Epic Systems Data Retention — Multi-Jurisdiction, WORM-Backed

Multi-layered. At federal level: HIPAA Privacy Rule §164.530(j) requires 6 years for documentation retention, HIPAA Security Rule §164.316(b)(2) requires 6 years for audit logs. HITECH adds breach-notification record retention. 42 CFR Part 2 (substance use disorder) adds patient consent retention. FDA 21 CFR Part 11 (clinical research) requires retention through trial closeout + statutory periods. At state level: California, Texas and New York require 10 years on adult records and 21–28 years on pediatric. Illinois requires 10 years. Florida requires 7 years. At Joint Commission level: continuous retention through next survey + 2 years. At CMS level: cost-report supporting documents retained 5 years post filing. The retention plan has to satisfy all of these in one artefact.

Three retention zones. Zone 1 (Epic clinical) — Chronicles, EpicCare, Resolute, Willow, OpTime, Beaker, MyChart all stay in Epic and retain on Epic's existing retention model (typically continuous + active patient + 10/21/28-year statutory windows). Zone 2 (Legacy ERP archive) — Lawson/PeopleSoft/McKesson cut to read-only at cutover and archived per their existing retention policy with read-only access for 10+ years for SOX 404 walkthrough, OIG audit, IRS audit, malpractice defense. Zone 3 (Migration artefacts) — every extract, transform output, load payload, manifest, reconciliation evidence pack hash-signed and retained per HIPAA + SOX + Joint Commission rules. All three zones queryable from a unified audit retrieval portal.

Minimum 7 years (SOX 404) — typical retention is 10+ years to cover state pediatric records, malpractice statute of limitations and Joint Commission continuous-survey requirements. For 340B-related evidence: HRSA retention rules + provider state law. For CMS cost-report supporting evidence: 5 years post filing minimum, typically 10 years. For HIPAA audit logs from the migration period: 6 years federal minimum, 7+ years many states. For 42 CFR Part 2 substance use disorder evidence: rule-specific retention plus state overlay. The Syntra ETL platform retains evidence packs in hash-signed immutable storage with WORM (write-once-read-many) controls and configurable retention windows per jurisdictional requirement.

Cut to read-only at cutover, kept queryable for 10+ years (the SOX 404 walkthrough horizon plus state retention overlay). Outright decommissioning typically happens at year 7–10 when retention windows expire — and even then, evidence packs distilled from the legacy ERP are kept indefinitely. Common pattern: Lawson/PeopleSoft/McKesson hardware retained for 2–3 years post-cutover for live read-only access, then snapshotted to a long-term archive (typically S3/OCI Object Storage with WORM + Glacier-class for the years 4–10 window), with read-only retrieval via a query portal. This balances cost (running legacy ERP forever is expensive) against retention requirements (which can't be skipped).

Epic continues its own retention model unchanged. Clarity SQL Server typically retains the operational mirror window (e.g., 2 years rolling) and Cogito retains analytical models per its configuration. Chronicles retains everything per the Epic retention configuration (which is typically continuous-plus-statutory). The migration does NOT change Epic's retention model. What Syntra ETL adds on top: every downstream-feed extract (Resolute AR posting, Willow consumption, OpTime materials, Beaker reagent) carries its own hash-signed manifest retained in the WORM archive. So even if Clarity rolls off old data, the migration evidence persists in the WORM archive with full chain of custody back to Chronicles via Cogito reconciliation reference.

Every extract, transform and load step from migration day forward is recorded in the actor log: actor (service account), timestamp (UTC + Epic-local), source row hash (SHA-256), target row hash (SHA-256), Cogito reconciliation reference (where applicable), data scope (table list with column scoping). The actor log is hash-chained — each entry's hash includes the prior entry's hash, so any tampering invalidates the chain. Retention: WORM storage with configurable window (typically 10 years federal HIPAA + state overlay). Retrieval: HIPAA-grade portal for privacy-officer + auditor self-service. The chain is unbroken from migration day through current operations. Joint Commission and OIG audits retrieve the chain directly.

CMS cost report (Form 2552-10 for hospitals) is filed annually, and supporting documents must be retained at least 5 years post-filing (typically 10 years per Medicare administrative contractor expectations). The migration scope generates supporting documents directly: AR aging snapshots used for cost-report worksheets, supply consumption history by service line, payer-mix breakdown, FTE workforce data. The retention plan tags these explicitly as "cost-report-supporting" in the WORM archive with cost-report-year metadata, so the reimbursement consultant retrieves the relevant year's pack on demand. Without this tagging, cost-report defense requires reconstructing supporting documents from scratch under audit pressure — a common pain point in legacy ERP retirements.

Yes — and this is a frequent gotcha in healthcare migrations. 42 CFR Part 2 governs substance use disorder records and patient consent for sharing. In Epic deployments, Part 2 records are typically flagged in Chronicles with restricted disclosure controls. Downstream feeds to Fusion (Resolute AR, Willow medication consumption) must respect Part 2 — patient-level identifiers carrying Part 2 flags are scope-limited or stripped at minimum-necessary boundaries. Retention for Part 2 records follows the rule's specific requirements plus state overlay. The Syntra ETL platform reviews Part 2 scope with your privacy officer before any feed activates, and the WORM archive carries Part 2-flag metadata for compliant retrieval. Joint Commission surveyors and HHS OCR auditors both expect Part 2 compliance documentation.