MyRHC Compliance index

HHS · FDA · NIST

Data Retention and Secure Destruction

Index of US federal sources on records retention and media sanitization, including HIPAA documentation rules, 21 CFR Part 11 and NIST SP 800-88.

Data Management Healthcare Research Biotech & Life Sciences Pharma All US

At a glance

Short name
Data Retention
Issuing / stewarding body
HHS, FDA, NIST
Jurisdiction
US
Also known as / related labels
HIPAA documentation retention (45 CFR 164.316(b)(2)) · 21 CFR Part 11 (Electronic Records) · NIST SP 800-88 Rev. 2 (Media Sanitization)

What this entry covers

This is a topic entry, not a single framework. It points to US federal sources on keeping and destroying records: the HIPAA Security Rule requires covered entities and business associates to keep required policies, procedures and records for six years from creation or last effective date (45 CFR 164.316(b)(2)), and NIST SP 800-88 gives guidance on media sanitization. FDA’s 21 CFR Part 11 requires controls that protect electronic records so they can be accurately and readily retrieved throughout the records retention period (21 CFR 11.10(c)).

MyRHC indexes this framework so practitioners, auditors, and automated agents can find the authoritative primary sources in one place. This page is a navigation aid. It is not legal advice and is not a substitute for the official text.

Official documentation

Recent changes

  • 2025-09-26: NIST published SP 800-88 Rev. 2, Guidelines for Media Sanitization, superseding Rev. 1 (2014). NIST CSRC; NIST announcement

How to use this index entry

  1. Open the official link above (or the agency home if the deep link drifts).
  2. Confirm edition / revision date against your program scope.
  3. Map applicability by sector and jurisdiction listed in the metadata.
  4. Follow related frameworks only after checking their own official sources.

Disclaimers

  • MyRHC does not host proprietary standards text (ISO, some industry bodies).
  • Where standards are paywalled, we link to the publisher’s catalog page.
  • Always verify current requirements with counsel and the issuing authority.
Index only — not legal advice. MyRHC does not certify compliance. Confirm current requirements with the issuing authority and qualified counsel. Proprietary standards text remains with its publisher.

Same agencies or sectors — still verify each official source independently.

Vendor Risk Management

Official

Vendor and Third-Party Risk Management

Index of US federal sources on managing vendor and supply chain security risk, including HIPAA business associate rules and NIST SP 800-161.

HHS NIST Vendor Management All

Common Rule

Official

Common Rule (45 CFR Part 46) and IRB Oversight

HHS regulations at 45 CFR Part 46 protecting human research subjects and governing IRB review, overseen by the Office for Human Research Protections.

HHS OHRP Clinical Research Biotech & Life Sciences

CLIA

Official

Clinical Laboratory Improvement Amendments (CLIA)

Federal quality standards for US laboratories testing human specimens, administered by CMS with CDC and FDA under 42 CFR Part 493.

CMS CDC Clinical Research Healthcare

DSCSA

Official

Drug Supply Chain Security Act (DSCSA)

US law setting up electronic, interoperable tracing of prescription drug packages through the supply chain, implemented by the FDA.

FDA Supply Chain Pharma

PHS FCOI

Official

Financial Conflict of Interest in PHS-Funded Research (42 CFR Part 50 Subpart F)

HHS rules at 42 CFR Part 50 Subpart F on managing investigator financial conflicts of interest in PHS-funded research, including NIH awards.

HHS NIH Research Integrity Research

GCP

Official

Good Clinical Practice (ICH E6(R3))

International standard for the design, conduct and reporting of clinical trials (ICH E6(R3)), issued by FDA as final guidance in the US.

FDA ICH Clinical Research Biotech & Life Sciences