How Long Do You Have to Keep HIPAA Records?
Understanding HIPAA Records Retention
HIPAA's Privacy Rule requires covered entities and business associates to maintain medical records, but it doesn't explicitly specify how long. The regulation states records must be kept for at least 6 years from their creation or last use. However, this is a baseline requirement—most healthcare organizations must comply with stricter state laws.
Federal Baseline (HIPAA Minimum)
Under 45 CFR § 164.530(j), HIPAA-covered entities must:
- Maintain records for at least 6 years from creation or last use
- Keep administrative, physical, and technical safeguards documentation for the same period
- Retain audit controls and access logs for accountability purposes
State-Specific Requirements (Often Longer)
Most states have their own medical records retention laws that exceed HIPAA's 6-year minimum:
| State Requirement | Typical Duration | Examples |
|---|---|---|
| Adult Patient Records | 7-10 years | California (7), New York (6), Florida (5) |
| Pediatric Records | Age 21 + 6-7 years | Most states extend past age of majority |
| Specialized Care | 10-30 years | Mental health, substance abuse, cancer |
Records You Must Keep
- Medical records: Patient charts, progress notes, lab results, imaging reports
- Administrative records: Billing records, correspondence, consents
- Compliance documentation: Risk assessments, policies, training logs, breach notifications
- Technical records: Audit logs, access controls, system changes
Special Retention Scenarios
1. Pediatric Records
Records for minors must be kept longer. The general rule: retain for 6-7 years after the patient turns 18-21 (depending on state). Some states require records to be kept until the patient is 25-30. Always verify your state's specific age threshold.
2. Mental Health & Behavioral Records
Many states require longer retention for psychiatric, substance abuse, and behavioral health records—often 10-15 years or longer. Check your state's mental health licensing board requirements.
3. Cancer Registry & Oncology Records
Oncology practices often must retain records for the patient's lifetime or a minimum of 10-20 years due to cancer registry requirements and follow-up care needs.
4. Workers' Compensation Records
Federal OSHA requires occupational health records be kept for 30 years past last employee exposure. This supersedes HIPAA's 6-year minimum.
5. Deceased Patients
Records for deceased patients are still protected under HIPAA. Generally keep for 6 years from last use, or as required by state law. Some states require indefinite retention.
Frequently Asked Questions
Destroying records prematurely can result in significant penalties:
- OCR civil fines: up to $100-$50,000 per violation
- Failure to produce records for litigation creates adverse legal consequences
- Potential loss of licensure or practice privileges
- In litigation, premature destruction can result in sanctions
Always maintain a documented records retention schedule and follow it consistently.
Yes, but follow specific guidelines:
- Ensure the electronic copy is a true, accurate representation of the original
- Verify all images are legible and complete
- Maintain a certified statement that the electronic version is the official record
- Securely destroy original paper records (shredding, incineration, or certified destruction service)
- Keep the certification document for audit purposes
Many practices use third-party scanning services to handle this conversion compliantly.
Yes—HIPAA's legal hold requirement applies:
- Once litigation is anticipated or threatened, do not destroy any potentially relevant records
- This "litigation hold" supersedes normal retention schedules
- Failure to preserve records can result in sanctions, default judgments, or significant penalties
- Continue the hold until the litigation is fully resolved
Your legal counsel should be notified immediately when potential litigation is foreseeable.
These are separate obligations:
- HIPAA: Privacy and security of patient information (6-year minimum)
- State Medical Board: Often requires longer retention (7-10 years) for licensure compliance
- Solution: Follow the LONGER requirement—typically your state's medical board rule
Exceeding HIPAA's minimum to meet state law is the safest approach.
Create and maintain a written retention policy that includes:
- Specific retention periods for each record type
- Reference to applicable state and federal laws
- Destruction methods (shredding, incineration, certified disposal)
- Destruction logs with dates and personnel responsible
- Legal hold procedures for active litigation
- Exceptions for minors, mental health, and specialty care
Have this policy reviewed by your legal counsel and include it in OCR compliance documentation.
Not Sure About Your Records Retention Obligations?
Medcurity helps healthcare organizations implement compliant records retention policies. Our HIPAA specialists can audit your current practices and ensure you meet all federal and state requirements.
Schedule a Compliance Review