How long must records of privacy practice acknowledgments be kept?

• A. 3 years
• B. 6 years
• C. 9 years
• D. 10 years

Answer: (B)

Records of privacy practice acknowledgments must be kept for six years. This aligns with HIPAA’s retention expectations for documentation that shows a patient was informed of and viewed the Notice of Privacy Practices. The six-year period runs from the date the acknowledgment was created or from the date the information last went into effect, whichever is later, ensuring there’s a sufficient window to address any audits, inquiries, or potential issues. Shorter periods, like three years, may not cover all applicable review windows, while longer periods aren’t required for this purpose and add unnecessary burden. Six years is the appropriate retention span.