Tax & Compliance

What records do I need to keep for an IRS audit?

IRS audit records are the books, receipts, invoices, contracts, and supporting documentation a business is required to maintain to substantiate items on filed tax returns.

Reviewed by Stanislav Sukhinin, CFALast reviewed April 15, 2026

Quick answer

Medical practices should keep complete tax records for at least 3 years (general statute of limitations), 6 years for substantial understatements, and indefinitely for assets, retirement plans, and HIPAA-related documentation.

The detail

IRS Publication 583 sets recordkeeping baseline. The general statute of limitations is 3 years from the return filing date; this is the minimum retention period for most records. The statute extends to 6 years if the taxpayer omits more than 25 percent of gross income. There is no statute of limitations for fraudulent returns or unfiled returns. Assets (equipment, real estate, leasehold improvements) require records as long as you own the asset plus 3 years after disposition, because basis affects gain or loss. Retirement plan records typically require permanent retention for plan documents and 6 years for participant data under ERISA. HIPAA requires medical record retention for at least 6 years after creation or last use, though state requirements often extend this (commonly 7 to 10 years). Practical recommendation for medical practices: keep all bank statements, deposit records, payroll registers, AP invoices, fixed asset detail, and tax returns indefinitely in digital form. Storage cost is negligible; reconstructing destroyed records under audit is almost impossible.

  • General IRS statute of limitations is 3 years from return filing date; extends to 6 years for substantial understatements.

    Source: IRS Publication 583

  • HIPAA requires medical record retention for at least 6 years after creation or last use.

    Source: HHS HIPAA Rules

  • Asset records must be retained as long as the asset is owned plus 3 years after disposition.

    Source: IRS Publication 583

What this means for clinic owners

From Sorso

Digital storage is cheap. Retain all financial records indefinitely. The only audit defense that works is producing original documents on demand. Reconstructing them after the fact almost never satisfies an examiner.

SS
Stanislav Sukhinin, CFA

Founder of Sorso. 19 years in corporate finance. Managed a $450M loan portfolio before building a fractional CFO firm exclusively for healthcare clinics.

Want to see how your practice measures up?

Take the 4-minute financial assessment. It is free, and it will show you where your practice is leaking money.