When a healthcare provider closes their practice, the fate of patient medical files becomes a significant concern for continuity of care. A structured process, governed by law, ensures records are retained and accessible. This framework establishes that the closing provider must responsibly transfer clinical documents to a designated custodian for a specific period. Understanding this regulated process is the first step in knowing how to secure your own health information when a practice shuts its doors.
Legal Requirements for Record Retention
The disposition of medical records is a professional and legal obligation defined by federal and state regulations. While the federal Health Insurance Portability and Accountability Act (HIPAA) governs the privacy and security of health information, it does not set the specific length of time that medical records must be retained. State laws determine retention periods, and these requirements vary significantly across the country.
Most states mandate a baseline retention period ranging from five to ten years for adult patient records. This period is calculated from the date of the patient’s last visit or discharge. If state law requires a longer retention period than federal guidelines, the state law takes precedence.
The retention rules are typically extended for patients who are minors at the time of their last treatment. State law often requires the files to be kept until the patient reaches the age of majority, plus an additional number of years, which can align with the state’s statute of limitations for medical malpractice. This means the obligation for a closing practice could potentially span decades for younger patients, and the records must be maintained in a secure, accessible format for the entire duration.
Locating the Designated Records Custodian
When closing a practice, the physician must appoint a custodian to take over the legal duty of storing and managing the medical records. The closing provider is required to proactively notify patients about the impending closure and the plan for record transfer. This notification often involves sending letters or emails to all patients seen within a specified recent period, such as the last two years.
Practices are also typically required to place public notices, often in local newspapers or on the practice website, announcing the closure date. These notices must be published for a specific duration to ensure patient awareness. The notification should include the name and contact information of the new records custodian, or instructions for requesting records before the final closure.
If a patient missed the initial announcements, they should contact the State Medical Board or the professional licensing agency where the physician practiced. These regulatory bodies often require the closing physician to report the name and location of the designated records custodian. Checking with any affiliated hospital or health system can also be helpful, as these larger entities sometimes track the disposition of the physician’s records.
Patient Rights and Retrieval Procedures
Once the records custodian is identified, patients have a federally protected right under HIPAA to access their health information. This right allows patients to obtain a copy of their medical records, including clinical notes, laboratory results, and imaging reports, regardless of the practice’s closed status. The request must generally be submitted to the custodian in writing, requiring a signed authorization form and verification of the patient’s identity to protect privacy.
The custodian must act on the request “without unnecessary delay.” Under HIPAA, access to the requested records must be provided no later than 30 calendar days after receiving the request. If the custodian requires more time, a single 30-day extension is allowed, but the patient must receive written notice explaining the reason for the delay. If state law mandates a faster response time, that shorter state timeline must be followed.
Custodians are allowed to charge a reasonable, cost-based fee for fulfilling the request. This fee is limited to the actual costs of copying, preparing a summary if specifically requested, and postage if the records are mailed. HIPAA rules strongly discourage per-page fees for electronic records, and fees cannot be charged for the labor involved in searching for or retrieving the records.
Handling Abandoned or Unavailable Records
Most practices adhere to legal requirements, but unexpected closures, such as due to a physician’s sudden death or bankruptcy, can leave records abandoned. If standard methods fail to locate a custodian, patients have recourse through regulatory channels.
The patient should first report the situation to the State Medical Board or the licensing agency that regulated the former physician. This body has the authority to investigate the failure to properly secure records and can compel compliance or locate the files. If the situation involves a failure to provide access within the mandated timeframe, the patient can file a formal complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). The OCR enforces HIPAA, and an investigation can often resolve access issues.