Nonprofit records retention: what to keep, what to purge, and who decides

Retention is a governance decision, not an IT task

The most common mistake is handing retention to whoever manages the drive. IT can tell you how much storage you have and how to move files. It can’t tell you whether a 2017 client intake form is still needed, whether a grant closeout has cleared audit, or whether an HR file is tied to an open complaint.

Those are program, finance, HR, and compliance questions. A workable retention schedule is approved by leadership, owned record type by record type by the people who understand the work, and carried out with IT’s help. When the order is reversed, one of two things usually happens. Either nothing gets deleted because nobody feels authorized, or something gets deleted that shouldn’t have been.

The rules come in layers

No single law sets a nonprofit’s retention periods. Several layers apply at once, and the longest applicable period wins. Here are the federal layers most social-service organizations run into.

Health privacy (HIPAA). If your organization is a HIPAA covered entity, the Privacy Rule requires you to keep your HIPAA policies, procedures, and required documentation, such as authorizations and notices, for six years from the date created or the date last in effect, whichever is later (45 CFR 164.530(j)). A point that surprises many people: HIPAA does not set a retention period for medical records themselves. HHS says so directly, and it leaves that to state law (HHS FAQ). What HIPAA does require is that records stay protected for as long as you hold them, including when you dispose of them.

Substance use disorder records (42 CFR Part 2). Part 2 doesn’t add a general retention period either. It does set rules for how records are destroyed: paper and electronic media must be sanitized so patient-identifying information is non-retrievable (42 CFR 2.16). It also sets specific handling if a program closes or is acquired (42 CFR 2.19). If your organization holds Part 2 records, how you purge matters as much as when.

Federal grants. Recipients and subrecipients of federal awards must keep award records for three years from the date the final financial report is submitted (2 CFR 200.334). That clock stops if litigation, a claim, or an audit starts before the three years are up: the records must be kept until it is resolved. It can also be extended in writing by the funding agency. Equipment bought with federal funds has its own clock, three years after final disposition. Note that the trigger is the final report, not the grant end date or the date the record was created, which is why grant records are easy to purge too early.

Tax and exempt status. The IRS asks public charities to keep records as long as they may be needed to show compliance with the tax code. For records supporting a return, that generally means until the statute of limitations runs, usually three years after the return’s due date or filing date, whichever is later. The IRS also names documents to keep permanently: the application for tax-exempt status, the determination letter, organizing documents such as articles of incorporation and bylaws with amendments, and board minutes (IRS Publication 4221-PC). Employment tax records must be kept at least four years after the tax is due or paid, whichever is later (IRS).

Employment. Payroll records under the Fair Labor Standards Act must be kept at least three years (29 CFR 516.5). Form I-9 must be kept three years after the date of hire or one year after employment ends, whichever is later (USCIS). General personnel records must be kept at least one year under EEOC rules, and longer if a discrimination charge is filed, until it is resolved (29 CFR 1602.14).

State law, contracts, and funders. This is the layer that usually sets the longest periods, and the one that varies most. States set how long clinical records must be kept, often with longer periods for records of minors, and licensing rules for behavioral health and other regulated programs add their own requirements. Contracts with counties, managed care plans, and private funders often specify retention periods too. Read them, because a contract term can quietly outlast every federal minimum above.

Build a schedule you can actually maintain

A retention schedule doesn’t need to be long. It needs one row for each kind of record your organization actually keeps, and each row needs six things:

• Record type. Described the way staff talk about it (“client intake packets,” “federal grant closeout files”), not in legal categories.
• Owner. The role that decides questions about this record type, such as the program director, finance manager, or HR lead.
• Trigger event. When the clock starts: creation, case closure, the end of employment, submission of a final report.
• Retention period. How long after the trigger.
• Authority. The rule or contract the period comes from, so the next person can check it.
• Disposition. What happens at the end: secure destruction, transfer to an archive, or permanent retention.

Two habits make the schedule usable. First, write down the authority for every period, even when it’s “internal decision.” When a funder or auditor asks why something was deleted, the answer is in the row. Second, prefer fewer, broader record types. Twenty well-owned rows beat two hundred that nobody reads.

Decide who signs off

Retention decisions should run through the people who carry the risk. In a small organization, that usually means the program or department lead as owner, finance for anything tied to grants or tax, HR for personnel files, whoever holds compliance responsibility for anything touching client health information, and the executive director for final approval of the schedule. Outside counsel reviews the schedule before it’s first used to delete regulated records.

Put the approval in writing. A schedule signed by leadership turns “someone deleted those files” into “we followed our documented policy,” and that difference matters in an audit or a dispute.

A safe way to purge

Once the schedule is approved, clearing out old records is a process, not a cleanup day.

1. Inventory before touching anything. List what exists: every file and folder, with its path, type, size, and dates. Work read-only, and move nothing until the inventory is done. In one behavioral health audit Klaro ran, the inventory covered 23,220 files and folders. Nothing was moved or deleted until every entry had been classified.
2. Classify each item against the schedule. Mark each record to keep, archive, destroy, or escalate. Keep two separate labels: what should happen to the record, and which rules might apply to it. A file can be a routine archive candidate and still need a compliance review first. In that audit, roughly 4,100 items were escalated for compliance review before any action.
3. Route escalations to the right owner. Anything that may contain client health information, substance use records, personnel data, or grant documentation goes to its owner, and to counsel where needed, before a decision is made.
4. Get written authorization for destruction. List the specific records or batches to be destroyed and have the owner and leadership approve the list. Place a legal hold on anything tied to litigation, an audit, or an open claim, and exclude it.
5. Destroy securely and keep a log. Use destruction methods that match the sensitivity: sanitize media for health and substance use records, not just “move to trash.” Record what was destroyed, when, under which schedule row, and who approved it. Keep that log, because it’s the proof that the policy was followed.

Mistakes to avoid

• Treating “archive” as a retention decision. Moving files into an “Archive” or “OLD” folder doesn’t start a clock or assign an owner. It hides the problem.
• Starting the grant clock too early. Federal grant retention runs from the final financial report, not the end of the program year.
• Assuming HIPAA sets clinical record retention. It doesn’t. Your state does, often with longer periods for minors.
• Deleting during a migration. Migrations create pressure to “clean up while we’re at it.” Classify first, migrate what the schedule says to keep, and handle destruction as its own approved step.
• Letting the schedule go stale. Review it when you add a program, take on a new funder, or sign a contract with retention terms, and at least once a year.

When to bring in help

A small organization can draft its own schedule. Bring in counsel to review it before you first use it to destroy regulated records, and whenever you’re unsure whether state law or a contract sets a longer period. Bring in outside support when the backlog is too large to inventory by hand, when records are spread across several drives and systems, or when a migration deadline is forcing decisions faster than your team can make them safely.