How long to keep medical records: the state schedules that outrank the HIPAA myth

How long must you actually keep a medical record?

There is no single national number, and anyone who quotes you one is guessing. HIPAA sets no medical-record retention period at all 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.That HIPAA's §164.316 six-year retention applies to compliance documentation rather than the clinical chart, and that the Privacy Rule sets patient rights without a medical-record retention period.. Your real obligation is the longest of three separate floors: your state's records statute or licensing-board rule, your payer and Medicaid provider agreements, and the malpractice statute of limitations in your state. Keep the chart until the longest of those has run — then, and only then, destroy it securely.

That framing matters because the floors rarely line up. A state may let a routine adult chart be released a few years after the last visit while a malpractice claim can still be filed for longer, and a payer contract can demand more than either. The controlling period is whichever runs latest, so the calculation is simple to state and easy to get wrong: for each category of patient, work out all three floors and take the maximum.

Do the math once, per category, and write the answer down. Adults, minors, deceased patients, and patients whose care touched a federal payer can carry different periods, so a practice that keeps everything under one blanket rule is either destroying some records too early or storing others long past any obligation — and paying to store risk it no longer needs to hold.

The HIPAA six-year rule is not a records-retention rule

The persistent myth is that HIPAA requires six or seven years of medical records. It does not. The six-year rule lives in the Security Rule at §164.316, and it governs your compliance documentation — your policies and procedures, your risk analysis, your business associate agreements, the written records of the security actions you took — not the clinical chart 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.That HIPAA's §164.316 six-year retention applies to compliance documentation rather than the clinical chart, and that the Privacy Rule sets patient rights without a medical-record retention period.. six years is how long you keep the paperwork that proves you run a compliant practice, measured from creation or from the date it was last in effect, whichever is later.

Conflating the two is how a solo practice ends up either shredding charts too early — because 'the six years are up' — or keeping everything forever out of vague dread. Neither is the rule. The Privacy Rule sets patient rights, minimum-necessary limits, and disclosure permissions; it is silent on how long the record must live 1Ref 1Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.That HIPAA's §164.316 six-year retention applies to compliance documentation rather than the clinical chart, and that the Privacy Rule sets patient rights without a medical-record retention period.. That silence is deliberate: medical-record retention was left to the states, and it is the state schedule, not HIPAA, that tells you when a chart may go.

So when you see 'HIPAA says keep records for six years,' translate it: HIPAA says keep your compliance documents for six years. The chart answers to a different set of rules entirely.

Where your real retention floor actually comes from

Three authorities stack to set your floor, and you take the longest. Professional guidelines give a useful starting reference — the American Psychological Association's record-keeping guidance suggests keeping an adult's record for seven years after the last service, and a minor's longer, always deferring to state law 2Ref 2American Psychological Association (2007).Record Keeping Guidelines.The professional record-keeping norm of roughly seven years after last service for adults and longer for minors, always deferring to state law, used as a starting reference.. A guideline is not the law that binds you, but it is a sane default to anchor against while you confirm the three floors that do bind you.

Your payers add their own terms. Medicare and Medicaid set retention requirements in the provider agreement and program manuals rather than in a single national line — New York providers find their Medicaid terms through the eMedNY portal 3Ref 3New York State Department of Health (2026).eMedNY.That New York Medicaid providers find their program's retention and billing terms through the eMedNY provider portal — an example of a payer floor set by the state program., Florida providers through the Agency for Health Care Administration 4Ref 4Florida Agency for Health Care Administration (2026).Florida Agency for Health Care Administration.That Florida Medicaid providers find their program's retention and billing terms through the Agency for Health Care Administration — showing the payer floor varies by state. — so the period binding a New York practice can differ from the one binding a Florida practice down the interstate. The third floor is your malpractice exposure. A statute of repose is separate from the ordinary statute of limitations: it sets an outer deadline after which no claim may be filed no matter when the injury is discovered, and you generally want the record to outlive it, because the chart is your defense.

Calculate all three for each patient category, take the maximum, and that number — not a remembered rule of thumb — is your retention floor.

Minors: the clock that starts at the age of majority

A pediatric chart is the most common retention mistake, because its clock usually does not start at the last visit. For a minor, most state schedules begin counting when the child reaches the age of majority, then run for a set number of years on top of that. HIPAA itself defers to state law on who controls a minor's record and for how long, treating a parent as the patient's personal representative in most situations while leaving the retention period to the state 5Ref 5HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who controls a minor's or decedent's record, treating parents and executors as personal representatives who may exercise the individual's access rights..

Practically, that means a chart for a patient last seen at age eight can carry a retention obligation stretching well into that person's twenties — far longer than the adult number in the same statute. Apply the adult period to a pediatric record and you may destroy it a decade early, exactly when a claim tied to childhood care could still surface. Read your state's minor-specific clock, and calendar it from the date of birth, not the last visit. The APA's guidance likewise treats minors' records as a longer-retention category, so the professional norm and the legal floor point the same way 2Ref 2American Psychological Association (2007).Record Keeping Guidelines.The professional record-keeping norm of roughly seven years after last service for adults and longer for minors, always deferring to state law, used as a starting reference..

The operational fix is small: tag every pediatric chart with a computed destruction-eligible date based on the majority-plus-years math, and re-check it if your state statute changes. A single mislabeled birthdate is how a compliant schedule quietly authorizes an early shred.

Deceased patients, closing the practice, and the custodian

Retention obligations survive both the patient and the practice. When a patient dies, the record does not become disposable — your state period keeps running from the last date of service, and the executor or personal representative can still exercise the access rights the living patient held 5Ref 5HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who controls a minor's or decedent's record, treating parents and executors as personal representatives who may exercise the individual's access rights.. Purging a decedent's chart on the theory that 'they're gone' is one of the cleaner ways a solo practice creates a records violation out of good intentions.

If you close, retire, or sell the practice, someone must remain the records custodian for the full remaining retention period, and that person should be named in a written agreement before you lock the door. The agreement fixes who holds the records, how a patient or attorney reaches them, who pays for the storage, and how the eventual destruction will happen. This is also where chart ownership becomes concrete: the distinction between who owns the medical record as property and who has a legal right to its contents drives what happens at wind-down — the owner may change hands in a sale, but the retention and access duties travel with the data.

Build the custodian arrangement into any closure or sale plan, not after it. Records that outlive a practice with no named keeper are records no one can produce when a subpoena or a patient request arrives — and the obligation to produce them did not close with the office.

Retention is a floor, not a schedule to purge on

The retention period is the earliest date you may destroy a record, never a command to destroy it that day. Three things freeze the clock and override your routine schedule: a subpoena or court order, an open or reasonably anticipated audit or investigation, and any active or foreseeable litigation. When any of these applies to a record otherwise eligible for destruction, the hold wins and the record stays.

HIPAA draws a sharp line between a court order and a bare subpoena, and the difference changes what you may hand over. A court order authorizes disclosure of exactly what it specifies. A subpoena that is not accompanied by a court order requires satisfactory assurances first — either that the patient was notified and given a chance to object, or that a qualified protective order is in place — before you produce anything 6Ref 6HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That a court order authorizes only the disclosure it specifies while an unaccompanied subpoena requires satisfactory assurances of notice or a protective order before production — the litigation-hold sequencing during a retention period.. Producing a full chart in response to an unaccompanied subpoena, without those assurances, is itself a disclosure problem.

And throughout the entire retention period you still owe the patient access. You cannot shred a chart early to sidestep a records request, and the right of access runs on its own clock — generally within 30 days of the request — regardless of how old the record is 7Ref 7HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That patients keep a right to access their records within 30 days for a reasonable cost-based fee throughout the retention period, so a record cannot be destroyed early to defeat a request and copy fees are capped.. The retention schedule and the access duty are two obligations pointing at the same file; both have to be satisfied before that file can ever leave your control.

Destroy it the way HIPAA requires — and log it

When the longest period has run and no hold applies, destruction itself is a HIPAA obligation, not a free-for-all. Protected health information must be rendered unreadable and unrecoverable — cross-cut shredding or pulverizing for paper, and wiping or physically destroying drives and devices for electronic media. OCR enforces this, including against very small practices; a box of charts left in an open dumpster is a reportable breach, not just sloppy housekeeping 8Ref 8HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR enforces secure-disposal obligations, including against very small practices, so improperly discarded charts are a reportable breach rather than routine housekeeping..

Document every destruction. A certificate or log that records what was destroyed, the date, the method used, and who performed it is what turns 'we shredded it' into a defensible act if anyone ever asks. Keep those logs with your compliance documentation — the destruction record is itself the kind of paper the six-year rule expects you to retain.

• What was destroyed — the record set, patient category, and date range
• When — the destruction date
• How — the method (cross-cut shred, pulverize, media wipe or destruction)
• Who — the person or vendor who did it, and for a vendor, the business associate agreement behind them

Write the schedule down as a standing policy so destruction happens on a routine, calendared cadence rather than in an anxious weekend purge. A written retention-and-destruction schedule turns an ad-hoc judgment call into a repeatable process — and a process is far easier to defend than a memory.

Tools that hold your records — and what a copy costs

Your records rarely live only in your hands. The EHR vendor, the cloud backup, and the billing service that hold PHI on your behalf are business associates who need an agreement in place, and your retention duty follows the data into their systems — including through the format migrations that happen when you switch platforms or convert an old system's files. A conversion that silently drops legacy data breaks the complete, readable record you are obligated to keep, so treat any migration as a records event, verify the old data survived, and keep the source until you have confirmed it.

Two edge cases catch solos. First, some tools that hold health data are not covered entities or business associates at all — a direct-to-consumer wellness app, a vendor outside the treatment relationship — and breaches of that data fall under the FTC's Health Breach Notification Rule rather than HIPAA 9Ref 9Federal Trade Commission (2026).Health Breach Notification Rule.That health data held by non-HIPAA tools and vendors falls under the FTC's Health Breach Notification Rule, so a solo must know which rule reaches which record-holding tool.. Knowing which rule reaches which tool tells you who you would have to notify, and when. Second, when a patient, an attorney, or another provider requests a copy during the retention period, the copy fees you may charge are limited to a reasonable, cost-based amount — the cost of labor and supplies to produce it — not whatever the request is worth to the requester 7Ref 7HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That patients keep a right to access their records within 30 days for a reasonable cost-based fee throughout the retention period, so a record cannot be destroyed early to defeat a request and copy fees are capped..

Inventory where your records actually live, confirm a business associate agreement covers each holder, and re-confirm it after any platform change. The retention schedule you built in the earlier sections only works if you can still reach — and read — the records it governs.