Training Record Retention: Federal and State Requirements Guide

The length of time you must retain employee training records depends on which federal and state regulations apply to your workforce, and getting it wrong in either direction creates risk. Destroying records too early leaves you unable to prove compliance during inspections, audits, or litigation. Retaining records without a systematic policy creates data management problems and may expose you to discovery obligations you could have avoided. This guide maps the major retention requirements by regulation, provides a practical framework for building a retention schedule, and covers the destruction procedures that close the loop.

Why Retention Periods Matter

Training records serve three distinct purposes, each with its own time horizon:

1. Regulatory compliance: Proving to inspectors and auditors that training was delivered as required. The relevant retention period is set by the regulation that mandates the training.

2. Litigation defense: Demonstrating that the employer took reasonable steps to train employees on hazards, policies, or procedures relevant to a legal claim. The relevant period is the statute of limitations plus any pre-litigation preservation obligations.

3. Operational continuity: Maintaining institutional knowledge of who was trained on what, especially when employees transfer between roles, return from leave, or when training requirements change. There is no regulatory period for this purpose; it is a business decision.

The practical challenge is that these three purposes often require different retention durations, and the employer must satisfy all of them simultaneously.

The cost of retaining a training record for five extra years is measured in storage costs. The cost of not having a training record when you need it is measured in fines, legal fees, and adverse outcomes. The math is simple.

Federal Training Record Retention Requirements

OSHA Standards

OSHA 300 Logs and 300A Summaries: 29 CFR 1904.33 requires employers to retain OSHA 300 logs and the annual 300A summary for five years following the end of the calendar year they cover. During this period, logs must be updated to reflect reclassified cases and must be available for inspection.

Bloodborne Pathogens (29 CFR 1910.1030): Section 1910.1030(h)(2) requires training records to be maintained for three years from the date of training. Records must include dates, content or summary, trainer qualifications, and names and job titles of all attendees.

Process Safety Management (29 CFR 1910.119): Training records must demonstrate that each employee currently involved in operating a process has received and understood the required training. This effectively means retaining records for the duration of the employee’s assignment to the process. Records of initial training and refresher completions must be maintained.

Hazardous Waste Operations (29 CFR 1910.120): Section 1910.120(e)(6) requires certification records showing training completion. These should be retained for the duration of the employee’s employment in HAZWOPER-covered activities plus any applicable state extension.

Respiratory Protection (29 CFR 1910.134): Fit test records must be retained until the next fit test is administered. Medical evaluation records fall under the medical record retention requirements of 29 CFR 1910.1020, which requires 30 years beyond the duration of employment.

Occupational Exposure to Noise (29 CFR 1910.95): Audiometric test records must be retained for the duration of employment per 1910.95(m)(3)(i). Training is a component of the hearing conservation program, and training records should be retained for the same duration.

Employee Medical and Exposure Records (29 CFR 1910.1020): This is the longest retention standard in OSHA regulations. Employee medical records must be retained for the duration of employment plus 30 years. Exposure records must be retained for 30 years. Training records that are part of a medical surveillance program fall under this standard.

DOT / FTA Requirements

Drug and Alcohol Testing Records (49 CFR Part 40 and Part 655): Retention periods vary by document type:

Record Type	Retention Period
Positive drug test results	5 years
Records of supervisor reasonable suspicion determinations	5 years
Negative and cancelled drug test results	1 year
Alcohol test results 0.02 or greater	5 years
Alcohol test results below 0.02	1 year
Education and training records (supervisor training, employee awareness)	2 years
Random testing process records	2 years

Note that supervisor reasonable suspicion training records specifically should be retained for at least the duration of the supervisor’s designation plus the regulatory minimum, since the training must predate any determination the supervisor makes.

FTA PTASP Records: 49 CFR Part 673 does not specify a standalone training record retention period, but PTASP records, including training documentation, must be maintained for the duration of the current plan and should be retained through at least one triennial review cycle. Best practice for transit agencies is to retain PTASP training records for at least five years beyond the employee’s separation. See our PTASP training guide for more detail.

National Transit Database: NTD data and supporting documentation should be retained for at least three years per FTA grant record retention requirements. Training records that support NTD submissions should be retained for at least three years beyond the reporting year.

HIPAA

HIPAA Training Records: The HIPAA Privacy Rule (45 CFR 164.530(j)) requires covered entities and business associates to retain documentation of training policies and training completion for six years from the date of creation or the date when it was last in effect, whichever is later. This includes records showing that workforce members received training on the entity’s privacy policies and procedures.

EPA Requirements

RCRA Hazardous Waste Training (40 CFR 265.16): Training records for personnel at hazardous waste treatment, storage, and disposal facilities must be maintained until closure of the facility. Records for former employees must be retained for three years after the employee’s departure.

State-Specific Requirements

State requirements frequently exceed federal minimums. Key examples:

California

• Personnel records (including training records): Retain for at least three years after separation under California Labor Code Section 1198.5 and related regulations
• Cal/OSHA injury records: Five years per Cal/OSHA requirements (aligns with federal OSHA)
• Sexual harassment training: Two years under Government Code Section 12950.1

New York

• New York State harassment training records: Retain for the applicable statute of limitations period (three years under NYSHRL as amended)
• New York City harassment training records: Three years per NYC Admin. Code Section 8-107

Illinois

• Workplace harassment training: Retain through the annual training cycle and recommended through the applicable limitations period

Texas

• State workers’ compensation requires employers to maintain training records related to workplace safety for the duration of the employee’s employment plus the applicable limitations period

Federal Contractors

Employers subject to OFCCP requirements under Executive Order 11246 and related regulations must retain personnel records, including training records, for a minimum of two years (one year for employers with fewer than 150 employees or contracts below $150,000).

Building a Practical Retention Schedule

Step 1: Inventory Your Training Categories

List every type of training your organization delivers and the regulation(s) that mandate or relate to each. For each category, identify:

• The applicable federal retention requirement
• The applicable state retention requirement(s) for each state where you have employees
• Whether the training relates to a category with litigation risk (safety, harassment, discrimination, environmental)
• The longest of all applicable periods

Step 2: Set Category Retention Periods

For each training category, set the retention period to the longest applicable requirement plus a buffer. A common approach:

Training Category	Recommended Retention
Safety and hazard-specific (OSHA)	Duration of employment + 5 years
Medical/exposure-related	Duration of employment + 30 years (per 1910.1020)
Drug and alcohol program	Per Part 40 schedule (1-5 years by record type)
PTASP/transit safety	Duration of employment + 5 years
Harassment prevention	Duration of employment + applicable statute of limitations + 1 year
HIPAA/privacy	6 years from creation or last effective date
General compliance	Duration of employment + 5 years
Professional development (non-regulated)	Duration of employment + 3 years

Step 3: Implement in Your Training System

Your training records management system should support:

• Retention classification: Tag each training record with its retention category
• Automated retention calculation: Based on the employee’s separation date and the retention period, calculate the eligible destruction date
• Legal hold override: When litigation, an investigation, or an audit is pending, suspend destruction for affected records regardless of the calculated date
• Destruction queue: Surface records that have reached their eligible destruction date for review and approval

For a learning management system evaluation focused on compliance, see our compliance training software guide.

Organizations that implement automated retention schedules with legal hold capabilities reduce their risk of both premature destruction and over-retention. The system manages the timeline; humans manage the exceptions.

Record Destruction Procedures

When records reach the end of their retention period and no legal hold applies, destroy them systematically:

Pre-Destruction Checklist

1. Verify no pending litigation, audit, or investigation requires preservation of the records
2. Confirm the retention period has fully expired for every record in the destruction batch
3. Obtain authorization from the records manager or legal department
4. Document the destruction: Record what was destroyed, the date, the method, and who authorized it

Destruction Methods

• Paper records: Cross-cut shredding or incineration. Simple recycling is not sufficient for records containing personal information.
• Digital records: Secure deletion that overwrites data. Simply deleting a file does not destroy the data. Use a certified data destruction process for hard drives or storage media being decommissioned.
• Cloud-hosted records: Verify with your vendor that deletion is permanent and that backup copies are also purged within a defined timeframe.

Consistency Is Critical

Apply your destruction policy uniformly. Destroying records from 2019 while retaining records from 2018 and 2020 for the same training category creates an inference that the 2019 records were selectively destroyed. Courts and regulators interpret selective destruction unfavorably. Either retain everything in a category or destroy everything that has reached its eligible date.

Litigation Holds and Preservation Obligations

When litigation is reasonably anticipated or has been filed, you have an obligation to preserve all potentially relevant records, regardless of whether their retention period has expired. This is called a litigation hold.

Training records are frequently relevant in:

• Workplace injury lawsuits: Was the injured employee trained on the relevant hazard?
• Harassment and discrimination claims: Was the accused trained on anti-harassment policies? Was the complainant trained on reporting procedures?
• OSHA citations: Can you produce training records for the relevant standard?
• Wrongful termination claims: Was the terminated employee trained on the policy they allegedly violated?

When a litigation hold is issued, immediately flag all affected training records in your system as preserved. Remove them from any automated destruction queue. The hold should specify the scope (which employees, which training topics, which time periods) and should remain in effect until legal counsel releases it.

Technology Considerations

Cloud vs. On-Premise Storage

Cloud-based training management systems offer advantages for record retention:

• Scalable storage that accommodates long retention periods without physical space constraints
• Automated backup and disaster recovery
• Access controls that prevent unauthorized modification or deletion
• Audit trail logging showing who accessed or modified records

On-premise systems can meet the same requirements but place the infrastructure burden on the employer. Evaluate your total cost of ownership including backup, disaster recovery, and the cost of a retention failure.

Data Integrity

Training records must be tamper-evident for the entire retention period. This means:

• Records cannot be modified after creation without a logged audit trail
• Timestamps are system-generated, not user-entered
• Completion records are linked to specific content versions
• The system maintains immutable records that can be verified as authentic during audits or legal proceedings

Use our Audit Readiness Score tool to evaluate whether your current system provides adequate data integrity for audit and legal defense purposes.

The Bottom Line

Training record retention is not a glamorous compliance topic, but it is a foundational one. Every other compliance effort you make, from delivering training to documenting competency to preparing for audits, depends on the records being available when you need them. Build a retention schedule based on your regulatory obligations, implement it in a system that automates the timeline, protect records from premature destruction, and destroy them systematically when the time comes. The organizations that do this well spend minutes producing records during inspections. The organizations that do not spend weeks reconstructing what they can and explaining what they lost. For guidance on building the records themselves, see our guide to building audit-ready training records and our OSHA recordkeeping guide.