Data Retention & Destruction Policy

Electronic Visit Verification (EVV) System
Last Updated: {{Insert Date}}

1. Purpose

This Data Retention & Destruction Policy establishes the requirements for storing, retaining, archiving, and securely destroying data—including PHI, PII, operational records, audit logs, system files, and metadata—within the EVV System (“the System”).
The policy satisfies requirements under:

  • HIPAA Privacy & Security Rules
  • Minnesota DHS 245D
  • 21st Century Cures Act EVV Mandates
  • State and Federal audit and retention laws
  • Applicable BAAs and contractual obligations

2. Scope

This policy applies to:

  • All data stored, processed, or transmitted by the System
  • All employees, contractors, vendors, and agencies using the System
  • All environments (production, backup, logs, archives, export files)
  • All data formats (electronic, paper, audio, image, and metadata)

3. Definitions

3.1 PHI (Protected Health Information)

Any individually identifiable health information.

3.2 PII (Personally Identifiable Information)

Any information that can directly or indirectly identify an individual.

3.3 ePHI

Electronic PHI stored or transmitted by digital means.

3.4 Retention Period

The period during which data must be preserved in accessible form.

3.5 Destruction

The irreversible disposal of data such that it cannot be reconstructed.

4. Data Categories & Retention Requirements

4.1 EVV Visit Data

Includes timestamps, GPS, caregiver ID, service type.
Retention: 7–10 years (state-dependent)

4.2 Audit Logs

Includes access logs, administrator actions, login attempts, data exports.
Retention: Minimum 6 years (HIPAA), longer where required.

4.3 Billing & Claims Data

Includes provider billing exports, DHS aggregator transmissions.
Retention: 7 years (common financial compliance requirements)

4.4 Care Documentation

Progress notes, care plans, incident notes (if stored in the system).
Retention: 7–10 years based on agency/state obligations.

4.5 Account & User Records

Employee/caregiver profiles, role assignments, credentials metadata.
Retention:

  • During active employment
  • 6 years after deactivation (minimum)

4.6 System Configuration Records

System-wide settings, permissions, schema versions, deployment metadata.
Retention: 6+ years or as needed to support audits.

4.7 Support Interactions

Tickets, logs, attachments.
Retention: 3–6 years unless containing PHI, which follows PHI rules.

4.8 Backups

Encrypted backups of production data.
Retention:

  • Daily backups: 30–90 days
  • Monthly backups: 6–12 months
  • Annual snapshots: 7 years (if required by contract)

5. Storage, Archiving & Protection

5.1 Secure Storage

All retained data is:

  • Encrypted at rest (AES-256 or equivalent)
  • Encrypted in transit (TLS 1.2+)
  • Stored in U.S.-based facilities
  • Protected by RBAC and MFA controls

5.2 Data Integrity

The System utilizes:

  • Automatic replication
  • Checksums
  • Periodic integrity checks
  • Controlled restoration procedures

5.3 Archiving

Older data may be moved to:

  • Low-cost encrypted archival storage (e.g., S3 Glacier)
  • Warm/cold storage tiers
  • Immutable storage for audit preservation

Archived data remains:

  • Secure
  • Encrypted
  • Accessible within mandated timeframes

6. Prohibited Storage Locations

PHI/PII may not be stored on:

  • User personal devices
  • Local hard drives
  • Unencrypted media
  • Email inboxes
  • Non-approved cloud providers
  • Public file sharing services (Google Drive personal, Dropbox personal, etc.)

7. Data Destruction Policy

7.1 General Principles

When retention periods expire, data must be destroyed:

  • Promptly
  • Completely
  • Securely
  • In a manner preventing reconstruction

7.2 Approved Destruction Methods

Electronic Data

  • Cryptographic erasure
  • Overwriting with secure delete tools
  • Deletion of encryption keys to render data unrecoverable
  • Secure wiping of storage media (NIST SP 800-88 standards)

Physical Media

  • Shredding
  • Pulverizing
  • Incineration
  • De-magnetizing (for magnetic media)

7.3 Backup Destruction

Backups containing expired data are:

  • Flagged for destruction
  • Securely purged on scheduled intervals
  • Subject to the same standards as live data

7.4 Documentation of Destruction

All destruction events must include:

  • Date of destruction
  • Method used
  • Data category
  • Authorized personnel
  • Verification logs

8. Exceptions & Holds

8.1 Legal Hold

Data may not be deleted if:

  • Required for litigation
  • Needed for an active audit
  • Mandated by law enforcement

Legal holds override retention timelines.

8.2 Agency Contract Requirements

If a customer agency has stricter retention requirements, those take precedence.

9. Monitoring, Review & Compliance

9.1 Monitoring

The System monitors:

  • Retention schedules
  • Backup lifecycle
  • Destruction events
  • Unauthorized data retention

9.2 Annual Review

This policy is reviewed:

  • Annually
  • After major system changes
  • After regulatory updates

9.3 Enforcement

Violations may result in:

  • Access revocation
  • Disciplinary action
  • Contract termination
  • Legal penalties depending on severity

10. Contact Information

For questions or compliance requests:

Privacy & Security Office
{{Your Company Name}}
{{Address}}
{{Email}}
{{Phone}}