How long must ERISA health plan records be retained?

Two ERISA provisions set the floor:

• Section 107: anyone who files or certifies plan reports must preserve the backup — worksheets, receipts, resolutions, and records that support Form 5500 and required disclosures — for at least six years after the filing date.
• Section 209: employers must keep records sufficient to determine benefits due to each employee. There is no six-year cutoff; the duty runs as long as the records could matter to someone's benefits.

In practice, prudent health plan retention goes beyond the floor: plan documents, amendments, charters, and committee minutes are kept for the life of the plan and after, because they prove what the plan said and how decisions were made. HIPAA separately requires six years for privacy and security documentation.

A written retention schedule — what is kept, where, and for how long — is itself a governance document auditors respect.