HIPAA Privacy Rule: policies, privacy official and six-year records
Health care providers covered by HIPAA must designate a privacy official and a contact for complaints, keep their privacy policies and procedures in written or electronic form, document required communications and actions, and retain that documentation for six years from its creation or the date it was last in effect, whichever is later.