While the regulation does not specify how long to retain records, it is recommended to keep them for at least two years. These documents must not be disclosed to anyone, unless necessary to investigate an incident or complaint, to take corrective action or if required by law.