While the HIPAA certification only reflects an organization's compliance with HIPAA at the time of assessment, all HIPAA-related documentation should be retained for a minimum of six years.