HIPAA requires that written responses to complaints or breaches must be maintained for years from date of creation or date when last in effect.

6 years

Explanation: HIPAA, the Health Insurance Portability and Accountability Act was passed into law by Congress in 1996. It protects personal information used in the healthcare and related industries such as health insurance companies. Under HIPAA, documents such as complaints and responses must be kept six years after they were filed or when last time in effect  by any covered entity. Covered Entities are organisations covered by the act.