The records custodian: contract, costs, and patient access after closing

What a records custodian is, and why a closed practice still needs one

A records custodian is the person or organization that takes legal responsibility for your patient files after you stop practicing — storing them securely, releasing copies on valid request, and honoring retention deadlines you can no longer meet yourself. Closing the doors does not end your records obligations; it transfers the day-to-day of meeting them. Naming a custodian in writing is how a solo clinician hands off that duty without abandoning it.

The custodian holds and discloses protected health information on your behalf, which makes them a business associate under HIPAA — so the arrangement needs a signed business-associate agreement, not a handshake 1Ref 1HHS Office for Civil Rights (2026).Business Associates.That a records custodian holding or transmitting PHI on the practice's behalf is a business associate requiring a signed BAA.. Think of the custodian as the answer to a plain question: after your name comes off the door, who owns the medical record, and who picks up the phone when a former patient, a new treating clinician, or an attorney asks for it?

The custodian agreement: what it must say

The custodian agreement is a written contract that survives your practice, and it should fix six things: who the custodian is and that they are licensed to hold the records, the business-associate terms HIPAA requires, how long each record type must be kept, the fee for releasing copies, where the files physically or electronically live, and what happens if the custodian themselves closes or dies. Vague custody is worse than none — it strands the records with no one accountable.

The copy-fee clause should mirror the patient's own HIPAA access right: a reasonable, cost-based charge, never a profit center 2Ref 2HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That the patient's right to inspect and copy records within 30 days for a reasonable cost-based fee survives closure and binds the custodian, with psychotherapy notes excluded.. Put the whole thing on paper before your last session.

How long the records have to outlive the practice

Retention is set by your state's record-keeping statute and licensing board, not by a single national number, so the custodian agreement should name your state's actual clock. As a professional reference point, the APA's record-keeping guidelines suggest keeping full records for roughly seven years after the last adult service, and longer for a minor, while deferring to any state rule that demands more 3Ref 3American Psychological Association (2007).Record Keeping Guidelines.The professional retention reference point (about seven years after last adult service, longer for minors) that the custodian schedule is built on, always deferring to state law.. Decedent records carry their own long tail.

Records of a patient who has died stay protected for fifty years after death, so a decedent's chart can outlast every living one you hold 4Ref 4HHS Office for Civil Rights (2026).Health Information of Deceased Individuals.That a decedent's PHI stays protected for fifty years and the estate's personal representative exercises the access right the custodian must honor.. Build the schedule around the longest rule that touches any file in your custody, and note the deadline on each chart so the custodian is not guessing.

Keeping the patient's access right alive

A patient's right to their own record does not close when your practice does; the custodian inherits the duty to honor it. Under HIPAA, an individual can inspect and obtain a copy of their record, generally within thirty days, for a reasonable cost-based fee, in the form they ask for where you can produce it — with psychotherapy notes the one clinical carve-out 2Ref 2HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That the patient's right to inspect and copy records within 30 days for a reasonable cost-based fee survives closure and binds the custodian, with psychotherapy notes excluded.. Build that timeline and fee into the custodian agreement.

If your records were electronic, the Cures Act information-blocking rule still reaches the custodian: an actor who unreasonably interferes with a patient's access to their electronic health information can land on the wrong side of that rule, and a closed practice is not one of its exceptions 5Ref 5Office of the National Coordinator / ASTP (2026).Information Blocking.That the Cures Act information-blocking rule reaches actors who interfere with access to electronic health information, so a custodian must not become the obstacle to electronic access.. The custodian's job is to make access easy, not to become the obstacle.

Who can lawfully request a chart after you close

After closure the custodian fields requests from three kinds of people: the patient, someone who legally stands in for the patient, and the courts. HIPAA treats a personal representative — a parent for most minor records, a guardian, or an estate's executor — as the individual for access purposes, but defers to your state's law on exactly who that is, especially for minors and incapacitated adults 6Ref 6HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA treats a personal representative as the individual for access and defers to state law on who controls a minor's or incapacitated adult's records.. The custodian needs a simple rule for verifying each before releasing anything.

When a subpoena or court order arrives — and they still arrive years after closing — the custodian follows the same HIPAA rule you would: a court order authorizes disclosure of only what it names, while a subpoena without a court order requires satisfactory assurances that the patient was notified or that a protective order is in place before anything goes out 7Ref 7HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That a court order authorizes disclosure only of what it names while a subpoena without one requires satisfactory assurances of notice or a protective order — the rule the custodian follows post-closure.. When a patient dies, the estate's personal representative exercises the access right, and the fifty-year protection means the custodian may still be answering for that chart long after 4Ref 4HHS Office for Civil Rights (2026).Health Information of Deceased Individuals.That a decedent's PHI stays protected for fifty years and the estate's personal representative exercises the access right the custodian must honor..

What custody costs, and who pays

Custody has three cost layers, and settling them prevents a fight later: the storage itself, the custodian's standing fee, and the per-request charge for pulling and copying a chart. Storage after the practice can be a paid records-storage vendor, a cloud EHR kept on a maintenance plan, or a colleague's secure system — each a business associate needing its own agreement 1Ref 1HHS Office for Civil Rights (2026).Business Associates.That a records custodian holding or transmitting PHI on the practice's behalf is a business associate requiring a signed BAA.. Decide who funds the retention years: you, from a set-aside, or the custodian from the copy fees they collect.

The per-request fee is capped by the same cost-based standard as your own releases, so the custodian cannot turn records into revenue 2Ref 2HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That the patient's right to inspect and copy records within 30 days for a reasonable cost-based fee survives closure and binds the custodian, with psychotherapy notes excluded.. A clean way to size the reserve is to estimate the storage bill across the longest retention deadline you carry, then fund that plus a modest allowance for the custodian's time, so the arrangement is not renegotiated every year.

Setting it up before you close: the sequence

Arrange custody while you are still practicing, because a custodian recruited after the doors shut inherits a mess instead of a plan. Work the sequence in order: pick the custodian, paper the agreement, reconcile and index the records, notify patients where future requests go, and file the change everywhere your identifiers live. Give yourself months, not days — reconciling a full panel of charts and updating registries is slow, and you want it done before the last session, not after.

• Choose a qualified custodian. A licensed colleague, a group practice, or a professional records-storage company — someone permitted to hold clinical records in your state and likely to still be reachable years out.
• Sign the agreement and the BAA. Cover retention, fees, location, access duties, and succession if the custodian themselves stops.
• Reconcile and index every chart. Confirm nothing is missing, note the retention deadline on each, and leave an index the custodian can actually search.
• Tell patients where records go. Your closing notice and the required patient communications should name the custodian and how to request a copy — the same message that handles closing the practice.
• Update your identifiers. Deactivate or update your NPI record, notify payers, and make sure the custodian's contact is what a future requester finds.

Professional bodies publish closing-a-practice and professional-will checklists you can adapt to your discipline 8Ref 8APA Services, Inc. (2026).Practice — APA Services.That a professional practice organization publishes closing-a-practice and professional-will guidance a solo can adapt when setting up custody.. The point of the whole exercise is continuity: a former patient, a new treating clinician, or an attorney should always find a door that opens.