Storage after the practice: options, costs, access duties

What does long-term record storage cost and require?

There is no federally set price and no single mandated method — HIPAA cares about the outcome, not the storage medium. The record has to remain secure and retrievable, and a patient's right-of-access request still has to get a response within 30 days (one 30-day extension available), in the form and format requested where producible 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The Security and Privacy Rule safeguards, including business associate provisions, that continue to apply to a record's storage after a practice closes., for as long as your applicable retention period runs 2Ref 2HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The 30-day right-of-access response duty, which continues to apply to archived or long-term-stored records.. Paper boxes at a commercial records-storage vendor, a locked on-site archive, and a cloud-hosted EHR archive can all satisfy that standard.

What changes between options is convenience, ongoing cost, and how quickly you can actually produce a record when a request arrives — not whether the underlying legal duty applies.

The common storage paths, compared honestly

A commercial records-storage vendor typically charges a recurring per-box or per-volume fee and handles physical security and sometimes retrieval logistics for you, which trades ongoing cost for reduced hassle. A self-managed locked storage unit is usually the cheapest option up front, but it puts the security burden — climate control, access control, fire risk — entirely on you, with no vendor safeguards built in. A cloud-hosted EHR archive folds storage into a subscription and can make retrieval fastest, but it depends on the vendor remaining in business and your archive remaining exportable years later.

There is no single right answer among the three; the right one depends on your volume, how often you expect a request, and how much ongoing administration you're willing to own personally.

A hybrid approach is common in practice — recent, more likely-to-be-requested charts stay in an actively accessible archive, while older records past the point of routine relevance move to lower-cost, slower-retrieval storage. Just make sure "slower retrieval" never crosses into "cannot meet the 30-day access deadline," since that timeline doesn't bend for storage convenience.

Security duties don't pause because the practice closed

An inactive or archived record is still protected health information, and the Security and Privacy Rule safeguards that applied while your practice was operating continue to apply to however you store it afterward 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The Security and Privacy Rule safeguards, including business associate provisions, that continue to apply to a record's storage after a practice closes.. That means access controls, a way to detect and respond to a security incident, and — if a vendor is holding the archive and handling PHI on your behalf — a business associate arrangement that satisfies the same rule.

A storage decision made purely on price, with security as an afterthought, is the version of this that produces a breach years after the practice itself stopped seeing patients. Ask any vendor directly how they secure the archive and who is notified if something goes wrong.

The custodian arrangement: who answers a request years later

Storage without a named person responsible for it is not a real storage plan — someone has to be the records custodian who receives and processes requests once the practice is no longer operating day to day. The custodian arrangement should specify, in writing, who that is, how they're reachable years into the future, and what happens if that person becomes unavailable themselves.

This is the piece solo practices skip most often, because it feels unnecessary while you're still actively practicing. It becomes urgent the day a patient, an attorney, or a licensing board tries to reach a records custodian and finds no one designated at all.

Name a backup custodian too, not just a primary one. A single point of failure in the custodian role defeats the purpose of planning for a future you can't fully predict — illness, relocation, or simply losing touch with the arrangement over enough years.

Retention length still sets how long you're paying for this

Storage is not indefinite — your retention schedule determines when a given record can be destroyed, and that schedule should drive your storage budget rather than the other way around. A minor's chart typically needs the longest storage window, since most states measure the clock from the age of majority rather than the date of last service, which can mean well over a decade of storage for a single pediatric or adolescent record 3Ref 3HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on minors' records, relevant to why a minor's chart typically requires the longest storage window..

Build destruction dates into your storage plan from day one — a system that only stores and never destroys accumulates cost indefinitely and creates more data than any retention rule actually requires you to keep. The same custodian who answers requests should also be the one tracking which records have reached their destruction date.

If a vendor holds the archive, know which rule actually covers them

Not every storage or backup tool you might reach for is automatically inside HIPAA's reach, and that gap matters for long-term archives specifically. A vendor that creates, receives, maintains, or transmits PHI on your behalf as part of a genuine health-records storage service is a business associate under the Security and Privacy Rule 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The Security and Privacy Rule safeguards, including business associate provisions, that continue to apply to a record's storage after a practice closes.. A general-purpose cloud storage or backup product that was never built for PHI may instead fall under the FTC's Health Breach Notification Rule, which covers health data held by tools outside HIPAA's own reach 4Ref 4Federal Trade Commission (2026).Health Breach Notification Rule.That the FTC's Health Breach Notification Rule covers health data held by non-HIPAA storage or backup tools outside HIPAA's reach..

Before you park years of patient records with any vendor, confirm which rule actually applies to them — the answer changes what breach-notification obligations exist if their systems are ever compromised.

Before you sign a storage contract: a short checklist

Settle four things before committing years of records to any storage arrangement: the named custodian and a backup contact, the retention and destruction dates for what's being stored, how quickly the vendor can produce a record when a request arrives, and what happens to the archive if the vendor itself closes or you stop paying. Professional practice-management guidance on closing a practice treats this kind of advance planning as standard, not exceptional 5Ref 5APA Services, Inc. (2026).Practice — APA Services.That APA's practice organization publishes practice-management guidance including closing a practice, supporting advance-planning norms for storage decisions..

Disposition planning belongs in the same conversation as storage, not a separate one held later — deciding now how records will eventually be destroyed is part of choosing where they'll live in the meantime 2Ref 2HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The 30-day right-of-access response duty, which continues to apply to archived or long-term-stored records.. This is a different problem from figuring out where records go when you're merely leaving employment at a group that keeps operating; here, no one is left running the practice at all.