The records custodian: the role every closure plan names

What a records custodian is responsible for

A records custodian is whoever is legally and practically accountable for a set of patient records once the clinician who created them stops managing day-to-day access — the practice closed, the clinician retired or died, or the records simply moved into storage. The job is narrow but exacting: keep the records secure, retain them as long as the law requires, and produce them when a patient, a new treating clinician, or a court validly asks.

HIPAA's own documentation-retention rule, at 45 CFR §164.316, requires covered entities to keep required documentation — policies, authorizations, the accounting-of-disclosures log — for six years from the date it was created or last in effect, whichever is later 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The §164.316 six-year documentation-retention floor and §164.524 access framework the custodian must follow.. That six-year figure is a floor for HIPAA's own paperwork, not the full answer for how long a clinical record itself must survive; state licensing-board rules on clinical-record retention run on a separate, usually longer, clock, and the custodian follows whichever period is longer. The access duty has its own clock too: a patient or their personal representative has the right to inspect or obtain a copy of the designated record set within 30 days of a request, with one permitted 30-day extension if the custodian gives written notice of the delay and its reason 2Ref 2HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The 30-day access timeline and single 30-day extension the custodian must meet when a patient requests records..

• Secure storage — physical or electronic safeguards meeting the same security standard the original practice was required to meet.
• Access requests — logging who asked, what they received, and when, inside the access window.
• Legal process — routing subpoenas and court orders through the same rules that applied before the practice closed, not looser ones.

Why a solo practice needs one named, not assumed

A group practice has partners and staff who absorb the custodian role by default when one clinician leaves. A solo practice has no such backstop — if nothing is written down, the records' fate is whatever the clinician's family, landlord, or estate happens to decide, none of whom have any HIPAA training or duty to the patients whose records they are suddenly holding. Naming a custodian in advance is what turns that scramble into a plan.

This matters most at two moments: when a patient dies during treatment and the chart still has retention and disclosure obligations running, and when the practice itself closes — retirement, relocation, disability, or death of the clinician. A practice-closure plan that never names who takes custody of the records is not really a plan; it is a hope that someone else will figure it out. The custodian arrangement is the specific written piece that closes that gap, and it belongs in the same document as the rest of a solo clinician's professional-ethics obligations on wind-down, not as an afterthought added after the doors are already closed.

Custodian is a different question than chart ownership

Custodian and owner sound like the same role and are not. Chart ownership is about who holds title to the physical or electronic record — generally the practice entity, not the patient. Custodian is about who is physically and legally responsible for that record's security and production once the original practice stops operating day to day. A solo clinician can own the record outright and still need to name someone else as custodian for the period after the practice winds down.

The two questions get confused because they resolve to the same person during active practice — the clinician who owns the record is also its de facto custodian. They separate the moment the clinician stops being reachable: ownership of the record doesn't lapse, but custody has to pass to someone who is actually available to answer a 30-day request. Reading who owns the medical record as a separate question from who has to produce it on request is the first thing that clarifies why a custodian designation is necessary at all.

Who can actually serve as custodian

Three arrangements cover most solo practices, and none require a corporate structure to set up. A covering colleague — another licensed clinician who agrees in writing to hold and produce records for a defined period — works well when the relationship is durable. A commercial medical-records storage vendor handles the mechanics (secure storage, request logging, destruction certificates) for a fee, shifting the operational burden but not the legal accountability. And a designee named in a professional will can be either of the above, formalized as part of a broader succession plan.

APA's practice organization publishes guidance on exactly this kind of practice-closure and professional-will planning for solo and small practices 3Ref 3APA Services, Inc. (2026).Practice — APA Services.That a professional body publishes practice-closure and professional-will planning guidance, used as a template for naming a custodian., and its framework is a reasonable starting template regardless of discipline: name the person, define the period, and specify how patients will be told who to contact.

What the custodian must still honor after the clinician is gone

Naming a custodian doesn't relax any of the underlying privacy obligations — it transfers them. The custodian inherits the same duty to disclose only the minimum necessary, to honor a valid authorization, and to give the same notice-of-privacy-practices protections the original practice provided 4Ref 4HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the custodian inherits the same minimum-necessary and notice obligations the original covered entity carried.. Records for former minor patients carry an extra wrinkle: HIPAA defers to state law on who counts as the personal representative for a minor's or an incapacitated adult's record, and a custodian who releases a minor's chart to the wrong requesting parent has made the same mistake the treating clinician would have made 5Ref 5HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who counts as a minor's personal representative, a rule the custodian must still apply..

This is also where a custodian arrangement most often fails in practice — not through malice, but because whoever inherits a box of charts assumes ordinary document-storage rules apply. They don't. A HIPAA custodian duty follows the record, not the org chart, and it survives the practice that created it.

Put the arrangement in writing before you need it

The custodian designation is only as good as the paper trail behind it: a signed agreement naming the custodian, the retention period they're bound to, and how patients will be notified of the handoff. Pair it with a written retention schedule — write the schedule down once, rather than reconstructing the rule from memory at closure — so the custodian has a single page answering every keep-or-shred question instead of guessing at each record's age. APA's record-keeping guidelines offer a widely used reference point: seven years after the last date of service for adult records, longer for records of minors, always yielding to whatever the clinician's state sets as the floor 6Ref 6American Psychological Association (2007).Record Keeping Guidelines.The seven-years-after-last-service retention norm for adult records, longer for minors, always deferring to state law..

Storage after the practice closes is the other half of the arrangement worth deciding now rather than later — where the boxes or the encrypted drive physically live, and who pays for it, matters as much as who is legally named custodian. A one-page custodian and retention memo, reviewed whenever the clinician's practice circumstances change, is cheaper than any dispute over an unanswered records request six years from now.