ERISA Record Retention for Group Health Plans: Employer Guide

ERISA requires the records behind plan reports to be kept at least six years, and employers to keep records that show who is entitled to benefits. HIPAA adds its own six-year rule for some plans.

Talk To Us About This

Six Years For Records Behind Reports

ERISA section 107, 29 U.S.C. 1027, is titled “Retention of records.” It applies to a person who must file a report or certify information under that part of ERISA, and to a person who would have to except for an exemption or simplified reporting rule. That person must keep records on the matters being disclosed in enough detail that the document can be verified, explained or clarified, and checked for accuracy and completeness. The statute says those records include vouchers, worksheets, receipts and applicable resolutions.

The records must be available for examination for at least six years after the filing date of the document they support, or six years after the date it would have been filed but for an exemption or simplified reporting rule. In practice, the clock runs from the filing, not from the day the record was created.

A Different Six-Year Rule That May Also Apply

HIPAA’s rules are separate from ERISA’s. Two provisions use the same period. Under 45 CFR 164.316(b)(2)(i), a covered entity or business associate must keep the documentation required by the Security Rule for six years from the date of its creation or the date it last was in effect, whichever is later. Under 45 CFR 164.530(j)(2), the same six years applies to Privacy Rule documentation, which covers written policies and procedures and records of actions or designations the rule requires to be documented.

Whether these apply to your plan depends on how it is set up. A group health plan that provides benefits only through an insurance contract and creates or receives no protected health information beyond limited exceptions is relieved of most of the Privacy Rule, though paragraph (j) still reaches plan documents amended under 45 CFR 164.504(f). These provisions govern policy and compliance documentation, not every claim file. We recommend confirming your plan’s status with your counsel.

What The Labor Department Requires If You Go Paperless

Under 29 CFR 2520.107-1, electronic media may be used to meet ERISA record retention requirements when conditions are met. The system needs reasonable controls to keep records accurate, authentic, reliable and unaltered. Records must be kept in a logical order, stored safely, and be inspectable, with the ability to index, retain, preserve, retrieve and reproduce them. They must be convertible to legible paper copies when needed. No agreement may limit your ability to meet reporting and disclosure duties. The rule also expects sound practices such as labeling, secure storage, backups and periodic quality checks, and paper must be kept for any record that cannot be fully and accurately transferred to electronic form.

Destroying Records Safely

We did not confirm a federal rule in the sources above that says when you must stop destroying plan records because of an audit, a claim or a dispute. The six-year periods are minimums for the records they cover, not permission to discard on day one of year seven if something is pending. A sensible practice is to pause scheduled destruction for any records connected to a Department of Labor inquiry, a participant claim, a COBRA dispute or a carrier audit, document who made that decision, and check with counsel before resuming.

Michigan: we did not confirm a Michigan statute that sets a retention period for group health plan records, so we state none here.