Loading...
A source-cited retention-schedule reference for Pennsylvania organizations — PA municipal records, hospital medical records, HIPAA documentation, IRS tax records, FLSA payroll records, and OSHA exposure/medical records — with every period traced to its primary regulatory source.
Guide briefing
Retention periods in Pennsylvania depend on the record type and which regulator governs it — there is no single statewide answer. Municipal governments dispose of records only under schedules approved by the PA Local Government Records Committee; PA hospitals must keep patient medical records at least 7 years after discharge (minors: until majority, then 7 more years); and federal rules set separate floors for HIPAA documentation (6 years), tax records (3–7 years depending on the situation), payroll (3 years, with underlying wage-computation records at 2 years), and workplace exposure/medical records (duration of employment plus 30 years). This guide lays out each schedule with its source so records managers can confirm the period that applies to their organization.
More from the Compliance & Regulations category.
Next step
Share the framework, records condition, workflow, capacity issue, or implementation risk. Reynolds routes it to the discipline that owns the work — from Emmaus, with same-day response.
Need help applying this guide?
Talk to a specialistThis guide is general reference information, not legal advice. Retention schedules and regulations are periodically revised — always confirm the current requirement against your regulator's published schedule (PHMC Local Government Records Committee, PA Department of Health, IRS, DOL, OSHA, or HHS) before setting a destruction date.
Records-retention questions rarely have a single answer, because Pennsylvania organizations sit under overlapping layers of authority: state schedules for local government, state health regulations for medical providers, and federal rules for tax, payroll, and workplace safety records. Each layer sets its own floor — the record must be kept at least that long — and where multiple rules apply to the same document, the longest applicable period controls. The table below summarizes every retention period verified directly against a primary regulatory source for this guide. Where a commonly cited duration could not be confirmed at the primary source, it has been left out rather than approximated — see the Sources section for what remains open.
| Record Type |
|---|
Compliance & Regulations
Compliance & Regulations
| Retention Period |
|---|
| Authority |
|---|
| Citation |
|---|
| PA municipal records (any type) | Governed by the specific series schedule approved by the Local Government Records Committee — no single blanket period; disposition is only lawful under an approved schedule | Municipal Records Act; PA Local Government Records Committee | pa.gov — Local Government Retention and Disposition Schedules |
|---|---|---|---|
| HIPAA Security Rule documentation (policies, procedures, risk assessments, training/action records) — NOT the patient medical record itself | 6 years from the date of creation or the date it was last in effect, whichever is later | HIPAA Security Rule | 45 CFR §164.316(b)(2)(i) |
| PA hospital patient medical records (adult) | Minimum 7 years following discharge | PA Dept. of Health hospital licensure regulations | 28 Pa. Code §115.23 |
| PA hospital patient medical records (minor) | Until the patient reaches majority, then 7 more years, or as long as adult records are maintained — whichever is longer | PA Dept. of Health hospital licensure regulations | 28 Pa. Code §115.23 |
| General business tax records supporting a return (no special situations below apply) | 3 years | IRS | IRS — How long should I keep records? |
| Employment tax records | At least 4 years after the tax becomes due or is paid, whichever is later | IRS | IRS — How long should I keep records? |
| Worthless securities loss or bad debt deduction records | 7 years | IRS | IRS — How long should I keep records? |
| Records where income was underreported by more than 25% of gross income | 6 years | IRS | IRS — How long should I keep records? |
| No return filed, or a fraudulent return filed | Indefinitely | IRS | IRS — How long should I keep records? |
| FLSA payroll records (payroll data, collective bargaining agreements, sales/purchase records) | At least 3 years from the last date of entry | Fair Labor Standards Act | 29 CFR §516.5(a) |
| FLSA wage-computation source records (time cards, work schedules, wage-rate tables) | At least 2 years | Fair Labor Standards Act | 29 CFR §516.6 |
| Employee medical records (occupational exposure-related) | Duration of employment plus 30 years | OSHA | 29 CFR §1910.1020(d)(1)(i) |
| Employee exposure records | At least 30 years | OSHA | 29 CFR §1910.1020(d)(1)(ii) |
| Analyses using exposure or medical records | At least 30 years | OSHA | 29 CFR §1910.1020(d)(1)(iii) |
Pennsylvania municipalities — cities of the third class, boroughs, incorporated towns, and townships of the first and second classes — don't operate under one blanket retention number. Instead, the Municipal Records Act authorizes municipal officers to dispose of records only in accordance with schedules approved by the state's Local Government Records Committee (administered through the Pennsylvania Historical & Museum Commission / PA State Archives). Each record series — meeting minutes, financial ledgers, personnel files, permits, and dozens of others — has its own approved schedule; there is no shortcut around it. Confirm the exact period for a given series directly against the current published schedule before scheduling any disposition.
The framework does confirm one point relevant to scanning programs: Pennsylvania explicitly permits electronic recordation to satisfy retention requirements. Municipalities may retain permanent records in PDF/A format, but must notify PHMC of their intent to use PDF/A for each record series before relying on it. Beyond that notification requirement, this guide does not have a verified primary-source citation for detailed imaging or certification standards (resolution, indexing, or destruction-of-original procedures) — that detail should be confirmed directly against the current Municipal Records Manual or by contacting PHMC's Division of Archives and Records Management before destroying source paper.
Two separate rules apply to healthcare organizations, and they are easy to conflate:
HIPAA itself does not set a medical-record retention period. The HIPAA Security Rule requires covered entities and business associates to retain documentation — policies, procedures, risk assessments, and records of security-related actions — for 6 years from the date of creation or the date it was last in effect, whichever is later (45 CFR §164.316(b)(2)(i)). This is a documentation-retention rule, not a patient-chart-retention rule.
State law governs how long the patient medical record itself must be kept. For Pennsylvania hospitals, 28 Pa. Code §115.23 sets a floor of 7 years following a patient's discharge. For a minor patient, records must be kept until the patient reaches the age of majority, and then for 7 more years (or as long as adult records are maintained, whichever period is longer). This guide did not independently verify retention requirements for non-hospital healthcare settings (physician offices, outpatient clinics, long-term care) — those are governed by separate PA regulations and were out of scope for this pass.
The IRS ties record retention to the statute of limitations for the return the records support, which is why the period varies by situation rather than being a single flat number:
Organizations should apply the longest period that any of their tax records could trigger, rather than defaulting to the 3-year minimum across the board.
Federal wage-and-hour rules split payroll retention into two tiers under the FLSA recordkeeping regulations (29 CFR Part 516):
In practice, this means the summary payroll record needs a shorter shelf life than the source documents that produced it — organizations often standardize on the longer 3-year period for simplicity, but the 2-year floor is what the regulation actually requires for the source data alone.
OSHA's access-to-records standard (29 CFR §1910.1020) sets the longest retention periods in this guide, reflecting the long latency of many occupational illnesses:
The regulation does include narrower exceptions for certain background data (for example, some environmental monitoring data may be kept for a shorter period if summary data is retained for 30 years) — organizations with complex industrial hygiene programs should review the full text of §1910.1020(d) rather than relying on the general rule alone.
None of the retention periods above change because a record is digitized — a scanned record is still subject to the same retention clock as its paper original. What digitization changes is storage cost, retrieval speed, and, for Pennsylvania municipalities specifically, the confirmed ability to rely on an electronic format instead of the paper original, provided the format and notification requirements are met.
For Pennsylvania local government records specifically, this guide verified that PDF/A is an accepted format for permanent electronic retention, subject to notifying PHMC of the intent to use it for each record series. Reynolds' document scanning services produce PHMC-compliant PDF/A output as part of a broader records management program. This guide did not verify equivalent digitization-standards language for the healthcare, tax, payroll, or OSHA record categories above — organizations in those categories should confirm digitization and destruction-of-original practices with their specific regulator (PA Department of Health for hospital records; IRS guidance for tax records; DOL/OSHA for employment and safety records) before destroying source paper based on a scan alone.
A record's retention period is the floor for how long it must be kept — it is not, by itself, instruction on format. Two practical checkpoints:
Under 28 Pa. Code §115.23, PA hospitals must keep patient medical records for a minimum of 7 years following the patient's discharge. For a minor patient, records must be kept until the patient reaches the age of majority and then for 7 more years, or as long as adult records are maintained, whichever is longer.
No. HIPAA's Security Rule (45 CFR §164.316(b)(2)(i)) requires covered entities to retain security-related documentation — policies, procedures, and risk assessments — for 6 years. It does not set a retention period for the patient medical record itself; that is governed by state law, which in Pennsylvania is 28 Pa. Code §115.23 for hospitals.
Under the FLSA recordkeeping regulations, payroll records must be kept at least 3 years from the last date of entry (29 CFR §516.5(a)). The underlying records used to compute wages — time cards, work schedules, wage-rate tables — need only be kept 2 years (29 CFR §516.6).
The IRS default is 3 years, but the period extends depending on the situation: 4 years for employment tax records, 6 years if income was underreported by more than 25%, 7 years for worthless-securities or bad-debt-deduction claims, and indefinitely if no return was filed or the return was fraudulent.
Under 29 CFR §1910.1020(d), employee medical records related to occupational exposure must be kept for the duration of employment plus 30 years, and employee exposure records (and analyses using them) must be kept for at least 30 years.
The PA Local Government Records Committee, under the Municipal Records Act, approves the retention and disposition schedules that municipal officers must follow. There is no single blanket period — each record series (minutes, financial records, permits, personnel files, etc.) has its own approved schedule, and disposition is only lawful under that approved schedule.
It depends on the record category and the regulator, and the honest answer is nuanced rather than a blanket yes. For Pennsylvania municipal records, PDF/A is a confirmed acceptable electronic format for permanent retention, but municipalities must notify PHMC of the intent to use PDF/A for each record series. For other categories in this guide — healthcare, tax, payroll, and OSHA records — this guide did not verify a primary-source statement confirming that a scan alone satisfies the retention requirement in place of the original. Confirm with your specific regulator before destroying source paper based on a scan.
Only once you've confirmed the record isn't subject to a longer period under a different rule that also applies to it (for example, a document could be both a tax record and an employment record with different floors), and, for PA municipal records, only in accordance with the disposition method authorized in the applicable approved schedule.
