1. The short version
| What | How long we keep it | Why that number |
|---|---|---|
| The export your EMR sends | Not kept | Each file is read, fingerprinted and discarded. The fingerprint proves what the file contained and holds no patient information at all. |
| The findings ledger — the patient identifier, the dates, the rule, the citation, the sentence we sent and the fields from your own export that produced it | While you are a client | The longest look-back any of our rules uses is 13 months, for bereavement contact, so the ledger has to reach back at least that far. |
| The record of every brief sent | While you are a client | So we can show what was sent, to whom, and when. |
| Anything with a patient in it, after you leave | Deleted within 30 days | Long enough to hand you an export and settle a final invoice. Not long enough to become a liability for either of us. |
| Backups | Roll off within 35 days | So a deleted record is genuinely gone, rather than quietly living on in a backup nobody thinks about. |
| Counts with no patient attached | Kept | "This agency had 14 overdue items in March" identifies nobody. We use it to see whether the service is working. |
| A log of what we deleted and when | Kept | So we can prove to you, or to a surveyor, that we actually did it. |
| Ordinary business contact details | Until you ask us to remove them | Names, work emails and agency details are not patient information and are handled like any other business contact. |
2. Why we keep it short rather than long
Most software holds on to data because storage is cheap and someone might want it one day. That reasoning does not survive contact with a compliance product. Every extra month we hold patient information is another month it could be breached, subpoenaed, or mishandled — with no benefit to you, because our rules never look back that far anyway.
So the rule we hold ourselves to is simple: we delete patient data the moment ComplyWell no longer needs it to do the job you hired us to do. The numbers in the table above are not a compromise between convenience and safety. They are the shortest periods that still let the service work.
3. What the law requires, and who it requires it of
Agencies often assume a vendor has to keep records for years. That is a misunderstanding worth clearing up, because it is the reason so many vendors hoard.
The long retention rules belong to you, not to us
A hospice must keep patient clinical records for six years after the patient's death or discharge, unless state law says longer — 42 CFR 418.104(d). A home health agency must keep them for five years after discharge, again unless state law says longer — 42 CFR 484.110(c).
Those obligations sit with the agency and the record it keeps in its EMR. They do not transfer to us, and we do not try to satisfy them on your behalf. If you leave ComplyWell tomorrow, your legal record is untouched, because it was never ours.
What actually binds us
Once you sign a Business Associate Agreement with us, HIPAA requires that at the end of that agreement we return or destroy all protected health information and keep no copies — 45 CFR 164.504(e)(2)(ii)(J). That is the rule this page exists to satisfy, and it points towards deleting sooner, not later.
The six-year rule people quote
HIPAA sets no minimum retention period for patient records themselves. The six-year figure that gets quoted is 45 CFR 164.530(j)(2), and it applies to HIPAA paperwork — policies, notices, authorizations — not to patient records. It is not a reason for a vendor to keep your patients' dates for six years, and any vendor telling you otherwise is worth a second question.
4. What happens when you leave
- You tell us, in writing or through the portal. No retention clause, no notice period designed to keep you.
- We send you an export of everything we hold about your agency, in a plain spreadsheet format you can open without our software. You do not have to ask, and you do not have to pay for it.
- Within 30 days, every record with a patient in it is deleted — the roster, the dates, the report history, the briefs we generated.
- Within a further 35 days our backups have rolled over, so the deleted records are gone from those too.
- We write down what we deleted and when, and we will give you that record on request.
If you would rather we deleted everything immediately and skipped the export, say so and we will.
5. Backups
We back the system up nightly so that a mistake on our side cannot cost you your data. Those backups are held for 35 days and then overwritten. This means there is a window — up to about five weeks — where a record you asked us to delete still exists inside a backup. We are telling you that plainly rather than pretending deletion is instant everywhere, because it never is, for anyone.
6. What we keep after everything else is gone
We keep counts that have no patient in them. For example: how many items an agency had overdue in a given month, which rules fired most often, how quickly briefs were opened. These describe the agency, not any person, and they cannot be turned back into a patient. We use them to see whether ComplyWell is actually helping, and to decide what to build next.
We also keep the deletion log described above, and ordinary business records such as invoices, which any company has to keep.
7. Asking us to delete something sooner
You do not have to leave to ask. If a patient's information should not be with us — it arrived in a report by mistake, or the patient has asked their agency to restrict it — tell us and we will remove it and confirm in writing. We will not ask you to justify the request.
Requests from patients themselves come through the agency, not through us. Under HIPAA we act on your instruction as the Covered Entity, and it would be wrong for us to act on a patient's record without you.
8. If this page and your agreement disagree
Your signed agreement and Business Associate Agreement win. This page is written to be readable, not to be a contract, and if we ever draft something that contradicts it we will fix this page rather than quietly rely on the fine print.
9. Contact
Questions about anything above go through our contact page. If your question is "can you prove you deleted it", the answer is yes, and asking is welcome.
Regulation citations on this page were checked against the electronic Code of Federal Regulations on 21 August 2026. This page is compliance-support information, not legal advice.