A medical record is a comprehensive collection of information documenting a patient’s health history, including diagnostic test results, physician notes, treatment plans, and medications. Determining how long a doctor’s office must keep these documents is not governed by a single federal rule. Retention rules are complex and highly variable, depending on state and federal mandates.
The Governing Framework for Record Retention
The duration for which patient records must be maintained is primarily set by state law, creating a patchwork of regulations across the country. While the federal Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for the privacy and security of protected health information, it does not set a minimum retention period for the clinical medical record. HIPAA does require that administrative documents, such as privacy policies and compliance records, be retained for six years from their creation or the date they were last in effect.
State laws govern the actual length of retention for patient treatment records, and a healthcare provider must follow the longest applicable retention period. A major factor driving these state requirements is the statute of limitations, which defines the time frame a patient has to file a medical malpractice lawsuit. Practices must keep records for at least the duration of this statute to protect themselves in case of litigation. Because state laws on malpractice vary, the corresponding medical record retention period also differs significantly.
Standard Retention Timeframes and State Variation
The most common retention period for adult medical records falls within a range of five to ten years after the patient’s last visit or discharge. For instance, some states, like Florida, require records to be kept for a minimum of five years, while others, such as Georgia, mandate ten years from the date of the last patient contact. This variation illustrates why a single answer to the question of record retention is impossible.
Special circumstances trigger extended retention requirements, most notably for minor patients. When a child is treated, the retention period is usually defined as a set number of years after the patient reaches the age of majority, not just the date of the last service. For example, a state may require records to be kept until the patient reaches age 21, or for seven years after the last encounter, whichever period is longer. This is because the statute of limitations for minors often does not begin until they turn 18, allowing a lawsuit to be filed many years after the initial treatment.
Retention periods can be triggered by different events, such as the date of service, the patient’s discharge date, or the date of the last contact with the office. In some cases, like in Montana, records for minors must be kept until the patient is 28 years old. A single practice may need to follow multiple retention schedules simultaneously based on the patient’s age and the specific state’s rules.
What Happens When a Practice Closes?
A physician’s legal obligations to maintain patient records do not end when they retire, move, or close their practice. The practice must make legally compliant arrangements for the continued secure storage of all patient files for the remainder of the required retention period. This often involves transferring the records to a designated custodian, such as another physician, a hospital, or a professional record storage service that complies with federal and state regulations.
The closing physician must notify patients well in advance of the closure date; 90 days is often recommended, with 30 days being common in many jurisdictions. This notification must inform active patients about the practice’s closure and explain how they can obtain copies of their records or arrange for their transfer to a new provider. The practice is legally responsible for ensuring that the records remain accessible and confidential until the retention period expires.
Patient Rights to Access and Retrieval
Under HIPAA, patients have a federally protected right to inspect and obtain a copy of their medical records. This right ensures individuals can access their health information to facilitate continuity of care and make informed healthcare decisions. While the healthcare provider owns the physical record—whether paper or digital—the patient owns the information contained within that record.
When a patient requests a copy of their records, the covered entity must provide access without unnecessary delay, and no later than 30 calendar days from the request date. If the provider cannot meet this deadline, they can request a single 30-day extension, provided they notify the patient in writing before the initial 30 days expire. Providers may charge a reasonable, cost-based fee for fulfilling the request. This fee is limited to the cost of labor for copying, any supplies used, and postage if the records are mailed. Fees cannot be charged for searching for or retrieving the patient’s information.