If you run an ABA organization, your documentation practices play an important role in your corporate compliance program. But even with the best session notes, billing systems, and employee files, your agency could still face risk if your record retention policy isn’t clear, consistent, and up to date.
Every ABA provider manages a wide range of clinical, financial, and administrative records and much of those records are protected under HIPAA and state law. Knowing how long to keep those records, where to store them, and when to securely destroy them is essential to remaining compliant and audit-ready.
In this article, we’ll break down how to create a record retention policy that works for your ABA agency, explain what determines record retention periods, and share practical steps to keep your policy active and effective.
Why Record Retention Matters for ABA Agencies
A record retention policy helps ensure your organization keeps records long enough to meet federal, state, regulator, and payer requirements, but not kepp those records so long that you create unnecessary risk. It’s about balance: keeping what’s required, discarding what’s expired, and documenting the process along the way.
ABA agencies typically maintain several key categories of records:
-
Clinical documentation: includes assessment reports, treatment plans, session notes, data sheets, behavior graphs, progress summaries, and discharge reports.
-
Billing and claims records: such as superbills, authorization requests, explanation of benefits (EOBs), remittance advice, payer communications, and supporting documentation for services billed.
-
Personnel and contractor files: applications, licenses, supervision logs, competency assessments, payroll documentation, CEU records, and background checks.
-
Compliance and privacy documentation: HIPAA policies, risk assessments, privacy incident logs, staff training records, and signed business associate agreements.
-
Administrative and operational records: contracts with payers and vendors, corporate meeting minutes, leases, insurance certificates, and policy manuals.
Each of these record types has its own set of legal and practical retention requirements.
For example:
-
HIPAA requires that documentation showing your compliance with HIPAA (like policies, risk analyses, and training records) be kept for six years from the date created or last effective.
-
Medicaid and many commercial payers require agencies to retain billing and service records for five to ten years after the date of service.
-
Employment records must generally be retained for at least three years under federal labor laws, though some states require longer retention periods.
-
Client treatment and billing documentation should typically be retained for at least the length of the state malpractice or negligence statute of limitations, which often extends beyond payer or HIPAA minimums.
Understanding Statutes of Limitation
A statute of limitation is the period of time a party has to bring a legal claim (such as malpractice, negligence, or fraud claims) after an event occurs. For ABA agencies, this timeframe can affect how long you should keep records that might be relevant to defending against such claims.
For instance:
-
If your state’s malpractice statute of limitations is seven years, keeping clinical records for at least that long ensures you can defend your agency if a former client or payer raises a concern.
-
For Medicaid audits or overpayment disputes, retaining billing documentation for the full federal or state recovery period (often five to seven years) protects you if payers seek repayment after an audit.
The key takeaway: retention isn’t just about compliance; it’s also about protection. Your policy should incorporate the longest applicable retention period across all relevant laws, payers, and statutes of limitation.
The Four Pillars of an Effective Record Retention Program
A record retention policy works best when it’s part of your day-to-day compliance operations, not just a document in a binder. These four steps help ensure that it’s both effective and practical.
Pillar 1. Review and Update Your Policy Regularly
Your policy should list every record category your agency maintains, how long each is kept, and the legal or contractual reason for that timeframe.
Include:
-
Where records are stored: for example, in your EHR, Google Workspace, payroll software, or physical files.
-
Who manages them: ideally, a designated “record retention lead.” In smaller agencies, this might be the compliance officer, practice manager, or owner and while it likley won't be their full-time role, it will provide a consistent point of accountability.
-
How they’re organized: such as file naming conventions or folder structure.
Review the policy annually or any time your operations change, especially if you adopt new systems, expand to new states, or update your payer contracts. Pair this internal review with periodic consultation from legal counsel and compliance consultation to confirm you’re meeting all applicable retention requirements.
Pillar 2. Define Your Destruction Process ...and Stick to It
Keeping records forever can seem safer, but in reality, it increases your data risk. The longer you hold unnecessary information you're responsible for protecting, the more likely it could be exposed in a breach or accessed unnecessarily.
Your destruction process should specify:
-
Timing: When you review and destroy expired records (for example, quarterly or annually).
-
Method: How you securely dispose of information such as shredding physical files, permanently deleting electronic files, or using secure data disposal software.
-
Documentation: Maintaining a destruction log that notes the record type, date, and method of destruction.
For HIPAA-covered entities, destruction must render data unreadable and irretrievable. Partnering with a HIPAA-compliant shredding vendor and keeping a Business Associate Agreement (BAA) on file is a best practice.
This process aligns with the data minimization principle we wrote about in a previous ABA Compliance Chronicle article — keeping only what’s necessary to fulfill legal, payer, and operational needs.
Pillar 3. Train Your Team ...Everyone Has a Role
Record retention isn’t just the job of folks involved in your corporate compliance program. Every employee who creates or handles documentation affects how records are managed.
Consider incorporating record retention into new hire onboarding and annual compliance training, with practical examples relevant to their role:
-
Clinicians: where to store finalized session notes and treatment plans in the EHR, and why they shouldn’t save them on personal devices.
-
Billing teams: how long to retain payer correspondence and claims data.
-
Supervisors and HR staff: proper storage of supervision logs, employee credentials, and CEU records.
-
Administrators: procedures for keeping executed contracts, leases, and insurance documents.
When employees understand the why behind record retention (that it’s both a legal safeguard and a way to protect client privacy) compliance becomes part of daily operations, not an afterthought.
Pillar 4. Audit for Compliance and Continuous Improvement or "What You Expect You Must INSPECT."
Auditing your record retention practices helps ensure that your policy is more than words on paper. It verifies that processes are working and gives you data to make adjustments. Consider audits such as...
-
Retention Period Audits
-
What to do: Sample different record types (clinical, billing, HR, etc.) and confirm they’re being retained for the correct period.
-
Why it matters: Ensures compliance with legal, contractual, and statute of limitation requirements — and identifies where records might be deleted too soon or held too long.
-
-
Destruction Verification Audits
-
What to do: Review your destruction logs or certificates to ensure expired records are actually being disposed of and that documentation is complete.
-
Why it matters: Confirms your agency follows through with its data minimization commitments and protects sensitive data from unnecessary exposure.
-
Even small quarterly reviews can go a long way toward maintaining consistency and confidence across your compliance program.
Common Pitfalls for ABA Providers
Through our work consulting with ABA agencies, we find folks tend to fall into these traps:
-
Policies that haven’t been updated in years.
-
No single person assigned to manage retention practices.
-
Destruction processes that exist “on paper” but not in practice.
-
Retaining records indefinitely out of caution, which increases cost and risk.
Avoiding these pitfalls starts with structure and follow-through.
Putting It All Together
An effective record retention policy protects your agency in multiple ways:
-
It helps you meet payer, HIPAA, and state requirements.
-
It ensures you can defend documentation if a question or audit arises.
-
It supports your data minimization goals, reducing long-term risk.
At ABA Compliance Solutions, we help ABA agencies design and implement record retention policies that fit their size, structure, and systems, whether you’re building one for the first time or updating a policy that no longer reflects your operations.
If you’d like expert support reviewing your current retention policy or creating a simple audit checklist, our team can help. You can reach us through your Compliance Connection membership portal or at abacompliancesolutions.com.
Final Thoughts
Record retention isn’t just about keeping old files; it’s about protecting your agency’s future. When your policy is current, your staff are trained, and your processes are active, you’ll have documentation that’s defensible, compliant, and right-sized for your organization. That’s the kind of compliance confidence every ABA provider deserves.
