Last updated: September 12, 2026
This page summarizes recordkeeping rules and is not legal advice. Confirm every period against the current text and your own counsel.
How long you have to keep call recordings
Retention is set by whichever rule on your list runs longest. CMS holds marketing and sales calls for six years. The six year clock people quote from HIPAA covers documentation rather than call audio. Client contracts routinely demand more than any regulator, and a policy written to an internal default is the one that falls apart under an audit.
Most of these conversations start with a bill, so start there. Say a floor runs 25 agents, each taking 60 calls a day, averaging three minutes. That is 4,500 minutes of audio a day and roughly 95,000 minutes a month across 21 business days.
Stored the way a lot of telephony platforms store it, 8 kHz mono and uncompressed, one minute weighs about a megabyte. The month comes to about 95 GB. A year is 1.1 TB. Hold six years and the archive settles near 6.8 TB before the oldest month starts aging out. Encode the same calls at 16 kbps and six years lands closer to 800 GB, which is identical audio at an eighth of the footprint.
At the two cents per gigabyte per month that commodity object storage runs, a round figure rather than a quote from anybody, that is roughly $140 a month against roughly $20. Neither one sinks a company. The line that actually shows up on an operator's invoice is the telephony vendor's per seat recording charge, which is not priced like object storage, and that is where the argument about three years versus six years gets real.
Which means the number worth knowing is the shortest period you are allowed to keep, and that comes out of a rule rather than a storage tier.
The retention drivers, side by side
Eight things can set the clock on a recorded call. The period in each row is a floor unless the row says otherwise, and the confidence column says how far we got with each one.
| Rule or driver | Who it binds | Period | Format | Citation | Confidence |
|---|---|---|---|---|---|
| CMS marketing and sales calls | TPMOs in Medicare Advantage and Part D | 6 years minimum | Audio for years 1 to 3, audio or complete and accurate transcript for years 4 to 6 | 42 CFR 422.2274(g)(2)(ii) | Read from a primary text mirror |
| Medicare enrollment records | Plans and the chain of enrollment | 10 years | Not addressed in the marketing and sales paragraph | Enrollment record rules | Secondary, unverified |
| FTC telemarketing records | Sellers and telemarketers covered by the rule | 5 years from the date the record is produced | Call detail records, audio not specified | 16 CFR 310.5(a) | Read from a primary text mirror |
| HIPAA documentation | Covered entities and business associates | 6 years from creation or from when it last was in effect | Written or electronic documentation | 45 CFR 164.316(b)(2)(i) | Read from a primary text mirror |
| Broker dealer communications | Members, brokers, and dealers under SEC recordkeeping | 3 years, the first two in an easily accessible place | Originals received and copies sent, including sales scripts | 17 CFR 240.17a-4(b) and (b)(4) | Read from a primary text mirror |
| PCI DSS card data | Anyone storing cardholder data, recordings included | Sensitive authentication data not retained after authorization | Card validation codes must not sit in a stored recording | PCI DSS v4.0 Requirement 3.3.1, PCI SSC FAQ 1210 | Read from the standards body FAQ |
| State recording law | Any operator dialing into that state | Usually silent on duration | Consent and notice rather than storage | Varies by state | Unverified, check per state |
| The client contract | You, one account at a time | Whatever the agreement says | Usually audio | Your own master services agreement | Verified where the contract exists |
Statute of limitations exposure belongs on the same list and has no citation to give you, because it depends on the claim and the state. Counsel usually sets that number, and it usually sits above the regulatory floor rather than below it.
The HIPAA row is the one people get wrong
45 CFR 164.316(b)(2)(i) says to "Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later." Paragraph (b)(1) is about keeping your policies and procedures in written form, and keeping a written record of any action, activity, or assessment the subpart requires you to document.
Documentation means the risk analysis, the business associate agreements, the policies themselves, and a written record of every assessment the subpart tells you to document. A recording of a patient calling about a prescription is protected health information with real obligations attached, and none of those obligations are the six year clock at 164.316.
A medical answering service that set audio retention to six years because HIPAA says six years picked the right number off the wrong rule. Six might still be correct for them. It would get there through the client contract, or through state medical record law, or through a claims exposure their counsel named. More on that at HIPAA and recorded calls.
The telemarketing rule most floors have never read
16 CFR 310.5(a) requires a seller or telemarketer to keep records "for a period of 5 years from the date the record is produced unless specified otherwise." That covers a record of each telemarketing call: the numbers on both ends, the date and time, the duration, the script used, the caller ID information transmitted, and how the call ended.
Notice what the rule asks for. Call records rather than call audio, five years of them, and a lot of outbound shops satisfy it by keeping the recordings because the recording is the easiest place to find all of it. That works, and it costs more than the rule asks for, which is fine as long as somebody picked it on purpose.
Why the client contract usually wins
A telephone answering service or a BPO signs a master services agreement with a hospital system or a law firm, and somewhere in that agreement is a retention clause somebody negotiated years ago. Seven years shows up constantly. So does "for the term and three years thereafter," which is a different shape of obligation entirely, because it floats.
The auditor who shows up is usually your client's auditor, holding your client's contract. No regulator on this page is going to read that document to you.
Format: audio, transcript, or both
Duration and format are separate questions and a policy has to answer both. CMS is explicit about it, requiring audio for the first three years and allowing audio or a complete and accurate transcript for years four through six, which we cover in CMS call recording requirements.
Generalize that and you have the cheap option for the back half of any retention window. A transcript is a fraction of the storage and it holds the words. What it drops is everything that is not words: the pause before the answer, the hold music running four minutes, two people talking over each other, the caller who clearly did not understand what they just agreed to. "Complete and accurate" is doing a lot of work in the CMS phrasing, and a transcript produced by a system nobody has calibrated is not obviously either.
Holding recordings longer than you have to
Audio you kept past its policy is still discoverable, and it still contains whatever your agent said on it. Keeping too much has no upside, and it is easy to drift into, because deleting things requires somebody to build a schedule and nobody gets promoted for that.
One rule runs the other direction outright. PCI DSS Requirement 3.3.1 prohibits storing sensitive authentication data after authorization, encrypted or not, and the PCI Security Standards Council addressed recordings directly in FAQ 1210. If an agent reads a card verification code back and the line is recording, that recording now holds sensitive authentication data. Council guidance is to prevent it from being recorded at all, and to delete it securely on authorization where prevention is not possible.
The same FAQ notes that PCI DSS does not override local audio retention law, which is one of the few places on this page where two rules genuinely pull against each other. Pause and redact tooling on the payment step exists for exactly that reason, and the card data rule and recorded calls works through where each approach breaks.
What retention does not tell you
A six year archive proves what was said and says nothing about whether anyone listened. Most operators we talk to are already recording everything and reviewing one or two calls per agent per week, so the archive grows and the knowledge does not.
That gap is what CallSniper works on. Calls are ingested after they end, transcribed with speaker separation, then scored against a scorecard you define, with searchable transcripts with timestamps standing behind each score. An answering service scoring per client account runs an answering service scorecard against the calls it took in that client's name. Machine scoring is dependable on rule based criteria like whether a required phrase was said and when, and shakier on whether somebody sounded rushed, which Aircall and StackAI both note about automated QA generally. Scoring does nothing about retention itself either, which stays a storage and policy problem you own.
Frequently asked questions
How long do you have to keep call recordings?
The longest period that any applicable rule sets, per record type. A Medicare TPMO holds marketing and sales calls six years under 42 CFR 422.2274(g)(2)(ii), while a covered telemarketer keeps five years of call records under 16 CFR 310.5(a). Client contracts frequently run longer than both.
Does HIPAA require you to keep call recordings for 6 years?
No. The six year period at 45 CFR 164.316(b)(2)(i) applies to documentation of your policies, procedures, and required actions or assessments. A recorded call containing patient information carries other obligations, and the six year figure is not one of them. Confirm your own retention with counsel.
Can you keep a transcript instead of the audio?
Under the CMS rule, audio is required for years one through three and a complete and accurate transcript is allowed for years four through six. Other rules answer this differently or say nothing, so check the format language in each rule that binds you before you delete any audio.
How long should a call center keep recordings?
Start with the client contract, since it is usually the longest number on the list and the one an auditor will actually read. Then check call recording laws by state for every state you dial into, plus the sector rules that touch your call types. Set the policy to the longest of those, per record type.
Write the policy against the longest rule on your list
Four steps produce a policy you can defend. List every phone path that records, including agent mobiles and the web meeting platform. Write down every rule that touches a call on those paths, with its citation and its period beside it. Pick the longest period per record type rather than per storage bucket. Read the client contracts last, because that is where the number usually moves.
The third step is where this goes wrong, and it goes wrong in the direction nobody writes about. An agency reads the CMS rule correctly, sets six years for marketing and sales calls, and applies six years to the bucket. Enrollment records sitting in the same bucket on their own ten year path get deleted in year seven, by a scheduled job, in exact compliance with a policy the agency wrote itself.
What prevents that is classification at ingest. A deletion rule has to key off what the record is, which means the record type gets attached when the call lands rather than reconstructed by whoever is holding the delete button six years later. A folder tree organized by month cannot carry that, and one organized by record type can.
Once the schedule is right, a call review on a sample of the archive tells you what those years of audio actually contain, which a paid pilot produces from six months of your own recordings at a fixed pilot price.
Sources
- Marketing and sales call retention and the audio and transcript format split, 42 CFR 422.2274(g)(2)(ii). Read via Cornell LII on 2026-09-09 for article 04. Verified against a primary text mirror. Not read again for this page.
- HIPAA documentation retention, 45 CFR 164.316(b)(1) and (b)(2)(i). Read via Cornell LII on 2026-09-12. Page shows most recent amendment 78 FR 5695, January 25, 2013. Verified against a primary text mirror.
- Telemarketing recordkeeping, 16 CFR 310.5(a). Read via Cornell LII on 2026-09-12. Source note 89 FR 26784, April 16, 2024. Verified against a primary text mirror.
- Broker dealer record preservation, 17 CFR 240.17a-4(b) and (b)(4). Read via Cornell LII on 2026-09-12. Verified against a primary text mirror. The paragraph's reference to recordings of telephone calls is tied to section 15F(g)(1) of the Act, so confirm scope with counsel before applying the three year period to ordinary sales calls.
- PCI DSS v4.0 Requirement 3.3.1 and PCI Security Standards Council FAQ 1210, dated June 2025, retrieved 2026-09-12. Verified from the standards body.
- Medicare enrollment record retention of 10 years. Secondary, from agent facing summaries gathered 2026-09-08. Not confirmed against primary text.
- State recording law and state medical record retention. Not read for this page. Unverified.
- Storage arithmetic in the opening section. Hypothetical volumes and round public cloud object storage rates, not a customer figure and not a price quote.
- Aircall and StackAI, on AI call scoring being more reliable on rule based criteria than on subjective tone. Third party, gathered 2026-09-08. Unverified.