A Client Asks You to Destroy Their Records: What You Can Offer

Can you destroy a client's records because they asked?

No, in almost every case. HIPAA gives a client no right to have a record deleted. The one federal right it creates over what a chart contains is the right to have it amended, and even that runs only for as long as the information is maintained 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR § 164.526 — Amendment of protected health information.The federal right an individual holds over the contents of the chart: amendment for as long as the information is maintained in a designated record set, the four permitted grounds for denial including that the information is accurate and complete, the 60-day action clock with one extension of no more than 30 days, and the statement of disagreement and rebuttal that travel with the record on future disclosures. Cited here to establish that HIPAA creates no right to have a record destroyed.. Underneath sits a second constraint that does not come from the client at all: the retention floor written into your own licensure law.

Those floors are set state by state and by license type. California requires a marriage and family therapist to keep a client's health service records for a minimum of seven years from the date therapy is terminated, or seven years from a minor client's eighteenth birthday, for therapy terminated on or after January 1, 2015 2Ref 2California State Legislature (2014).California Business and Professions Code Section 4980.49.One named state example of the licensure retention floor that puts early destruction out of reach: California marriage and family therapists, a minimum of seven years from the date therapy is terminated, or seven years from a minor client's eighteenth birthday, for therapy terminated on or after January 1, 2015. Cited as California LMFTs only, alongside an instruction to read the reader's own board rule.. That is one state and one license type. Read the retention rule in your own board's regulations before you answer the client, because a neighbouring state's number is not yours and HIPAA supplies none.

A flat refusal leaves the client exactly where they started. The useful reply names the retention rule you are held to, cites it, and moves to what can be done with a record that will exist either way.

What HIPAA gives a client over the contents of the chart

Amendment. An individual has the right to have a covered entity amend protected health information about them in a designated record set, for as long as that information is maintained 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR § 164.526 — Amendment of protected health information.The federal right an individual holds over the contents of the chart: amendment for as long as the information is maintained in a designated record set, the four permitted grounds for denial including that the information is accurate and complete, the 60-day action clock with one extension of no more than 30 days, and the statement of disagreement and rebuttal that travel with the record on future disclosures. Cited here to establish that HIPAA creates no right to have a record destroyed.. Nothing in that section reaches destruction. Amendment corrects and adds; the original entry stays where it is, and a note the client disputes remains in the file with the dispute attached to it.

The clock is short and it is yours to meet. Act on an amendment request no later than 60 days after you receive it, with at most one extension of no more than 30 days, and the reason for the delay has to reach the client in writing inside that original 60 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR § 164.526 — Amendment of protected health information.The federal right an individual holds over the contents of the chart: amendment for as long as the information is maintained in a designated record set, the four permitted grounds for denial including that the information is accurate and complete, the 60-day action clock with one extension of no more than 30 days, and the statement of disagreement and rebuttal that travel with the record on future disclosures. Cited here to establish that HIPAA creates no right to have a record destroyed..

You may also decline. A covered entity may deny an amendment request on four grounds, and the one a clinician reaches for most is that the information is accurate and complete 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR § 164.526 — Amendment of protected health information.The federal right an individual holds over the contents of the chart: amendment for as long as the information is maintained in a designated record set, the four permitted grounds for denial including that the information is accurate and complete, the 60-day action clock with one extension of no more than 30 days, and the statement of disagreement and rebuttal that travel with the record on future disclosures. Cited here to establish that HIPAA creates no right to have a record destroyed.. A contemporaneous note about what happened in a session usually is. Denial is a written act, though, and the written denial has to explain itself.

A denial is not where the client's options end. They may submit a written statement of disagreement; you may write a rebuttal; and the request, the denial, the statement and the rebuttal are appended to or linked with the designated record set, so the dispute travels with the record on later disclosures 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR § 164.526 — Amendment of protected health information.The federal right an individual holds over the contents of the chart: amendment for as long as the information is maintained in a designated record set, the four permitted grounds for denial including that the information is accurate and complete, the 60-day action clock with one extension of no more than 30 days, and the statement of disagreement and rebuttal that travel with the record on future disclosures. Cited here to establish that HIPAA creates no right to have a record destroyed..

The six-year figure is about your policies, not the chart

HIPAA's six-year clock covers the documentation the Privacy Rule itself requires, meaning your policies, procedures and the writings the rule tells you to keep, and it runs from creation or from the date the item was last in effect, whichever is later 3Ref 3U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR § 164.530 — Administrative requirements.The six-year clock at (j)(2) and what it actually covers: the documentation the subpart requires, running from creation or the date the item was last in effect, whichever is later. Cited to correct the common reading of it as a federal clinical-record retention period.. It is not a federal retention period for the clinical record, and HIPAA sets none. The chart's floor comes from state licensure law.

This matters in the conversation itself, because a client who has read about the six years sometimes arrives asking you to start that clock, or to confirm the file disappears at the end of it. Neither is how it works.

Three things you can offer in place of destruction

Access, amendment and restriction. A client may ask you to restrict how their protected health information is used or disclosed for treatment, payment or health care operations, and outside one case you are not required to agree to it 4Ref 4U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR § 164.522 — Rights to request privacy protection for protected health information.The restriction a clinician can offer in place of destruction: a discretionary restriction on use or disclosure for treatment, payment or health care operations that the covered entity is not required to agree to, and the one restriction that is mandatory, against disclosure to a health plan where the item or service was paid for in full out of pocket, which the covered entity also cannot terminate on its own.. Agreeing is still a real option, and an agreed restriction binds you.

One restriction is mandatory. Where the client has paid in full out of pocket for an item or service and asks you not to disclose the information about it to a health plan for payment or health care operations, you have to agree, unless the disclosure is otherwise required by law, and that restriction cannot be terminated by you on your own 4Ref 4U.S. Department of Health and Human Services (Office for Civil Rights) (2026).45 CFR § 164.522 — Rights to request privacy protection for protected health information.The restriction a clinician can offer in place of destruction: a discretionary restriction on use or disclosure for treatment, payment or health care operations that the covered entity is not required to agree to, and the one restriction that is mandatory, against disclosure to a health plan where the item or service was paid for in full out of pocket, which the covered entity also cannot terminate on its own.. A client paying cash for a course of therapy so that it never reaches their insurer can have that in writing.

Access is the half clinicians forget to offer. A client has the right to inspect and obtain a copy of protected health information about them in a designated record set, with psychotherapy notes carved out of that right, and the clock to act on the request is 30 days with one extension of no more than 30 more 5Ref 5U.S. Department of Health and Human Services (2026).45 CFR 164.524 - Access of individuals to protected health information.The client's right to inspect and obtain a copy of protected health information in a designated record set, the psychotherapy-notes carve-out from that right, and the 30-day action clock with one extension of no more than 30 days. Cited as the access option a clinician can offer immediately.. Some clients asking for destruction have never read the file. Sending the copy first changes what the rest of the conversation is about.

Ask what the client is trying to keep the record away from

Most destruction requests are aimed at a person rather than at the file. A client who has just been asked for records by a court, an employer or an agency asks for deletion because deletion is the only remedy they have a word for. Find the requester first. Once you know who's asking for the therapy record, a restriction, a narrowed authorization or a plain account of what you would and would not disclose usually answers the worry underneath.

The common ones are recognisable. Employer attendance confirmations, CPS requests without a subpoena, and a records demand in the middle of a custody matter each run on their own rules, and none is disposed of by destroying a chart. A record you no longer hold is also not a record that never existed, and its absence at the wrong moment reads badly for both of you.

But some of what a client wants kept out of the chart never has to enter it.

That is a prospective question and a different one: the mandatory progress note contents your board and your payers require are narrower than everything a session contains, and the time to work out where a disclosure sits is before the note is written. A client who is leaving a group practice or an app raises the same worry from the other end, and the platform exit carries its own question about who holds the file afterwards.

When the retention floor runs out

Destruction becomes available once your state's retention period has run, and it stays a judgment rather than an automatic step. The ACA Code of Ethics instructs counselors to maintain records in accordance with federal and state laws and statutes such as licensure laws, and to deliberate carefully before destroying records that may be needed by a court of law 6Ref 6American Counseling Association (2014).2014 ACA Code of Ethics.The ethics frame for eventual disposal: the instruction to maintain records in accordance with federal and state laws and statutes such as licensure laws, and to deliberate carefully before destroying records that may be needed by a court of law. Cited as an ethics code binding on ACA members and counselors, not as law and not as governing other license types.. Clearing the floor does not settle the question.

That code binds ACA members and counselors as ethics rather than as law, and psychologists, social workers and marriage and family therapists answer to their own associations and their own boards. The operational point survives the differences: write the decision down. A dated line recording that the retention period had expired, what was destroyed, and that no known claim, complaint or proceeding was pending is the only account of the disposal you will ever have.

Two situations keep a file alive past the floor. A pending or reasonably foreseeable complaint, claim or subpoena is the first. The second arrives after a client dies, when who may lawfully request the record changes and the retention question reopens on different terms.

A client who asked you to destroy their file will usually take a smaller and more exact thing once it is offered in writing. Put the retention rule, its citation, and the one or two options you can actually give them into a single letter, and keep a copy of that letter in the chart.