What records do I need to keep for an IRS audit?

IRS Publication 583 sets the recordkeeping baseline. The general period of limitations is 3 years from the return filing date (a return filed early counts as filed on the due date); this is the minimum retention period for most records. It extends to 6 years if you did not report income that is more than 25 percent of the gross income shown on the return, and to 7 years for a claim for a loss from worthless securities or a bad debt deduction. There is no limit for fraudulent returns or unfiled returns. Employment tax records must be kept for at least 4 years after the tax becomes due or is paid, whichever is later. Keep asset records (equipment, real estate, leasehold improvements) until the period of limitations expires for the year you dispose of the asset, because basis drives depreciation and the gain or loss on sale. For retirement plans, ERISA requires the records behind plan filings to be kept for at least six years after the filing date; keep the plan documents themselves for as long as the plan exists. HIPAA does not set a retention period for medical records; state law does. HIPAA's six-year rule covers the documentation HIPAA itself requires, such as policies and procedures, counted from creation or the date last in effect. Medicare adds its own requirement: a CMS fact sheet tells providers and suppliers that furnish or order Medicare services to keep medical records for 7 years from the date of service. Practical recommendation for medical practices: keep all bank statements, deposit records, payroll registers, AP invoices, fixed asset detail, and tax returns indefinitely in digital form. Storage cost is negligible; reconstructing destroyed records under audit is slow and rarely convincing.