The HIPAA data retention requirements apply to both covered entities and business associates. HIPAA data retention requirements mandate that covered entities and business associates maintain certain documentation for a specified time frame. If the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) audits a covered entity or business associate, OCR may demand production of these records for inspection. What Documents are Subject [...]