Document Retention and Destruction Policy

1. Purpose

The headacheMD for all Foundation (the "Foundation") is committed to maintaining accurate records and ensuring compliance with legal, regulatory, and operational requirements. This Document Retention and Destruction Policy establishes guidelines for:

• Retaining documents for appropriate periods;
• Securely storing documents during the retention period;
• Properly destroying documents when retention periods expire;
• Ensuring compliance with applicable laws and regulations;
• Protecting confidential and sensitive information.

2. Scope

This policy applies to all documents, records, and information in any format, including:

• Paper documents;
• Electronic files and databases;
• Email communications;
• Photographs and images;
• Audio and video recordings;
• Digital storage media;
• Any other medium containing information related to Foundation operations.

3. Legal Hold Exception

When a legal hold is in effect:

• All relevant documents must be preserved;
• Destruction of documents must be suspended immediately;
• All staff must be notified of the legal hold;
• Documents must be secured and protected from loss or alteration;
• Legal counsel will determine when the legal hold may be lifted.

4. Document Retention Schedule

The following table outlines retention periods for various categories of documents. These periods reflect legal requirements, industry best practices, and operational needs.

Document Category	Retention Period	Notes
Corporate Records	Permanent	Articles of Incorporation, Bylaws, Amendments
Board Meeting Minutes	Permanent	All board and committee meeting minutes
Tax Returns & Financial Records	7 years after filing	IRS Form 990, state tax returns, financial statements
Audited Financial Statements	Permanent	Annual audited financial statements
Employment Records	7 years after termination	Personnel files, payroll records, benefits records
Patient Assistance Applications	10 years after last contact	Applications, medical records, financial documentation
HIPAA Protected Health Information (PHI)	6 years from creation or last effective date	Minimum; may be longer based on state law
Medical Review Committee Records	10 years	Review decisions, meeting notes, correspondence
Financial Assistance Committee Records	10 years	Review decisions, financial assessments
Donation Records	7 years	Donor information, gift acknowledgments, receipts
Contracts & Agreements	7 years after expiration or termination	Service agreements, vendor contracts, leases
Insurance Policies	Permanent	Current and expired policies, claims records
Legal Documents	Permanent	Lawsuits, judgments, settlements, legal opinions
Whistleblower Reports	10 years from resolution	Reports, investigation records, outcomes
Conflict of Interest Disclosures	7 years after disclosure	Annual disclosure forms, board recusal records
Email Communications	3 years (unless otherwise specified)	General emails; important emails may have longer retention
Bank Statements & Records	7 years	Bank statements, canceled checks, deposit records
Accounting Records	7 years	General ledgers, journals, invoices, receipts
Grants & Funding Agreements	7 years after final payment	Grant applications, award letters, reports

5. Document Storage

5.1 Physical Documents

Physical documents should be:

• Stored in secure, climate-controlled facilities;
• Organized in a logical filing system;
• Protected from fire, water damage, and unauthorized access;
• Indexed for easy retrieval;
• Regularly reviewed to identify documents eligible for destruction.

5.2 Electronic Documents

Electronic documents should be:

• Stored on secure, password-protected systems;
• Backed up regularly with off-site storage;
• Encrypted when containing sensitive information;
• Organized in a logical directory structure;
• Protected by firewalls and antivirus software;
• Accessible only to authorized personnel.

5.3 HIPAA-Protected Information

Documents containing Protected Health Information (PHI) must be stored in compliance with HIPAA requirements:

• Physical documents must be locked in secure cabinets;
• Electronic PHI must be encrypted;
• Access must be limited to authorized personnel with a need to know;
• Access logs must be maintained;
• Business Associate Agreements must be in place for third-party storage providers.

6. Document Destruction

6.1 Destruction Procedures

Documents may only be destroyed after:

• The retention period has expired;
• No legal hold is in effect;
• Approval has been obtained from the designated authority (typically the Executive Director or Board Treasurer);
• A destruction log has been created documenting what was destroyed and when.

6.2 Destruction Methods

Documents must be destroyed using methods that ensure information cannot be recovered:

• Paper Documents: Shredded using a cross-cut shredder or destroyed by a certified document destruction service;
• Electronic Files: Deleted and overwritten using secure deletion software, or the storage media must be physically destroyed;
• Hard Drives & Storage Media: Physically destroyed (drilled, degaussed, or crushed) or securely wiped using Department of Defense (DoD) standards;
• CDs/DVDs: Physically destroyed (shredded or broken);
• HIPAA-Protected Information: Must be destroyed in a manner that renders PHI unreadable, indecipherable, and otherwise cannot be reconstructed.

6.3 Destruction Log

A destruction log must be maintained documenting:

• Date of destruction;
• Description of documents destroyed;
• Retention period that applied;
• Method of destruction;
• Person authorizing destruction;
• Person performing destruction;
• Confirmation that no legal hold was in effect.

7. Responsibilities

7.1 Board of Directors

The Board of Directors is responsible for:

• Approving this policy and any amendments;
• Ensuring compliance with the policy;
• Overseeing document retention and destruction activities.

7.2 Executive Director

The Executive Director is responsible for:

• Implementing this policy;
• Designating document custodians for each department;
• Authorizing document destruction;
• Ensuring staff are trained on this policy;
• Maintaining the destruction log.

7.3 Document Custodians

Document custodians are responsible for:

• Maintaining organized document files;
• Identifying documents eligible for destruction;
• Ensuring documents are properly stored and secured;
• Coordinating destruction activities for their department.

7.4 All Staff

All staff members are responsible for:

• Following this policy;
• Not destroying documents without authorization;
• Reporting potential policy violations;
• Protecting confidential information.

8. Compliance Monitoring

The Foundation will:

• Conduct annual reviews of document retention practices;
• Audit destruction logs to ensure compliance;
• Train staff on policy requirements annually;
• Update the retention schedule as laws change.

9. Policy Review and Updates

This policy will be reviewed annually by the Board of Directors. The retention schedule will be updated as necessary to reflect changes in applicable laws and regulations.

10. Contact Information

Questions about document retention or destruction should be directed to:

headacheMD for all Foundation
Executive Director
Email: info@headacheMD.org
Phone: (713) 426-3337
Address: 19907 Empress Crossing Ct, Spring, TX 77379