For most U.S. human-subjects research, an investigator is required to keep consent documents, IRB correspondence, and research records for at least 3 years after completion/closure of the study with the IRB , but in many cases you must keep them longer (sometimes 6–10 years or more) depending on the type of data and the sponsor’s or regulator’s rules.

Core federal baseline

Under the Common Rule (OHRP, 45 CFR 46.115), records related to IRB‑regulated human research must be retained for a minimum of 3 years after completion of the research.

This “research records” umbrella typically includes:

  • Signed informed consent forms
  • IRB approval letters and correspondence
  • Protocols, amendments, and reports submitted to the IRB
  • Study‑specific source documents and data that support the research findings

So if your study ends and is closed with the IRB in 2026, the bare minimum federal retention period under the Common Rule would usually run until at least 2029.

When longer retention is required

Many studies are subject to additional rules that extend the retention period beyond 3 years, and investigators must follow the longest applicable requirement.

Common scenarios:

  • HIPAA-covered research (identifiable health information):
    Records must usually be kept at least 6 years after each subject signed the HIPAA authorization , or after the authorization/waiver was last in effect.

  • FDA‑regulated studies (drugs, devices, biologics):
    Investigators generally must keep records 2 years after either:

    • The marketing application is approved for the indication studied, or
    • The investigation is discontinued and FDA is notified that no application will be filed or that it will not be approved.
  • VA, DoD, or other federal sponsors:
    Certain VA research records (including signed consent forms) must be kept 6 years or more as federal records.

DoD‑related research often has at least 3‑year minimums and may impose longer periods depending on the specific directive.

  • Institutional policies:
    Some institutions or IRBs require investigators to store signed consent forms and research data for 5–10 years (or longer) after study completion, regardless of federal minimums.
  • Sponsor or contract requirements:
    Industry sponsors, data use agreements, and funding agencies may specify longer retention (for example, 7 or 15 years) in the clinical trial agreement or grant conditions.

In practice, you are expected to follow whichever requirement produces the longest retention period for your particular study.

Practical rule of thumb for investigators

If you’re an investigator trying to decide “how long” to retain:

  1. Start with 3 years after IRB‑designated study completion/closure as the absolute floor for consent forms, IRB correspondence, and research records.
  1. Check for add‑ons :
    • HIPAA (identifiable PHI) → at least 6 years.
    • FDA‑regulated drug/device/biologic → 2 years after the regulatory milestones described above.
    • VA/DoD or other agencies → follow their specific record‑control schedule.
    • Institutional policy or state law → may require 5–10+ years.
    • Sponsor contract → whichever is longest.
  1. If there are questions or disputes about data validity or research conduct , records should be kept until all questions, allegations, or litigation are fully resolved , even if this exceeds the nominal retention period.

Example scenario

Imagine a university‑based clinical trial of a new drug that:

  • Uses identifiable medical records (HIPAA applies).
  • Is FDA‑regulated.
  • Is funded by a sponsor that requires data to be kept 10 years after study completion.

In that case:

  • Common Rule → 3 years after completion.
  • HIPAA → 6 years after each subject’s authorization.
  • FDA → 2 years after marketing application approval (or discontinuation/no‑application).
  • Sponsor → 10 years after completion.

You would keep consent documents, IRB correspondence, and research records for at least 10 years , because that is the longest applicable requirement.

Bottom line:
The “3‑year rule” is only the minimum. Investigators must check all applicable regulations, institutional policies, state laws, and sponsor requirements and then retain consent documents, IRB correspondence, and research records for the longest required period , commonly ranging from 3 to 10+ years after the study’s completion and sometimes until any related questions, audits, or litigation are fully resolved.

Information gathered from public forums or data available on the internet and portrayed here.