Security incident reports should generally be kept for how long?

• A. Three to five years
• B. Five to six years
• C. Five to seven years
• D. Indefinitely

Answer: (C)

Retention of security incident reports is guided by legal exposure, regulatory expectations, and privacy considerations. The standard practice is to keep these reports for five to seven years. This window typically covers the period needed for potential civil claims and regulatory inquiries to surface, since many liability statutes in healthcare fall within that range, and investigations or audits may extend beyond the immediate incident. It balances the need to preserve documentation for investigations and litigation with concerns about privacy and storage costs. Keeping records forever isn’t usually required and increases risk of unnecessary exposure, while a shorter window like three to five years may not cover longer-tail claims. Five to seven years is a commonly adopted, prudent retention period.