in effect if that is later. A BAA signed in 2026 and ended in 2031 is kept until 2037. A policy replaced in 2029 is kept until 2035. Six years is also how long HHS has to begin a penalty action after a violation (45 CFR 160.414).

Where do a signed BAA and a delivery certificate fit?

The Security Rule requires a business associate's satisfactory assurances to be documented in a written contract or other arrangement (45 CFR 164.308(b)(3)), and the Privacy Rule says the same (164.502(e)(2)). That contract is the BAA, so it carries the six years. Every Fax Pigeon plan includes a signed BAA, executed at signup, from $4.99 a month billed annually for 200 pages. The pricing page lists all six plans.

HIPAA names no period for a delivery certificate, so its period follows where the practice files it. Kept with the fax it proves, it stays with the chart under the state's period. Relied on to show where a fax went in a misdirected-fax assessment, it is documentation toward the practice's burden of proof (164.414(b), 164.530(j)(1)(iv)), which carries six years. Every Fax Pigeon plan includes a delivery certificate for every delivered fax.

What happens when a period ends, or the contract does?

When a period ends, HHS says neither rule prescribes a disposal method and each practice decides what is reasonable for the information it holds. The examples HHS gives are shredding, burning, pulping or pulverizing paper, and clearing, purging or destroying electronic media (HHS FAQ).

When a contract ends, the BAA decides. HHS says the HIPAA Rules generally do not require a business associate to keep electronic PHI beyond the time it provides services (HHS FAQ). A BAA has to provide that, at termination and if feasible, the business associate returns or destroys the PHI it still holds (45 CFR 164.504(e)(2)(ii)(J)). A fax that has to stay in a chart for years needs a copy in the practice's own records before the practice closes an account with any fax service, which is why downloading comes before canceling.

* Fax Pigeon prices and plan terms as of October 11, 2026.

Frequently asked questions

How long do you have to keep faxes under HIPAA?: HIPAA names no period for the faxes themselves. A fax filed in a patient's chart follows the state's chart rule: at least 5 years from the last patient contact for a Florida physician, 6 years in New York, 7 years from the last treatment for a Texas physician. HIPAA's six years cover the practice's compliance records (45 CFR 164.316(b)(2)(i), 164.530(j)(2)).
Is the HIPAA retention period 6 years or 7 years?: Six. HIPAA sets six years from creation or from the date a record last was in effect, whichever is later, for the documentation its rules require (45 CFR 164.316(b)(2)(i), 164.530(j)(2)). Seven years comes from state law: Texas sets at least seven years from the last treatment for a physician's chart (22 Tex. Admin. Code 163.2(c)). The two numbers apply to different records.
How long do I keep a signed BAA?: Six years from the date it last was in effect. HIPAA requires the satisfactory assurances to be documented in a written contract or other arrangement (45 CFR 164.308(b)(3), 164.502(e)(2)), and the period in 164.316(b)(2)(i) and 164.530(j)(2) runs from creation or the date last in effect, whichever is later. A BAA that ends in 2031 is kept until 2037. Every Fax Pigeon plan includes a signed BAA, executed at signup.
Do I have to keep a fax delivery certificate under HIPAA?: HIPAA names no period for a delivery certificate, so the period follows where the practice files it. Kept with the fax in the chart, it follows the state's period. Relied on as evidence after a misdirected fax, it is documentation toward the breach burden of proof, which carries six years (45 CFR 164.414(b), 164.530(j)(1)(iv)). Every Fax Pigeon plan includes a delivery certificate for every delivered fax.
How do you dispose of faxes when the retention period ends?: HHS says neither the Privacy Rule nor the Security Rule prescribes a disposal method, and each practice decides what is reasonable. Its examples are shredding, burning, pulping or pulverizing paper, and clearing, purging or destroying electronic media, so the information cannot be reconstructed. The safeguards duty runs through disposal (45 CFR 164.530(c)).

Fax Pigeon

HIPAA-compliant fax with a signed BAA on every plan

Plans start at $4.99 a month, billed annually, for 200 pages, with your own number and unlimited people. Your first fax is free.

Free porting of your local number
Fax from your email
AI summary of every inbound fax
E-signatures
Contact management
Delivery proof

Plans and pricing

Know a practice that still faxes? Refer it through the referral program and earn 20% of its plan, every month it stays.