Medical Records Retention Requirements by State and Federal Law
Medical records retention is governed by overlapping federal and state laws, with no single rule covering all situations. Practices that follow only the HIPAA minimum risk state-level violations, and practices that follow only their state law may still fall short of Medicare or malpractice requirements. This guide maps the regulatory landscape so practices can set a defensible retention policy.
Federal Retention Requirements
HIPAA itself does not set a minimum retention period for medical records. The HIPAA Privacy Rule (45 CFR 164.530(j)) requires covered entities to retain policies, procedures, and documentation of compliance activities for 6 years from the date of creation or the date last in effect. This 6-year rule applies to administrative records (privacy policies, training logs, business associate agreements), not to patient charts.
Medicare Conditions of Participation (42 CFR 482.24(b)(1)) require hospitals to retain medical records for at least 5 years. For Medicare fee-for-service claims, the False Claims Act statute of limitations is 6 years from the date of the claim (31 U.S.C. 3731(b)), and CMS can audit records within that window. Practices that cannot produce records for audited claims face overpayment demands.
OSHA requires employers to retain employee medical records (including exposure records) for 30 years past the employee's last date of employment under 29 CFR 1910.1020(d)(1)(i). This applies to occupational health records, not general patient records.
The Stark Law and Anti-Kickback Statute require retention of financial arrangements, referral records, and compensation documentation for at least 6 years (42 CFR 411.353). Failure to produce these records during an investigation creates a presumption of violation.
State Retention Minimums: Key Variations
State retention requirements range from 5 years to 10 years for adult patient records. Florida (F.S. 456.057(12)) requires 5 years from last patient contact. California (Health and Safety Code 123145) requires 7 years from discharge for hospitals and 7 years from last visit for other providers. New York (10 NYCRR 415.19) requires 6 years from discharge or 3 years after the patient's age of majority, whichever is longer.
Minor patient records carry longer requirements in most states. The general rule is to retain records until the patient reaches the age of majority (18) plus the state's standard retention period. In states with a 7-year minimum, this means records for a newborn must be kept for 25 years. Some states (Illinois, New Jersey) explicitly require retention until the minor turns 23 to 25.
ERISA-governed health plans must retain claims and eligibility records for at least 6 years under 29 U.S.C. 1027. This affects employer-sponsored health plan documentation that practices may hold.
States with specific imaging or radiology retention rules (such as mammography under MQSA, 21 CFR 900.12(c)(4)) require original films or first-generation digital copies for 5 to 10 years, or until the patient's next mammogram plus an additional retention period.
Malpractice Statute of Limitations Considerations
The safest retention policy accounts for the malpractice statute of limitations in your state, not just the records retention statute. If a state requires 7 years of record retention but has a 10-year malpractice discovery rule, destroying records at year 7 leaves the practice unable to defend a claim filed in year 9.
Discovery rules extend the effective retention need. Many states start the malpractice clock when the patient discovers (or reasonably should have discovered) the injury, not when the procedure occurred. In states with a 2-year-from-discovery rule and a 6-year statute of repose (such as Ohio under ORC 2305.113), records may need to be retained for up to 8 years or longer.
The American Health Information Management Association (AHIMA) recommends retaining adult patient records for 10 years after the last encounter as a best practice that satisfies most state requirements and malpractice considerations. For minors, AHIMA recommends retention until the patient reaches the age of majority plus the applicable state retention period.
Practices with multi-state patient populations should follow the longest applicable requirement across all states where they are licensed and treat patients. Telemedicine providers are especially affected because they may be subject to retention laws in both the provider's state and the patient's state.
Destruction and Transition Policies
HIPAA requires that protected health information (PHI) be destroyed in a manner that renders it unreadable. The HHS Guidance on PHI disposal (published under 45 CFR 164.310(d)(2)(i)) specifies shredding, burning, or pulping for paper records. Electronic records must be cleared, purged, or destroyed in accordance with NIST SP 800-88 Guidelines for Media Sanitization.
Maintain a destruction log documenting what was destroyed, the date of destruction, the method used, and the person responsible. The destruction log itself should be retained permanently. OCR has investigated practices that could not demonstrate compliant destruction of PHI.
When a practice closes or a provider retires, records must be transferred or retained. Most state medical boards require written notification to patients (typically 30 to 90 days in advance) with instructions for obtaining records. The AMA Ethics Opinion 3.3.3 requires reasonable efforts to notify patients and arrange record transfer.
Cloud-based EHR vendors may impose their own data retention and export timelines. Before signing an EHR contract, confirm that you can export complete records in a standard format (C-CDA, PDF) and that the vendor will not delete data before your retention obligations expire. Include data retention terms in the Business Associate Agreement.
How long should a medical practice keep patient records?
A defensible minimum is 10 years from the last encounter for adult patients, which satisfies most state requirements and provides protection during the malpractice statute of limitations. For minors, retain records until the patient turns 18 plus your state's retention period (often 7 to 10 additional years). Always check your specific state law, as requirements vary from 5 to 10 years.
Does HIPAA require keeping records for 6 years?
No. The commonly cited 6-year HIPAA requirement (45 CFR 164.530(j)) applies to administrative and compliance documentation (policies, training records, BAAs), not to patient medical records. HIPAA does not set a minimum retention period for clinical records. Patient record retention is governed by state law, Medicare requirements, and malpractice considerations.
What happens if records are destroyed before the retention period expires?
Premature destruction can result in state medical board sanctions, inability to defend malpractice claims (courts may draw adverse inferences from missing records), Medicare overpayment demands for undocumented claims, and HIPAA penalties if PHI was not destroyed in a compliant manner. The penalties vary by state but can include fines and license discipline.
Do electronic records have different retention requirements than paper records?
No. The retention period is the same regardless of format. Electronic records must meet the same accessibility requirements: you must be able to produce a readable copy upon patient request or legal demand. The advantage of electronic records is that storage costs are lower and retrieval is faster, making longer retention periods more practical.
For practices
Bring this to your own practice.
QR Rx turns every procedure into a branded recovery plan that keeps patients engaged and brings them back. Start free in minutes, or see it live in a 20-minute demo.
This blog provides general information about healthcare compliance and aftercare best practices. It does not constitute legal, medical, or regulatory advice. Consult qualified professionals for guidance specific to your practice.
