Data retention policy and trust scores: how aging data loses integrity over time
Health data loses integrity the moment it is created. A blood pressure reading from 3 years ago, an address from a prior state, a medication list from before a formulary change: each carries a trust score that decays on a predictable curve. Data retention policies that ignore this decay feed stale records into AI models that make real clinical decisions.
A lab result from 2019 is not the same data asset as a lab result from this morning. Both may be syntactically valid. Both may pass schema checks. Both may sit in the same FHIR resource type. But one reflects a patient's current physiology and the other reflects a historical state that may have no bearing on a clinical decision made today.
The problem is that most health data systems treat them identically. There is no decay function. No trust depreciation. No mechanism to signal that a record's clinical utility has degraded to the point where including it in a model may cause more harm than excluding it.
This is the data retention integrity problem, and it is one of the most underappreciated risks in healthcare AI.
Why data ages differently in healthcare
Not all health data decays at the same rate. A patient's blood type does not change. A genetic variant identified through whole genome sequencing remains stable indefinitely. But a hemoglobin A1c reading has a clinical half-life of roughly 90 days. A social determinants screening has a useful window of 6 to 12 months before housing status, food access, or transportation circumstances may shift.
The challenge is that EHR systems, claims databases, and research registries rarely encode this distinction. A diagnosis code from 2016 sits alongside a diagnosis code from last week with no metadata indicating which one should carry more weight in a predictive model.
Consider medication reconciliation. The average patient over 65 takes 5 or more medications. Formulary changes, insurance switches, and clinical protocol updates mean that a medication list from 18 months ago may be 30% to 40% inaccurate. Yet that list, unchanged in the EHR because no reconciliation event occurred, feeds into drug interaction algorithms, prior authorization logic, and care gap identification tools as if it were current.
This is not a theoretical risk. It is the default state of most health data infrastructure.
What are the four main types of data integrity?
Data integrity in healthcare operates across four distinct categories, each affected differently by time.
Physical integrity refers to the protection of data from hardware failures, corruption, or environmental damage. Aging affects physical integrity when storage media degrades or when backup systems fail to maintain bit-level fidelity over years of retention.
Logical integrity ensures data follows the rules and constraints of its schema. A FHIR Observation resource from 2018 may be logically valid under R3 but structurally incompatible with R4 validation rules. Time creates version drift that breaks logical integrity silently.
Entity integrity requires that every record has a unique identifier and that no duplicate or orphaned records exist. Over time, patient matching degrades as patients change names, addresses, and insurance carriers. A record linked to the correct patient in 2020 may be linked to the wrong patient in 2025 if the MPI has not been actively maintained.
Referential integrity ensures that relationships between records remain valid. When a provider retires, a facility closes, or a lab changes its LOINC mapping, the references embedded in historical records become broken pointers. The data looks complete. The relationships are hollow.
Each of these integrity types degrades on its own timeline. Physical integrity may hold for decades with proper infrastructure. Referential integrity can break within months of a system migration.
What are the 5 principles of data integrity?
The ALCOA framework, originally developed for FDA-regulated industries, defines five principles that govern whether data can be trusted. Each principle interacts with time in specific ways.
Attributable. Every data point must be traceable to the person or system that created it. As staff turn over, credentials expire, and systems are decommissioned, attribution metadata becomes harder to verify. A clinical note attributed to a physician who left the organization 4 years ago may still be attributable on paper, but the ability to verify its context or intent is gone.
Legible. Data must be readable and interpretable. Scanned documents degrade. Legacy system exports produce character encoding errors. PDF-based records from retired EHR platforms become increasingly difficult to parse as the software that created them disappears.
Contemporaneous. Data should be recorded at the time of the event. Retroactively entered data, late-filed claims, and backdated notes all violate this principle. The further a record sits from its creation date, the harder it becomes to confirm whether it was contemporaneous.
Original. The original record or a verified copy must be preserved. Data that has been migrated across 3 EHR systems, converted between HL7 v2 and FHIR, and copied into a data warehouse may retain its content but lose its originality. Each transformation is a potential corruption vector.
Accurate. The data must reflect reality. This is where aging hits hardest. A patient's weight, address, smoking status, medication list, and functional status all change over time. A record that was accurate when created becomes inaccurate through the simple passage of time, without anyone touching it.
The ALCOA principles do not account for temporal decay by default. That is why trust scoring must layer a recency dimension on top of traditional integrity frameworks.
Key statistics
The cost and scope of data aging in healthcare is measurable.
How trust scores decay over time
The SuperTruth Data Trust Index scores every health data record from 0 to 100 across 8 dimensions. Recency carries 15% of the total weight. But recency does not operate in isolation. It amplifies or dampens the contribution of every other dimension.
A record with perfect provenance, valid consent, and high concordance still loses trust value if it was collected 5 years ago. The provenance is intact, but the clinical relevance may not be. Conversely, a record collected yesterday with poor provenance scores low regardless of its freshness.
This interaction creates a trust decay curve that is not linear. It follows a step function with critical thresholds.
For most clinical data types, the DTI recency contribution begins to degrade after 90 days. At 6 months, the recency score has dropped significantly for dynamic data elements like vitals, lab values, and social determinants. At 12 months, medication lists and problem lists carry meaningful recency penalties. At 24 months, most non-genomic clinical data has lost enough recency value to pull the overall DTI score below thresholds required for AI model training.
Static data, such as genetic variants, blood type, or confirmed diagnoses of chronic conditions, follows a different curve. These elements retain high recency scores for years because the underlying reality they represent does not change.
The key insight is that trust decay is data-type-specific. A one-size-fits-all retention policy that keeps everything for 7 years (or 10, or indefinitely) treats a 2019 A1c result and a 2019 BRCA1 finding as equivalent assets. They are not.
What measures can be taken to preserve the integrity of data?
Preserving data integrity over time requires active intervention, not passive storage.
Recency tagging at ingestion. Every record entering a health data system should carry a metadata timestamp that enables downstream systems to calculate its age relative to the current date. This timestamp must be immutable and distinct from any "last modified" field.
Data-type-specific retention curves. Organizations should define decay profiles for each data category. Vital signs may have a 90-day clinical utility window. Genomic data may have an indefinite window. Social determinants data should be rescreened annually at minimum. These curves should be encoded into the data governance layer, not left to individual analysts.
Automated trust scoring. Manual review of record freshness is not scalable. The DTI Engine applies recency scoring automatically at the point of ingestion and recalculates it on a continuous basis. Records that fall below a configurable trust floor are flagged or excluded from downstream AI pipelines without requiring human intervention.
Provenance chain maintenance. As records age, their provenance metadata becomes the primary mechanism for verifying their original context. Systems that strip provenance during migration or aggregation destroy the one artifact that could help a future user assess whether the data is still trustworthy. Maintaining provenance chains is not just a best practice. It is the only way to evaluate aged data at all.
Consent revalidation. Consent given 5 years ago for a specific research study may not cover the AI use cases that have emerged since then. Aging data carries aging consent. Dynamic consent architectures must account for temporal drift in both the data and the permissions attached to it.
What are the challenges in maintaining data integrity?
The biggest challenge is that data integrity is invisible until it fails. Nobody notices a stale medication list until a drug interaction algorithm misses a contraindication. Nobody flags a 3-year-old address until a care coordination team sends a home health nurse to the wrong location.
Specific challenges include:
System migrations destroy context. Every time a health system switches EHR vendors, migrated data loses metadata. Notes are flattened. Structured fields become unstructured text. Timestamps are overwritten with migration dates. The data survives, but its integrity metadata does not.
Retention policies are compliance-driven, not quality-driven. Most organizations retain data for the minimum period required by regulation, typically 6 to 10 years depending on state law and data type. These policies exist to satisfy legal requirements, not to ensure that retained data remains clinically useful. The result is large volumes of data that are legally required to exist but clinically dangerous to use without recency adjustment.
No standard for expiration metadata. FHIR resources include effective dates and periods, but there is no widely adopted standard for encoding a record's expected clinical utility window. A lab result does not carry a "use by" date the way a medication carries an expiration. This absence forces every downstream system to make its own assumptions about freshness.
Patient matching degrades over time. Enterprise Master Patient Indexes (EMPIs) are probabilistic systems. The confidence of a match decreases as patient demographics change. A record correctly matched in 2020 may be incorrectly matched in 2025 if the patient changed their name, moved, or switched insurance carriers. Every year of retention without revalidation increases the false match rate.
Volume obscures decay. Health systems generate enormous quantities of data daily. Stale records do not disappear. They accumulate. Over time, the ratio of current to outdated data shifts until the majority of a data warehouse consists of records whose clinical utility has expired. Without trust scoring, there is no mechanism to distinguish the 10% that is current from the 90% that is not.
Data integrity vs data quality: why the distinction matters for retention
Data quality asks whether a record is complete, correctly formatted, and free of errors at the time of creation. Data integrity asks whether that record has remained trustworthy across its entire lifecycle.
A lab result can be high quality at the moment it is generated: correct patient, correct test, correct value, correct units. But 3 years later, the same result has low integrity for current clinical decision-making because it no longer reflects the patient's state. The quality has not changed. The integrity has.
This distinction is critical for data retention policy. Quality-focused retention keeps everything that was ever correct. Integrity-focused retention asks whether correctness at creation translates to trustworthiness at use. These are fundamentally different questions, and they lead to fundamentally different architectures.
The difference between data quality and data trust is not semantic. It determines whether an AI model trained on a 5-year data set is learning from signal or from noise.
Building a data expiration trust score
The concept of a data expiration trust score is straightforward: every record should carry a continuously updated score that reflects its remaining clinical utility based on its age, data type, and context.
SuperTruth's DTI Engine implements this through the Recency dimension, which contributes 15% of the total trust score. But recency interacts with every other dimension:
This multidimensional approach prevents the naive assumption that old data is always bad or new data is always good. A genetic test from 2018 with strong provenance and validation may score higher than a vital sign from yesterday entered by an unverified device. Context determines decay rate.
The regulatory dimension: retention requirements vs integrity requirements
HIPAA requires covered entities to retain certain records for 6 years from the date of creation or the date when the record was last in effect, whichever is later. Many states impose longer periods. Pediatric records often must be retained until the patient reaches the age of majority plus additional years.
These are retention floors, not integrity guarantees. The law requires you to keep the data. It says nothing about whether that data remains trustworthy for AI use.
The FDA's evolving guidance on AI and machine learning in medical devices adds another layer. The agency expects that training data for AI/ML devices meets quality standards that implicitly include recency. A model trained on 10-year-old clinical data without recency adjustment would face scrutiny during a premarket review. The FDA's approach to auditing health AI training data makes this expectation increasingly explicit.
Organizations that conflate regulatory retention requirements with data fitness for AI use are building on a foundation that compliance never intended to provide.
What this means for healthcare AI pipelines
Every AI model consuming health data should enforce a recency floor. Not as a suggestion. As a hard gate.
Claims data lag already introduces 30 to 90 days of staleness before data even enters a model. Layer that on top of records that may be months or years old, and the effective age of a training dataset can be measured in years, not days.
Readmission prediction models trained on data with no recency adjustment will learn patterns that reflect historical care delivery, not current protocols. Sepsis prediction algorithms that ingest outdated vital sign baselines will generate alerts calibrated to a patient who no longer exists in that physiological state.
The fix is not to delete old data. Historical data has legitimate uses in trend analysis, longitudinal research, and population health surveillance. The fix is to score it. Tag every record with a trust score that decays according to data-type-specific curves. Let downstream consumers filter based on their own recency requirements. A researcher studying 10-year cancer outcomes needs that old data. A clinical decision support tool recommending today's insulin dose does not.
This is what recency as a scoring dimension makes possible. Not deletion, but differentiation.
From retention policy to trust architecture
Data retention policy has historically been a compliance function owned by legal and IT. It answers the question: how long must we keep this? That question is necessary but insufficient.
The next question, the one that determines whether healthcare AI is trustworthy, is: how long should we trust this? That question requires a trust architecture, not a retention schedule.
The DTI Engine scores every health data record 0 to 100 across 8 trust dimensions before your AI model sees it. Recency is baked into that score, weighted at 15%, and calibrated to data-type-specific decay curves. If your team is evaluating data for training, compliance, or clinical use, contact Louis Simeonidis at louis@supertruth.ai or (215) 918-4140.
Further reading:
Jason Alan Snyder
Co-founder of SuperTruth and Artists & Robots, and an inventor on the Data Trust Index patents. Twenty-plus years building technology inside Interpublic Group. He writes here nearly every day on data trust, provenance, and what AI should be allowed to act on, and publishes essays on his Substack.
About SuperTruth · LinkedIn · Substack · jasonalansnyder.com
See it in practice
DTI scores the record, not the patient.
8 dimensions. 0–100. Travels with every record permanently.