Checklist · Data Privacy · Retention and Disposal

Checklist: Records Retention and Secure Disposal for Illinois Businesses and Healthcare Practices

How to build a retention schedule from the periods federal and Illinois law actually set, suspend destruction when a dispute is coming, dispose of paper and devices so the data cannot be read, and keep the proof that you did.

By Lincoln Square Law · 12-minute read

🖨 Print this checklist

Most businesses keep records for one of two reasons: a law requires it, or no one decided otherwise. The second reason is the expensive one. Every file kept past its purpose must be protected with reasonable security under Illinois law (815 ILCS 530/45(a)), may have to be produced in litigation, and must be disposed of properly when the day finally comes (815 ILCS 530/40(b)). For biometric data, Illinois also sets an outer limit on how long a business may keep it (740 ILCS 14/15(a)).

This checklist follows the order in which a compliance lead builds the program: inventory the record series, attach the period the law sets to each one, suspend destruction when a legal hold applies, destroy by a method that defeats reconstruction, and keep the evidence. Breach notice under the Personal Information Protection Act is covered in our PIPA white paper, and data vendor contract terms in our privacy vendor contract review checklist.

1. Inventory the record series before assigning periods

• Ask each department to list the record series it creates or receives (payroll, personnel files, Forms I-9, patient charts, billing, background check reports, timeclock data, vendor contracts) and the system or location where each one is kept.
• Include the copies that live outside the system of record: email attachments, shared drives, laptops, backup media, scanned paper, and files held by vendors.
• Assign each series one owner who approves its retention period and authorizes its destruction.
• Flag each series that contains Illinois residents’ personal information, protected health information, biometric identifiers, or information derived from a consumer report, because each category carries its own disposal rule.
• Write down the event that starts the clock for each series (creation, payment, last entry, end of employment, last interaction, end of contract), since most retention periods run from an event rather than a fixed date.

2. Attach the federal and Illinois employment periods

• Keep payroll records for at least three years from the last date of entry (29 C.F.R. 516.5(a)).
• Keep collective bargaining agreements, individual employment contracts, and the other written plans and agreements the rule lists for at least three years from their last effective date (29 C.F.R. 516.5(b)).
• Keep time cards, wage rate tables, and records of additions to or deductions from wages for at least two years (29 C.F.R. 516.6(a), 516.6(c)).
• Keep employment tax records for at least four years after the due date of the tax for the return period they relate to, or the date the tax is paid, whichever is later (26 C.F.R. 31.6001-1(e)(2)).
• Keep records of each employee’s name, address, and wages paid each payday, and keep a copy of each pay stub for not less than three years after the date of payment (820 ILCS 115/10).
• Retain each Form I-9 for three years after the date of hire or one year after employment ends, whichever is later, and keep any document copies you chose to make with the form (8 C.F.R. 274a.2(b)(2)(i), 274a.2(b)(3)).
• Keep personnel files available for people who left within the preceding year, because the Personnel Record Review Act gives them the same written-request inspection right as current employees (820 ILCS 40/1, 40/2).

The onboarding steps that create these records are covered in our Illinois new-hire compliance checklist.

3. Set the healthcare periods HIPAA fixes and the one it does not

• Retain the policies, procedures, and other documentation the Privacy Rule requires for six years from the date of creation or the date last in effect, whichever is later (45 C.F.R. 164.530(j)(2)).
• Apply the same six-year rule to Security Rule policies, risk analyses, and every security action or assessment that must be documented (45 C.F.R. 164.316(b)(2)(i)).
• Do not use the six-year HIPAA period as the patient-chart period. HHS states that the Privacy Rule does not include medical record retention requirements and that state laws generally govern them (HHS FAQ 580).
• Before setting the chart period, confirm the Illinois rule that applies to your practice type and the terms of your payer contracts, and record on the schedule the source you relied on.
• Adopt written policies for the final disposition of electronic protected health information and the hardware or media that hold it, and for removing it before media are reused (45 C.F.R. 164.310(d)(2)(i), (ii)).
• Keep a record of hardware and media movements and the person responsible for each, a specification the rule classifies as addressable (45 C.F.R. 164.310(d)(2)(iii)).
• Protect records awaiting destruction, including bins and storage rooms, with administrative, technical, and physical safeguards (45 C.F.R. 164.530(c)).

4. Apply the biometric and consumer report rules

• Publish a written policy with a retention schedule and guidelines for permanently destroying biometric data, keyed to whichever comes first: the initial purpose is satisfied, or three years pass after the individual’s last interaction with the business (740 ILCS 14/15(a)).
• Calculate each person’s destruction date from the earlier of those two events, and record which event you used.
• Follow the published schedule unless a valid warrant or subpoena issued by a court of competent jurisdiction applies (740 ILCS 14/15(a)).
• Identify background check reports and every record derived from them, and dispose of them with reasonable measures that protect against unauthorized access (16 C.F.R. 682.3(a)).

5. Suspend destruction under a legal hold

• We recommend issuing a written legal hold when litigation, a government investigation, an audit, or a demand letter is reasonably anticipated, rather than waiting for a lawsuit to be filed.
• Name the custodians, record series, systems, and date range in the notice, and send it to IT and to every vendor that stores or destroys the covered records.
• Suspend automatic deletion, email purges, backup rotation, and scheduled shredding for the covered material until counsel releases the hold.
• Collect written acknowledgments from custodians and reissue the notice at set intervals while the matter remains open.
• If a hold would keep biometric data past its destruction date, decide with counsel how to proceed, because section 15(a) names only a valid court-issued warrant or subpoena as the exception.
• Record the date the hold is released, and resume the schedule only for material that no other hold covers.

6. Dispose of paper and electronic media so they cannot be read

• Shred, burn, pulverize, or redact paper containing personal information so that it is unreadable, unusable, and undecipherable (815 ILCS 530/40(b)(1)).
• Destroy or erase electronic and other non-paper media to the same standard (815 ILCS 530/40(b)(2)).
• Sanitize copiers, printers, phones, laptops, and drives before they are sold, donated, returned to a lessor, or transferred, since the FTC Disposal Rule treats those transfers as disposal (16 C.F.R. 682.1).
• We recommend using NIST SP 800-88 Rev. 2 as the reference for choosing a sanitization method by media type and data sensitivity.
• Apply the schedule to backups and vendor-hosted systems as well, or document why a backup copy persists and how it is protected.

7. Hold disposal vendors to written terms and certificates

• Require in the contract that the vendor implement and monitor policies prohibiting unauthorized access to, acquisition of, or use of personal information during collection, transportation, and disposal (815 ILCS 530/40(c)).
• Include the reasonable-security provision the statute requires in any contract that discloses Illinois residents’ personal information (815 ILCS 530/45(b)).
• Document due diligence on the destruction company before hiring it to handle consumer report information (16 C.F.R. 682.3(b)(3)).
• If the vendor will handle protected health information, review the business associate terms before the first pickup using our vendor contract checklist.
• We recommend requiring a certificate of destruction for each pickup or job that states the date, method, location, quantity or serial numbers, and the person who performed the work.
• Reconcile each certificate against your pickup log or asset inventory and follow up on any gap.

8. Keep the evidence that the program ran

• Keep the approved version of the schedule in force on the date of each destruction, with its approvals.
• Keep a destruction log showing the record series, date range, method, approver, and legal hold check.
• File hold notices, acknowledgments, and releases with the matter file.
• Retain HIPAA disposal policies and the documentation of each disposal action that must be recorded for six years (45 C.F.R. 164.316(b)(2)(i)).
• Review the schedule every year and whenever the law, a system, or a service changes, and record what changed and why.

Why keeping everything is not the cautious choice

Indefinite retention looks safe until the costs are added up. The Illinois security duty reaches every record containing personal information that a business owns, licenses, maintains, or stores, whether or not it still needs the record (815 ILCS 530/45(a)). When the record is finally discarded, improper disposal carries a civil penalty of up to $100 for each individual affected, capped at $50,000 for each instance of improper disposal (815 ILCS 530/40(d)). Financial institutions subject to the Gramm-Leach-Bliley Act and persons subject to the federal consumer report disposal provision are outside section 40 (815 ILCS 530/40(f), 15 U.S.C. 1681w), which leaves those businesses to their own federal disposal obligations.

Biometric data is the clearest case. Section 15(a) of the Biometric Information Privacy Act does more than permit destruction. It requires compliance with the published schedule. A timeclock system that keeps former employees’ fingerprint templates for years keeps running without any visible error while it falls out of compliance. Our guide to BIPA in 2026 covers consent and collection, and this checklist covers the end of the cycle.

The federal consumer report disposal provision works differently. It does not require any record to be kept or destroyed beyond what other law requires (15 U.S.C. 1681w). It governs only how disposal is done once the business decides to dispose. The period for a background check report therefore comes from the business’s own schedule and whatever other rules reach that file.

Periods that run from different events

Calculation errors come from mixing rules that use opposite logic. The Form I-9 and employment tax records take the later of two dates. BIPA section 15(a) takes whichever comes first. An I-9 example: a person hired on March 1, 2022 who leaves on June 30, 2026 reaches three years from hire on March 1, 2025, but one year from separation on June 30, 2027. The later date controls, so the form stays until June 30, 2027.

That is why the schedule needs, for each series, the trigger event, the period, the comparison rule (later or first), and the legal source. A schedule that says seven years for everything cannot show that a particular destruction was timely. We recommend having the system compute the destruction date from those fields and having the series owner confirm it before it is carried out.

Patient charts and the Illinois question

Practices often assume HIPAA sets the patient-chart period. It does not. The six years in sections 164.316 and 164.530 apply to compliance documentation such as policies, risk analyses, and recorded actions, and HHS confirms that the Privacy Rule sets no period for medical records. The chart period depends on state law and may vary by license type, patient population, and payer contracts. For that reason this checklist does not state a number. Confirm the rule that applies to your practice before any chart is destroyed.