HIPAA Privacy Rule: policies, privacy official and six-year records
Mental health providers covered by HIPAA must designate a privacy official and a contact for complaints, keep their privacy policies and procedures in written or electronic form, and retain the required documentation for six years from its creation or the date it was last in effect, whichever is later.