In accordance with Department of Defense Manual (DODM) 6025.18 paragraphs 7.3.c and 7.3.d, Department of Defense (DOD) covered entities must maintain policies and procedures in written or electronic format for six years from the date the document was created, or from when it was last in effect, whichever is later unless a longer period is specified by the National Archives and Records Administration or by DOD or DOD Component records management regulation and guidance or other laws, regulations, and DOD Component issuances. Since HIPAA requires that all documentation be maintained for six years from the date the document is created or the document is in effect, whichever is later, the Defense Health Agency (DHA) Privacy and Civil Liberties Office (PCLO) requires that the DOD Institutional Review Boards maintain the documentation related to HIPAA Privacy Rule reviews of studies for this same time period, six years after the date the study closes.