Massachusetts Document Retention Schedule — By Industry
How long to keep records in Massachusetts — 9 industries. Healthcare, legal, accounting, schools, HR, financial services, real estate, non-profits, and general business. Minimum retention periods, governing authority, and what to do when retention ends.
For the current rules by industry, see our Massachusetts document retention schedule.
How to Use This Guide
Every Massachusetts business and institution operates under at least two layers of records retention obligations: federal requirements (IRS audit windows, HIPAA, FLSA, FERPA) and Massachusetts state law (M.G.L. statutes of limitation, 201 CMR 17.00, 603 CMR 23.00). Professional organizations — law firms, CPA practices, medical providers — carry a third layer from their licensing board and professional conduct rules.
This guide organizes those obligations by industry. Each section shows the minimum retention period for the most common record categories, the governing authority, and a plain-language explanation of why that period exists. The schedules reflect widely adopted standards; individual circumstances — pending litigation, open audits, active investigations — always extend retention regardless of the minimums listed here. When a retention period ends, see our guide to signs your business is overdue for a records purge for practical guidance on beginning the clearance process.
Massachusetts statutes of limitation define how long a party can bring a legal claim. They are the most important driver of business record retention because records must generally be kept for at least as long as a claim could be filed. The following periods govern most common business situations.
| Claim Type | Period | Authority |
|---|---|---|
| Written contracts | 6 years | M.G.L. c. 260, §2 |
| Oral contracts | 6 years | M.G.L. c. 260, §2 |
| Tort / personal injury | 3 years | M.G.L. c. 260, §2A |
| Medical malpractice | 3 years | M.G.L. c. 260, §4 |
| Product liability | 3 years | M.G.L. c. 260, §2A |
| Property damage | 3 years | M.G.L. c. 260, §2A |
| Employment / wage claims | 3 years | M.G.L. c. 149, §150 |
| Tax (standard IRS audit window) | 3 years | IRC §6501(a) |
| Tax (substantial understatement) | 6 years | IRC §6501(e) |
| Tax fraud | No limit | IRC §6501(c) |
Massachusetts medical record retention is governed by a combination of state law (M.G.L. c. 111, §70), HIPAA Privacy Rule requirements, and Medicare/Medicaid billing fraud statute of limitations periods. Massachusetts law is more protective of patients than the federal HIPAA minimum in several respects. Healthcare providers must satisfy the most stringent applicable requirement. HIPAA requires covered entities to retain HIPAA-related documentation (policies, procedures, notices of privacy practices, authorizations, and business associate agreements) for six years from creation or last effective date. Clinical records have their own retention requirements under state law.
| Record Type | Minimum Retention | Authority |
|---|---|---|
| Adult patient medical records | 7 years from last treatment | M.G.L. c. 111, §70; HIPAA 45 CFR §164.530(j) |
| Minor patient records | Until age 21, or 7 years — whichever is longer | M.G.L. c. 111, §70 minor provision |
| HIPAA policies & procedures | 6 years from creation or last effective date | 45 CFR §164.530(j)(2) |
| Business Associate Agreements | 6 years from creation or last effective date | 45 CFR §164.530(j)(2) |
| Billing & claims records | 7 years from service date | Medicare/Medicaid fraud SOL; CMS guidance |
| Radiology / imaging (X-rays, MRI) | 5–7 years; minors until age 21 | State radiation regulations; professional standards |
| Laboratory reports | 10 years | CLIA 42 CFR §493.1105 (10 yrs for cytology) |
| Pathology / tissue specimens | 2 years minimum; 10+ years recommended | CAP guidelines; CLIA requirements |
| Surgical / anesthesia records | 7 years from procedure | M.G.L. c. 111, §70; professional standards |
| Controlled substance records (DEA) | 2 years minimum | 21 CFR §1304.04 |
| Employee occupational health records | 30 years post-employment | OSHA 29 CFR §1910.1020 (toxic substance exposure) |
Law firm records retention is shaped by the Massachusetts malpractice statute of limitations (three years), the Rules of Professional Conduct (confidentiality obligations that survive file closure), ABA Formal Opinion 471 (client notification before file destruction), and the IOLTA account requirements under Mass. R. Prof. C. 1.15. The overriding principle is that client confidentiality obligations extend through the final act of disposal — a discarded client file is a potential Rule 1.6 violation.
| Record Type | Minimum Retention | Authority |
|---|---|---|
| Active matter files (most practice areas) | 7 years post-representation | MA malpractice SOL (3 yr) + conservative buffer; ABA Opinion 471 |
| Real property / title matters | 20 years post-representation | MA deed recording claims; title defect exposure |
| Estate & probate matters | Permanent recommended | Beneficiary claims may arise decades later |
| Criminal defense files | Permanent | Habeas corpus; post-conviction relief — no fixed SOL |
| Family law / custody orders | 10 years post-representation | Modification proceedings can be filed years after judgment |
| IOLTA trust account records | 7 years minimum | Mass. R. Prof. C. 1.15(f) |
| Financial / billing records | 7 years | IRS audit exposure; client fee dispute records |
| Engagement letters & retainer agreements | 7 years post-engagement | Malpractice defense; fee dispute documentation |
| HR & personnel records | 7 years post-separation | EEOC 5-yr; MA wage claim SOL 3 yr; conservative buffer |
CPA firms operate under AICPA Code §1.700.001 (Confidential Client Information), IRC §7216 (criminal penalties for unauthorized disclosure of tax return information), and — since June 9, 2023 — the FTC Safeguards Rule (16 CFR Part 314), which classifies tax preparers as financial institutions subject to formal information security program requirements. Penalties under the FTC Safeguards Rule begin at $100,000 per violation.
| Record Type | Minimum Retention | Authority |
|---|---|---|
| Individual tax returns (Form 1040) | 7 years | IRS 6-yr fraud SOL; AICPA guidance |
| Business returns (1120, 1065, 1120-S) | 7 years | IRS audit window; potential successor claims |
| Tax workpapers & supporting schedules | 7 years | AICPA records guidance; IRS document request exposure |
| Audit & attest engagement files | 7–10 years | AICPA SSARS; SOX 7-yr rule for public company audits |
| Estate & gift tax returns | Permanent recommended | No SOL for fraudulent returns; stepped-up basis disputes |
| Engagement letters | 7 years post-engagement | Professional liability and malpractice defense |
| Compiled financial statements | 7 years | SSARS standards; lender reliance claims |
| Payroll & employment tax records | 7 years | IRS §6501; FICA SOL provisions |
| Firm financial records & billing | 7 years | IRS audit; fee dispute documentation |
Massachusetts schools operate under FERPA (20 U.S.C. §1232g), IDEA (for special education records), and Massachusetts 603 CMR 23.00 — which divides student records into permanent (transcript) and temporary (everything else) categories with dramatically different retention periods. Massachusetts requires written parent notification before destroying any student record, regardless of whether the federal FERPA minimum has been met.
| Record Type | Minimum Retention | Authority |
|---|---|---|
| Student transcript (permanent record) | 60 years after student leaves | 603 CMR 23.06(1) — only record with 60-yr minimum |
| Special education records (IEPs, evaluations) | 7 years after student leaves | 603 CMR 23.06; IDEA parent notification required first |
| Disciplinary records | 7 years after student leaves | 603 CMR 23.06; written parent notice required |
| School health records (nurse files) | 7 years; immunization records 10 years | 603 CMR 23.06; 105 CMR 220.500 for immunizations |
| Standardized test scores | 7 years after student leaves | 603 CMR 23.06 temporary record provisions |
| Counseling records | 7 years after student leaves | 603 CMR 23.06; heightened security required |
| Financial aid & lunch eligibility records | 7 years | Federal program auditing requirements |
| Employee / HR records | 7 years post-separation | EEOC 5-yr; MA wage claim SOL 3-yr; conservative buffer |
| School committee minutes & policies | Permanent | Massachusetts public records requirements |
| Student devices (Chromebooks, tablets) | Destroy on decommission | FERPA + MA 201 CMR 17.00 — student data on hardware |
Financial services firms operate under the Gramm-Leach-Bliley Act (GLBA), the Bank Secrecy Act (BSA), SEC and FINRA recordkeeping rules, the FTC Safeguards Rule, and Massachusetts 201 CMR 17.00. The GLBA Safeguards Rule requires documented secure disposal of customer financial records. Insurance companies in Massachusetts are also subject to DOI record retention requirements.
| Record Type | Minimum Retention | Authority |
|---|---|---|
| Bank Secrecy Act records (CTRs, SARs) | 5 years | BSA 31 CFR §1010.430 |
| Customer account records | 6 years from account closure | FINRA Rule 4511; SEC Rule 17a-4 |
| Trade confirmations & blotters | 3–6 years depending on type | SEC Rule 17a-4; FINRA Rule 4511 |
| Customer complaints | 4 years | FINRA Rule 4513 |
| Anti-money laundering records | 5 years | BSA / FinCEN requirements |
| Loan origination files | 3 years post-payoff | ECOA Reg B; RESPA; TILA requirements |
| Insurance policies (issued) | Permanent (long-tail claims) | MA DOI; CGL long-tail liability exposure |
| Insurance application & claims records | 6 years | MA DOI regulations; M.G.L. c. 260, §2 |
| GLBA privacy notices & opt-outs | 5 years | 16 CFR Part 313; FTC Safeguards Rule |
| General ledgers & financial statements | 7 years | IRS audit window; SOX (public companies) |
Every Massachusetts employer is subject to a layered HR records regime combining federal requirements (FLSA, FMLA, ADA, EEOC, ERISA) with Massachusetts state law (M.G.L. c. 149 wage and hour provisions, MCAD anti-discrimination requirements, and the three-year wage claim statute of limitations). The standard recommendation of seven years post-separation for most personnel records reflects a conservative buffer above the longest applicable federal period.
| Record Type | Minimum Retention | Authority |
|---|---|---|
| Payroll records (wages, hours, deductions) | 3 years minimum; 7 years recommended | FLSA 29 CFR §516.5; MA M.G.L. c. 149 §52C |
| I-9 Employment Eligibility Verification | 3 years from hire OR 1 year after termination — whichever is later | 8 CFR §274a.2(b)(2) |
| Personnel files (active employees) | Duration of employment + 7 years | EEOC 5-yr; MA MCAD 3-yr; conservative practice |
| FMLA records & leave documentation | 3 years | 29 CFR §825.500 |
| ADA accommodation records | 1 year from creation; 3 years recommended | 29 CFR §1602.14; EEOC guidance |
| ERISA pension & benefits records | 6 years | ERISA §107; 29 CFR §2520.107-1 |
| Workers’ compensation records | 5 years post-injury | MA M.G.L. c. 152; DIA requirements |
| OSHA injury & illness logs (300, 300A, 301) | 5 years | 29 CFR §1904.33 |
| Toxic substance exposure records | 30 years post-employment | OSHA 29 CFR §1910.1020 |
| Job applications (not hired) | 1 year minimum; 3 years recommended | EEOC 29 CFR §1602.14; MA MCAD safe practice |
| Discrimination charge files (EEOC/MCAD) | Until resolution + 1 year | 29 CFR §1602.14; M.G.L. c. 151B |
Massachusetts real estate records retention is shaped by the six-year written contract statute of limitations (M.G.L. c. 260, §2), the 20-year period for certain deed-related claims, environmental liability exposure (which can extend indefinitely under CERCLA), and the Massachusetts Board of Registration of Real Estate Brokers and Salespersons regulations requiring brokers to retain transaction records for three years.
| Record Type | Minimum Retention | Authority |
|---|---|---|
| Purchase & sale agreements (closed) | 7 years post-closing | MA SOL for written contracts; IRS capital gain records |
| Broker transaction records | 3 years minimum; 7 years recommended | 254 CMR 3.00 (MA Board of Registration) |
| Escrow & client trust records | 7 years | 254 CMR 3.00; M.G.L. c. 260, §2 |
| Lease agreements (commercial) | 7 years after expiration | M.G.L. c. 260, §2; holdover and damage claims |
| Lease agreements (residential) | 6 years after expiration | MA security deposit laws; M.G.L. c. 186 |
| Property management records | 7 years | Financial auditing; owner dispute exposure |
| Phase I / II environmental reports | Permanent recommended | CERCLA; MassDEP; long-tail environmental liability |
| Mortgage loan origination files | 3 years post-payoff | RESPA; TILA; Reg B ECOA requirements |
| Lead paint inspection records (pre-1978) | Permanent recommended | MA 105 CMR 460.000; long-tail liability |
Non-profits face the same federal tax record requirements as for-profit businesses (IRS audit windows), Massachusetts Attorney General oversight (M.G.L. c. 12, §8E), and additional obligations tied to grant funding, donor restrictions, and board governance. IRS Form 990 and the organization’s application for tax-exempt status (Form 1023) should be retained permanently and are available for public inspection upon request.
| Record Type | Minimum Retention | Authority |
|---|---|---|
| IRS determination letter (tax exemption) | Permanent | Public inspection requirement; IRS §6104 |
| Form 990 (annual information returns) | Permanent (public record) | IRC §6104; public disclosure obligation |
| Board meeting minutes & resolutions | Permanent | Governance best practice; MA AG oversight |
| Articles of organization & bylaws | Permanent | M.G.L. c. 180; corporate formation records |
| Audited financial statements | 7 years | IRS audit window; MA AG Pub. Charities Division |
| Grant documentation & reports | 3–7 years after grant period | Grantor requirements vary; federal grants: 3 years (2 CFR §200.334) |
| Donor records & pledge agreements | 7 years after fulfillment | M.G.L. c. 260, §2; gift restriction enforcement |
| Payroll & HR records | 7 years post-separation | FLSA; EEOC; MA wage laws — same as any employer |
| Contracts & vendor agreements | 7 years after expiration | M.G.L. c. 260, §2 (6-yr written contract SOL + buffer) |
Every Massachusetts business — regardless of industry — is subject to the IRS audit window, the six-year written contract statute of limitations, and Massachusetts 201 CMR 17.00 (requiring documented secure disposal of records containing personal information). The schedules below apply broadly to any for-profit business not covered by a more specific industry framework above.
| Record Type | Minimum Retention | Authority |
|---|---|---|
| Corporate formation documents (articles, bylaws) | Permanent | M.G.L. c. 156D; corporate governance records |
| Annual reports & board minutes | Permanent | Corporate governance; director liability exposure |
| Federal & state tax returns | 7 years | IRC §6501 (6-yr window) + 1-yr buffer |
| General ledger & financial statements | 7 years | IRS audit; investor / lender access obligations |
| Accounts payable & receivable records | 7 years | IRS audit; M.G.L. c. 260, §2 (6-yr SOL) |
| Bank statements & cancelled checks | 7 years | IRS audit; fraud investigation lookback periods |
| Contracts & vendor agreements | 7 years after expiration | M.G.L. c. 260, §2 (6-yr written contract SOL + buffer) |
| Insurance policies (occurrence-based CGL) | Permanent | Long-tail claims may arise decades after policy period |
| Property & equipment records | 7 years post-disposal | IRS depreciation; basis calculation for capital gains |
| Customer & sales records | 7 years | IRS audit; M.G.L. c. 260, §2; UCC claims |
| Manufacturing / quality records | 10–15 years (product liability exposure) | M.G.L. c. 260, §2A; repose period for products varies |
A record that has passed its retention period is not simply an old file — it is a liability waiting for a trigger. It contains personal information about identifiable people. It is subject to Massachusetts 201 CMR 17.00. If it is breached, M.G.L. c. 93H requires notification to the Attorney General and affected individuals. The correct action when a retention period ends is secure destruction, not indefinite storage or casual recycling. Our annual purge service is designed specifically for this moment — any volume, one visit, flat rate confirmed in writing.
“A covered entity shall implement and monitor compliance with policies and procedures that establish physical, administrative and technical safeguards appropriate to the size, scope and type of business of the covered entity to protect personal information from unauthorized access, use, modification, and disclosure… Records disposal shall render personal information unreadable.”
201 CMR 17.00, Massachusetts Standards for the Protection of Personal Information. Applies to every business that owns, licenses, or maintains personal information about Massachusetts residents.Physical industrial shredding — reducing paper to cross-cut confetti and electronic media to fragments too small to contain any recoverable data — satisfies the “unreadable and unrecoverable” standard under 201 CMR 17.00, HIPAA, FACTA, FTC Safeguards Rule, and all industry-specific frameworks covered in this guide. The notarized Certificate of Destruction is your documented evidence that the obligation was met.
Three things that do NOT satisfy “unreadable and unrecoverable”
“After the recession our company recovered and we needed to clean out a decade of records from our storage room. The FAQ page was very helpful — I appreciated the speed and courtesy during the visit and the certificate was in my inbox the next morning. I will definitely use your service again.”
Massachusetts document retention — common questions
Under M.G.L. c. 111, §70, Massachusetts medical providers must retain adult patient records for at least seven years from the date of last treatment. Records for minor patients must be retained until the patient reaches age 21, or for seven years from the date of last treatment — whichever period is longer. HIPAA separately requires covered entities to retain HIPAA-related administrative documentation for six years from creation or last effective date. Providers must satisfy whichever period is longest. See our HIPAA medical shredding guide for the complete compliance framework for Massachusetts healthcare providers.
Massachusetts does not have a single comprehensive employer records retention statute. Employers must navigate a combination of federal requirements: three years for payroll records under the FLSA, six years for ERISA benefits records, and five years for OSHA injury logs. The Massachusetts wage claim statute of limitations is three years (M.G.L. c. 149, §150), and MCAD discrimination claims can be filed within three years of the discriminatory act. Most employment attorneys recommend retaining all personnel records for seven years post-separation as a safe buffer above every applicable period. When the retention period ends, our annual purge service handles the certified destruction.
The standard IRS audit window is three years from the filing date or due date, whichever is later. The window extends to six years if the IRS determines that income was understated by more than 25%. There is no statute of limitations for fraudulent returns. Most Massachusetts businesses retain all tax records for seven years — providing a one-year buffer beyond the six-year window — before certified destruction. Our guide to signs your business is overdue for a records purge covers the practical indicators that a review is needed.
While no single Massachusetts statute mandates a Certificate of Destruction by that name, the requirement for “documented secure disposal” under 201 CMR 17.00, HIPAA, FACTA, and the FTC Safeguards Rule is functionally equivalent to requiring one. In practice, the notarized Certificate of Destruction is the standard evidence of compliant disposal accepted by auditors, regulators, and courts across all applicable frameworks. Organizations that cannot produce documentation of their disposal practices have no evidence of compliance when challenged. About our Certificate of Destruction.
We handle certified destruction for every industry on this page.
Drop-off 99¢/lb at our Tewksbury MA facility, schedule a pickup, or call to discuss a large annual purge. Notarized Certificate of Destruction with every job. Serving Greater Boston since 2007.