Spring cleaning might feel like a time to finally tackle the overflowing file cabinets, the stray folders piling up on desks, or to address long-forgotten digital files hiding in shared drives. But any such decluttering must be done with a firm eye on compliance. Getting rid of documents too early or improperly can expose you to audit risks. Before you toss that old tenant file or clear out waiting list documents, it's worth taking a pause to consider HUD’s record retention requirements.

HUD rules don’t just specify how long you must hold onto documents. They also dictate how those documents must be handled and, ultimately, disposed of. These records aren’t just paperwork. They’re the key to showing compliance with HUD rules and income verification. And once the retention period has expired for all of the relevant files and documents, HUD requires owners to dispose of the data in a manner that will prevent any unauthorized access to personal information. In HUD Handbook 4350.3, HUD uses the words “burn, pulverize, shred, etc.” to describe the way in which files and records are to be disposed to prevent any unauthorized access to personal information. Here are some reminders about HUD’s record retention requirements.

Applicant Files

For owners and managers, the starting point in deciding what can go is knowing how long each type of record needs to be kept. For example, applicant files are a category where retention timing hinges on status changes. If an applicant is still on the waiting list, their file must remain intact. Once they’re removed due to ineligibility or by their own decision, you still need to retain that file, along with any related documentation, for at least three more years. And if that same applicant ends up moving in, the documentation follows them into their resident file, starting a new clock based on the duration of their tenancy and extending three years beyond move-out.

In other words, applicant files must be maintained from the time the application is accepted, for the entire time an applicant is on the waiting list, and for three years after the applicant is removed from the waiting list. According HUD Handbook 4350.3, par. 4-22, the current application must be retained as long as the applicant is active on the waiting list.

Once the applicant is removed from the waitlist, then the application, Supplement to Application (HUD 92006), initial rejection notice, applicant reply, copy of the owner’s final response, and all documentation supporting the reason for removal must be retained for three years.

When an applicant moves in and begins to receive assistance, the application and form HUD-92006 the applicant completed must be maintained in the tenant file for the duration of the tenancy and for three years after the tenant leaves the site.

Resident Files

Resident files carry even more weight. From move-in paperwork to income verifications, original consent forms, and signed certification forms like HUD-9887 and HUD-50059, all of it needs to stay accessible for the length of the tenancy, and then all this paperwork must stick around for another three years after the resident departs. The resident’s files should be available for review by the tenant upon request or by a third party who provides signed authorization for access from the tenant.

According to HUD Handbook 4350.3, par. 5-23, at a minimum, owners must keep the following documentation in the resident file:

• All original, signed HUD 9887s and 9887-As;
• A copy of signed consent forms;
• A copy of the EIV Income Report, regardless of whether or not any income is reported for the household, along with the HUD-50059 and any other documentation obtained supporting income and rent determinations; and
• Any third-party verifications received from third-party sources.

If your files have gotten unwieldy, HUD does allow older portions to be stored off-site, as long as those files can be retrieved quickly when requested by HUD or a Contract Administrator. However, storage doesn’t mean optional retention. Even in a remote location, the documents remain subject to HUD’s rules and must be securely preserved.

EIV Reports

One area where managers may stumble is with records from the Enterprise Income Verification (EIV) system. These reports carry particularly sensitive personal data, so extra care is needed.

The Income Report, Summary Report showing Identity Verification Status as “Verified,” and the Income Discrepancy Report along with any supporting documentation must be retained in the resident file for the term of tenancy plus three years. According to HUD Handbook 4350.3, par. 9-14:

• Any tenant-provided documentation to supplement the Social Security Administration or National Database of New Hires data must be retained in the resident file for the term of tenancy plus three years.
• Results of the Existing Tenant Search must be retained with the application. If the applicant was not admitted, it must be retained with the application for three years. If the applicant was admitted, it must be retained in the resident file for the term of tenancy plus three years.
• The master file containing the New Hires Report, Identity Verification Reports, Multiple Subsidy Report, and Deceased Tenant Report must be retained for three years.

Privacy rules. It’s important to note that with regard to the disclosure of EIV data, the Federal Privacy Act prohibits disclosing an individual’s information to another person without the written consent of that individual. As such, the EIV data of an adult household member may not be shared (or a copy provided or displayed) with another adult household member or to a person assisting the tenant with the recertification process, unless the individual has provided written consent to disclose such information.

You are not, however, prohibited from discussing with the head of household and showing the head of household how the household’s income and rent were determined based on the total income reported and verified.

With the written consent of the tenant, EIV data may be shared with persons assisting the tenant with the recertification process. Parties to whom the tenant can provide written consent include:

• Service coordinators (only if they are present at and assisting the tenant with the recertification process);
• Translators/interpreters;
• Individuals assisting an elderly individual or a person with a disability;
• Guardians;
• Powers of attorney; and
• Other family members.

Disposing of Files 

When it comes time to finally dispose of records that have met their full retention period, you’ll need to do more than just empty them into the trash. HUD expects personal data to be destroyed in a way that makes it unrecoverable. Shredding is the most common method, but burning or pulverizing are also acceptable if done securely. The goal is to eliminate any chance of unauthorized access to private information.