Data that is no longer needed is removed. HIPAA requires Protected Health Information (PHI) to be retained for six years plus 180 days after the creation or last effective date, whichever is later.