How Long Should Medical Practices Keep Patient Medical Records?

Medical Answer

There is no single medical-record retention period that applies to every medical practice in every state. How long you need to keep a patient’s records can depend on state law, the type of healthcare provider, the patient’s age, the type of record, government-program requirements, accreditation requirements, payer contracts, and other legal considerations.

One particularly important distinction is that the commonly cited HIPAA six-year rule should not be treated as a universal requirement to retain every patient’s clinical medical record for six years. HIPAA requires certain documentation related to HIPAA compliance to be maintained for six years, while state law typically plays a major role in determining how long clinical medical records must be retained.

For many practices, it may also be prudent to consider a 10-year retention period because certain False Claims Act allegations can potentially involve conduct occurring as much as 10 years earlier. However, 10 years is not a universal rule either. If another applicable requirement calls for longer retention, your practice should follow the longer period.

Does HIPAA Require Medical Records to Be Kept for Six Years?

This is one of the most common misconceptions in medical-record management.

You may hear: “HIPAA requires medical records to be kept for six years.” That’s too broad.

HIPAA does contain a six-year retention requirement for certain documentation required under the HIPAA rules. However, that doesn’t mean HIPAA establishes a universal six-year retention period for every clinical medical record maintained by a physician practice.

Determining how long to maintain the actual patient chart generally requires looking at: State Law + Other Applicable Federal Requirements + Patient Age + Record Type + Contractual Requirements

So don’t build your entire retention policy around, HIPAA is 6 years.

Start With Your State’s Medical Record Requirements

State law is one of the most important places to start. Retention periods vary considerably between states.

One state may require physicians to maintain records for a certain number of years after the last patient encounter, while another may use a different period or trigger.

Requirements may also differ between individual physician and hospitals or other healthcare facilities.  That’s why copying another practice’s retention policy can be risky.

The right question isn’t how long doctors keep records, it’s what retention requirements applies to our type of provider in our state.

Provider Type Can Change the Requirement

Don’t assume every healthcare organization in your state follows the same rule. State laws may establish different requirements for:

• Physicians
• Hospitals
• Clinics
• Ambulatory facilities
• Other licensed healthcare entities

When researching a retention requirement, verify that it actually applies to your organization. A rule written for hospitals may not necessarily establish the requirement for an independent physician practice.

Minor Patient Records Require Special Attention

Records involving children can create some of the longest retention periods.

Depending on state requirements, you may need to keep a minor’s record until the patient reaches a certain age or for a certain number of years after reaching the age of majority. That means a standard 10-year destruction rule may not work for every patient.

Your retention process needs to identify: Minor Patient → Special Rule → Correct Destruction Date

Don’t rely on staff to remember this manually. Build it into your retention schedule.

Different Record Types May Have Different Requirements

Another common mistake is assuming One Patient = One Retention Date. Different records may have different requirements. Depending on your practice and jurisdiction, you may need to separately evaluate:

• Clinical records
• X-rays
• Diagnostic images
• Immunization records
• Billing records
• HIPAA-required documentation
• Business records
• Employee health and safety records

That means your retention schedule should be record specific and not simply patient specific.

Why Should Medical Practices Consider Keeping Records for 10 Years?

Medical records don’t just support ongoing patient care. They can also become essential evidence years later.

The federal False Claims Act contains limitation periods that can potentially allow certain allegations involving conduct occurring as much as 10 years earlier. For a medical practice, that creates a practical question: If a Claim From Years Ago Is Challenged, Will We Still Have the Documentation to Defend It?

Medical records may help establish:

• Medical necessity
• Services actually performed
• Clinical decision-making
• Diagnoses supporting treatment
• Documentation supporting billed services

If you destroyed those records too soon, you may have lost some of the strongest evidence available to your practice.

Think of Retention as a Defense Strategy

Imagine your practice provides a service today. The physician clearly documents clinical finding, medical necessity, treatment, and service performed. Eight or nine years later, that claim becomes part of a reimbursement investigation.

If the record still exists, you may be able to show exactly why the service was provides and why the claim was submitted. Without the documentation, you’re trying to reconstruct an encounter that happened nearly a decade ago.

That’s one reason a practice may decide that 10 Years is an appropriate baseline when no longer requirement applies.

But Don’t Turn 10 Years Into Another Universal Rule

Replacing: “HIPAA Says Six Years” with: “Everyone Must Keep Records 10 Years” creates the same problem.

There is no universal 10-year rule for every patient record. Your state might require 11 or 12 years or another period for particular providers or record types. Records for minors may need to be retained longer as well. A more defensible policy is 10 years or the longest applicable requirement, whichever is longer if your organization chooses a 10-year baseline.

Check Payer and Government Program Requirements

State law isn’t your only consideration. You also need to consider how long your payer agreements require you to make records available for an audit. Government-program participation requirements may also affect how long documentation should remain available. Depending on your practice, review:

• Medicare requirements
• Medicaid requirements
• Managed-care contracts
• Commercial payer agreements
• Other government healthcare programs

Your retention policy should account for your organization’s actual participation and contracts.

Accreditation Requirements May Matter Too

If your organization is accredited or certified, additional requirements may apply. That creates another comparison: State Law + Federal Requirements + Payer Requirements + Accreditation Requirements

You don’t want to discover after destroying records that another applicable requirement called for longer retention.

Use the Longest Applicable Requirement

Operationally, multiple retention periods can become difficult to manage. Suppose your analysis shows:

• State Requirement = 7 Years
• Practice Risk-Management Policy = 10 Years
• Certain Minor Records = Longer Than 10 Years

The safest destruction date is not the earliest date. It’s the point at which every applicable retention requirement has been satisfied. That’s why many practices benefit from adopting a longer common retention period while maintaining exceptions for records that require even longer retention.

Why Not Just Keep Everything Forever?

It sounds simple: “If We Never Destroy Anything, We Can Never Destroy It Too Early.”

But indefinite retention creates its own problems. Every record you retain creates more:

• Protected health information to safeguard
• Data potentially exposed during a breach
• Storage to manage
• Information to retrieve
• Systems that must remain accessible

The better objective is keep what you need for as long as required and then securely destroy it when it is truly eligible. Retention should be intentional. So should destruction.

Create a Written Medical Record Retention Schedule

Don’t expect employees to remember different retention rules. Build a schedule.

For every major record category, identify:

Record Type	Retention Period	Retention Trigger	Authority/Reason	Destruction Method
Adult Medical Record	Practice-specific	Last encounter or applicable trigger	State law + policy	Approved method
Minor Medical Record	Practice-specific	Age/last encounter	State law	Approved method
Diagnostic Images	Practice-specific	Applicable trigger	State requirement/policy	Approved method
HIPAA Documentation	Applicable period	Creation/last effective date	HIPAA	Approved method

Add the applicable legal or regulatory authority whenever possible.  That makes future policy reviews much easier. Instead of asking why 10 years was chosen, you can immediately see the reason.

Make Sure You Define the Retention Trigger

A policy saying retain for 10 years is incomplete. You also need to know – 10 years from when?

The trigger might be:

• Last patient encounter
• Date of creation
• Date of discharge
• Date of final treatment
• Patient’s age of majority
• Another event established by the applicable requirement

The trigger can be just as important as the number of years.

Don’t Forget Records Outside Your Current EHR

Your retention policy should account for everywhere patient information lives. That may include:

• Current EHR
• Archived EHR
• Paper files
• Scanned records
• Imaging system
• Laboratory platform
• Diagnostic systems
• Cloud storage
• Offsite storage
• Vendor systems

A record doesn’t satisfy your retention obligations merely because its still somewhere. Your practice needs to be able to retrieve it.

What Happens When You Change EHRs?

This is a major medical-record retention vulnerability. When changing vendors, don’t focus only on migrating current patients, ask what happens to historical records. Before terminating an EHR contract, determine:

• How historical records will be retained
• Whether they can be exported
• What format they will be in
• Whether they remain readable
• How staff will retrieve them
• Who pays for continued access
• How long the vendor keeps backups
• What happens when the contract ends

A record you cannot retrieve may be of very little value when you need it.

Can You Destroy Paper Records After Scanning Them?

Potentially, but don’t use just scan & shred quality control. Before destroying the paper version, verify that the electronic copy is complete, legible, accessible, and reproducible. Your practice should have a defined scanning and validation process. That might include confirming:

• Every page was scanned
• Images are readable
• Documents are attached to the correct patient
• Records can be retrieved
• Required metadata is preserved

Only then should the original paper record move into the approved destruction process, assuming no requirement mandates that the original be retained.

Never Destroy Records Subject to a Hold

Even when your retention schedule says eligible for destruction stop if the record is relevant to:

• Pending litigation
• Reasonably anticipated litigation
• Government investigation
• Payer audit
• Subpoena
• Regulatory inquiry
• Other preservation requirement

Your normal destruction policy may need to be suspended. Build a “hold check” into every destruction workflow.

What About Records for a Patient Who Has Died?

Don’t assume that if patient died, you can destroy their records. Your normal retention requirements still need to be evaluated. State laws may also contain special requirements affecting deceased-patient records.

HIPAA also continues to protect a deceased individual’s protected health information for 50 years following the individual’s death. The patient’s death therefore shouldn’t be used as your destruction trigger unless an applicable law or policy specifically establishes how retention should be calculated.

Don’t Forget the Destruction Side of the Policy

A complete retention policy shouldn’t stop with keep it for X years. It should also explain what happens when X years have passed. Before destruction:

• Retention Requirement Satisfied?
• Special Rule Satisfied?
• No Hold?
• No Audit or Investigation?
• Authorized for Destruction?

Then: Secure Destruction → Document Destruction

A destruction log can help demonstrate that records weren’t simply lost or discarded randomly.

Use the LONGEST Test before assigning a medical-record destruction date:

L — LAW: What does your state require?

O — OTHER FEDERAL REQUIREMENTS: Are additional federal rules relevant?

N — NEED FOR DEFENSE: Could the documentation be needed to defend billing or other claims?

G — GROUP: Is the patient part of a special group, such as a minor?

E — EXTERNAL REQUIREMENTS: Do payer, contractual, accreditation, or program requirements apply?

S — SPECIAL RECORD TYPE: Does this particular record have its own requirement?

T — TAKE THE LONGEST APPLICABLE PERIOD: Don’t destroy the record until every applicable requirement has been satisfied.

And then perform one final check – Is there a hold? If yes, don’t destroy.

Real Practice Example

A physician practice has followed the same rule for years, destroy patient records after six years. Management believes that’s required by HIPAA. Before the practice’s next annual destruction cycle, the administrator reviews the policy.

She discovers that:

• The HIPAA six-year requirement isn’t a universal clinical medical-record retention rule.
• State requirements need to be reviewed separately.
• Minor patients may need longer retention.
• Certain records have different requirements.
• Longer retention may help protect the practice if old claims are questioned.
• Historical records exist outside the current EHR.
• Nobody checks for litigation or audit holds before destruction.

The practice replaces its one-line policy with: Record Inventory → Legal Requirement → Retention Trigger → Final Retention Period → Hold Check → Authorized Destruction → Destruction Log

Now the practice doesn’t just know how long, it knows why.

Does HIPAA Require All Medical Records to Be Kept for Six Years?

No. HIPAA requires certain documentation associated with compliance with its rules to be retained for six years, but that shouldn’t be interpreted as a universal six-year clinical medical-record retention requirement.

Your practice should review applicable state and other requirements to determine how long patient records need to be maintained.

Should Medical Practices Keep Medical Records for 10 Years?

A 10-year baseline can be worth considering because documentation may be needed years later to defend billing, medical necessity, or False Claims Act allegations.

However, 10 years isn’t a universal legal requirement for every medical record. If another applicable requirement calls for longer retention, follow the longer period.

Do Minor Patient Records Need to Be Kept Longer?

Often. State laws frequently establish special retention rules for minors. Those rules may extend retention until a certain age or for a specified period after the patient reaches the age of majority.

Can We Destroy Records When a Patient Dies?

Don’t assume so. A patient’s death does not automatically eliminate the practice’s retention obligations. Follow your retention schedule and applicable state and federal requirements.

Should We Keep Patient Records Forever?

Generally, your practice should establish an intentional retention and destruction policy rather than keeping PHI indefinitely without a defined reason.

Once every applicable retention requirement has been satisfied and no preservation obligation exists, eligible records should be securely destroyed according to policy.

Medical Record Retention Checklist

Determine the Retention Period

☐ Identify the record type
☐ Identify the provider/entity type
☐ Verify current state requirements
☐ Check applicable federal requirements
☐ Determine whether the patient is a minor
☐ Check special-population requirements
☐ Review payer and program requirements
☐ Review accreditation requirements if applicable
☐ Consider potential defense needs
☐ Select the longest applicable retention period

Build Your Retention Schedule

☐ Record category
☐ Retention period
☐ Trigger date
☐ Legal/regulatory authority or business reason
☐ Storage location
☐ Responsible department
☐ Approved destruction method

Before Destroying Records

☐ Retention period expired
☐ State requirements satisfied
☐ Federal requirements satisfied
☐ Special-record requirements satisfied
☐ No litigation hold
☐ No audit or investigation hold
☐ No subpoena or other preservation requirement
☐ Destruction authorized
☐ Destruction documented

Bottom Line

There is no single medical-record retention period that every medical practice should automatically apply to every patient record.

Don’t use: HIPAA = 6 Years → Destroy

And don’t replace it with: Everything = 10 Years → Destroy

Instead: Identify the Record → Check State Requirements → Check Federal and Program Requirements → Consider Patient Age → Review Special Requirements → Consider Defense Needs → Use the Longest Applicable Period → Check for Holds → Destroy Securely

A 10-year baseline may be worth considering from a risk-management perspective, but state laws, records involving minors, and other obligations may require considerably longer retention.

Your most important tool isn’t a magic number. It’s a current, written, record-specific retention schedule.

Key Takeaways

• There is no universal medical-record retention period for every physician practice.
• Don’t automatically use six years simply because of HIPAA.
• State law is a critical part of determining how long clinical records must be retained.
• Retention requirements can differ by provider type.
• Records for minors frequently require longer retention.
• Certain record types may have their own retention periods.
• Payer, program, accreditation, and contractual requirements may also affect retention.
• False Claims Act exposure is one reason a practice may consider a 10-year retention period.
• If another requirement exceeds 10 years, follow the longer requirement.
• A patient’s death does not automatically make the record eligible for destruction.
• Your practice should maintain a written, record-specific retention schedule.
• Never destroy records subject to litigation, an audit, investigation, subpoena, or other preservation obligation.

Get More Practical Medical Records Guidance With an All-Access Pass Medical-record retention can quickly become complicated when state requirements, HIPAA documentation, minor patients, billing risks, electronic storage, record access, and destruction requirements overlap. With a Healthcare Training Leader All-Access Pass, your entire team gets access to expert-led training covering medical records, HIPAA, compliance, billing, coding, reimbursement, practice management, credentialing, front desk operations, HR, and other challenges affecting medical practices. Give your team practical guidance they can use to build stronger record-retention procedures, protect patient information, respond to record requests more confidently, reduce compliance risk, and avoid destroying documentation your practice may still need. Why Trust Healthcare Training Leader? Healthcare Training Leader has helped more than 68,000 healthcare professionals at 10,000+ practices strengthen their skills and tackle the operational, financial, and compliance challenges they face every day. Medical-record requirements can involve multiple state and federal rules, different record types, special patient populations, and significant operational decisions. Our expert-led training focuses on turning complicated healthcare practice issues into clear, actionable guidance your team can put to work.