Firms in the healthcare industry must follow data retention requirements specified by a variety of statutes and regulatory bodies, including the Health Insurance Portability and Accountability Act (HIPAA), Medicare Conditions of Participation, and the Food and Drug Administration (FDA).