The carrier's longer clock: repose statutes and tail exposure

Why your carrier's number is bigger than the legal minimum

HIPAA's own documentation-retention floor runs six years from creation or last effective date 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The six-year HIPAA documentation retention floor, contrasted against the separate and typically longer clock malpractice exposure requires. — a privacy-and-security requirement, not a malpractice-defense one. Your malpractice carrier's recommended retention period is built on an entirely different question: how long could a claim against you still be filed, and do you have the record to defend it when it is.

That's why a carrier's guidance routinely exceeds both the HIPAA floor and whatever your state sets as a bare licensure minimum. The carrier isn't asking what the law requires you to keep; it's asking how long its own actuarial experience says claims can still surface — a business question about risk, not a compliance question about a regulatory floor.

Statutes of limitations vs. statutes of repose — the distinction that matters

A statute of limitations typically starts running when harm is discovered or reasonably should have been, which already creates uncertainty about when the clock actually began. A statute of repose is different and stricter: it's an outer deadline that can run from the act or omission itself, closing the door to a claim after a fixed period regardless of when — or whether — the patient ever discovers the harm.

This distinction is why "keep records for the limitations period" understates the real exposure. A carrier thinking in terms of repose is thinking about the record you'd need to defend a claim filed at the very edge of that outer window, which is a materially longer horizon than a discovery-based limitations clock alone suggests.

Why minors reset the clock entirely

Record-keeping guidelines for behavioral health commonly recommend a longer retention period for minors than for adults — beyond the guideline example of roughly seven years after last service for an adult — precisely because a minor's limitations period frequently doesn't start running until they reach the age of majority, always deferring to the specific state's rule 2Ref 2American Psychological Association (2007).Record Keeping Guidelines.The retention-norm example of roughly seven years after last service for adults, longer for minors, always deferring to the reader's specific state rule.. A claim tied to pediatric or adolescent treatment can surface many years after the encounter itself.

If your practice ever saw minors, even occasionally, build that extension into your retention schedule as its own line rather than applying your adult-patient retention period across the board — that single exception is where a carrier's advice and a licensure minimum diverge most sharply.

Tail exposure: what happens to old claims when you leave a carrier

Most malpractice policies are written on a claims-made basis, which only covers a claim reported while the policy is active — so switching carriers, retiring, or closing a practice can leave a gap where an incident that happened under an old policy generates a claim after that policy has lapsed. Tail coverage, or the new carrier's acceptance of prior acts, is what closes that gap.

tail triggers covers exactly when that decision has to be made. What matters for retention is that the records supporting an encounter from years ago need to survive as long as that tail exposure runs — often well past the point you assumed the matter was closed.

A common convention among solo practices closing or transitioning coverage is treating the tail decision and the records-destruction decision as the same conversation rather than two separate ones — since retiring records before the tail period ends defeats the purpose of having bought the tail coverage in the first place. Ask the question at the same time you're comparing tail-coverage quotes, not months afterward.

The record a deposition or suit actually asks for, years later

HIPAA distinguishes a court order, which authorizes disclosure of only what it specifies, from a bare subpoena without a court order, which requires satisfactory assurances of notice to the patient or a protective order before you respond 3Ref 3HHS Office for Civil Rights (2026).Court Orders and Subpoenas.The distinction between a court order and a bare subpoena for records disclosure, relevant to how a malpractice suit filed near a repose deadline demands records years later.. A malpractice suit filed near the outer edge of a repose period will typically demand the full chart, your billing records, and often a deposition — and the deposition is where thin or missing documentation becomes visible fastest.

the deposition walks through what a treating provider should expect and prepare for. None of that preparation helps if the underlying record was already destroyed on a schedule set to the legal minimum rather than to your actual claims exposure.

Why 'the state minimum' undersells the real exposure

A state's licensure board typically sets a records-retention minimum aimed at continuity of care and board oversight, not at the outer edge of malpractice litigation risk — the two numbers were written to answer different questions and there's no reason they'd happen to match. Treating the board minimum as sufficient malpractice protection conflates a licensing requirement with a litigation one.

Your carrier's recommendation is the number built from its own claims history — how long after treatment its claims have actually been filed across its book of business — which is a more direct measure of your real exposure than a licensure statute ever was.

That's also why two solo clinicians in the same state, same specialty, can get different retention advice from two different carriers: the number reflects each carrier's own claims data and risk appetite, not a single shared legal standard both are reading off the same statute.

Setting a retention period that satisfies both law and your carrier

Retain records for at least the longest of: your state's licensure-board minimum, your malpractice carrier's recommended period, and the extended clock for any minors you've treated — never the shortest of the three. Ask your carrier directly for its recommended number in writing rather than assuming a generic industry figure applies to your specialty and state.

buying malpractice coverage is a natural moment to ask that question, since you're already discussing policy terms with the carrier. Get the answer in writing and file it with your retention schedule, so the number driving your practice's actual retention decision isn't a guess reconstructed from memory.