Any recommended strategy for 6 year data retention.

Hello Jim, I can't tell anything about HIPAA. But as long as you don't have to keep the data in your ARM database it's fairly easy to keep 6 years of ARM data. We kept it almost 10 years, accidentially ;-). ARM has a builtin archive function. Which is quite handy. I don't know if it is on by default. At least you can turn it on. If so, the archives are stored on your ARM server or you can specify a network share to store it.

What we are looking at right now is archiving the reports into a folder monthly and yearly and copying the database ofline with MS SQL Studio as well.  The main concern it to ensure that we have a version of ARM that will be able to read the DB after 6 years.  We may archive the version of ARM installer as well so that we can do a rebuild if we need to do an extensive forensic study of the past data.

What we are looking at right now is archiving the reports into a folder monthly and yearly and copying the database ofline with MS SQL Studio as well.  The main concern it to ensure that we have a version of ARM that will be able to read the DB after 6 years.  We may archive the version of ARM installer as well so that we can do a rebuild if we need to do an extensive forensic study of the past data.

Archiving the reports is easy. Just put them on share. That's how we save our reports. For your database concern, I recommend to use the ARM buitlin archiving mechanism. It's not limited. The only thing is you have to backup the archived scan files.

One concern is that ARM archives the reports with a hash and removes the extension.  So you HAVE to have ARM to read them back.  Unless there is something I'm missing.  Thus the need to have an archive copy of the ARM version.  

Yes, but you can tell ARM to save the resulting reports on a network share. Look at the administrator guide.  The key word is custom storage path. You will find it on the bottom of the report creation dialog where you set the format, the schedule and the email address.