How Long Must Medical Records Be Kept? It Depends on Your State

The most common error in this area is treating HIPAA’s six-year requirement as a medical record retention period. It is not. 45 CFR 164.316(b)(2) requires retention of HIPAA-specific documentation — policies, procedures, and records of required actions and assessments — for six years. It says nothing about how long a patient’s chart must be kept.

Medical record retention is set by state law, and in some states by facility licensing rules that differ from the rules for individual practitioners. A practice relying on "six years, HIPAA says so" may be under-retaining by a wide margin or applying a rule that does not exist in its jurisdiction.

These are illustrative rather than exhaustive, and they show the range is wider than a single national answer could cover:

Nearly every state extends retention for records of minor patients, typically running the period from the age of majority rather than from the date of treatment. The practical effect is that a record created for a two-year-old may need to be kept for two decades, not the headline period.

Separately, retention periods commonly run from the date of last treatment rather than from record creation. For a patient seen over many years, the clock starts at the final encounter and the earliest notes are retained far longer than the stated term implies. Practices that purge by document date rather than by last-encounter date tend to discover this the wrong way.

A recurring source of error is assuming one rule covers everyone practising in a state. Several states regulate facilities and individual practitioners under separate instruments with different periods.

Ohio and Illinois are the clearest illustrations. Both set a defined retention period for facilities through licensing rules, and neither imposes an equivalent general statute on private physician practices. That does not mean a private practice may discard records freely: professional-conduct obligations, malpractice statutes of limitations, payer contracts, and the practical need to defend a claim all impose effective retention floors that no single statute states.

For a clinician who moved between a hospital system and private practice, this is the trap. The period that governed at the hospital was a licensing rule that followed the facility, not the physician, and it did not travel with them.

Retirement, relocation, practice sale, and death are the scenarios where retention obligations are most often breached, because the person who understood them is no longer there.

Massachusetts is explicit that the duty to preserve records survives retirement, licence lapse or revocation, and the physician’s death — which means an estate inherits an obligation. Many states impose notification requirements when a practice closes, covering how patients are told and how they may obtain copies. Practices frequently satisfy these by transferring records to a custodian, which is itself a disclosure of protected health information requiring the usual safeguards.

If records exist only as documents held by a transcription vendor, a practice closure raises a question worth answering in advance: who retrieves them, in what format, and how long does the vendor keep the copy afterwards?

A transcribed document becomes part of the medical record, so the retention obligation follows it. Two questions follow from that, and neither is usually asked during vendor selection.

First, who holds the copy? If a transcription vendor retains finished documents indefinitely, that is a copy of your records held by a third party under your obligations, with a corresponding breach surface. Retention you did not specify is retention you are responsible for.

Second, can you get everything out? A vendor whose export is a per-file download is a practical problem when the requirement is to preserve a defined record set for decades, or where a state requires permanent retention of a core record. Ask about bulk export before you need it, not after.