Ask this question in any practice manager forum and you will get the same confident answer: "HIPAA requires six years." That answer is wrong in a specific and expensive way. HIPAA does require six years, but not for patient charts. The six-year clock covers your compliance paperwork. Your charts are governed by a different set of rules entirely, and those rules come from your state.
This article separates the two clocks, shows what each one actually covers, and gives you a starting table for state retention periods, with one warning repeated on purpose: verify your own state before you shred anything.
Medical Record Retention: The Two Clocks That Get Confused
Clock One: HIPAA's Six Years (Compliance Documents)
The HIPAA Privacy Rule, at 45 CFR 164.530(j)(2), requires a covered entity to retain required documentation "for six years from the date of its creation or the date when it last was in effect, whichever is later."
Read the "whichever is later" part twice, because it matters. A policy adopted in 2015 and retired in 2024 must be kept until 2030: six years from when it was last in effect, not from when it was written.
What counts as required documentation: your written policies and procedures, your Notice of Privacy Practices and its acknowledgments, risk assessments, training records, sanction records, B.A.A.s (Business Associate Agreements), breach documentation, and patient authorizations. The full inventory is in the HIPAA documentation requirements article.
Notice what is not on that list: the medical record itself. HHS has stated plainly that the Privacy Rule does not include medical record retention requirements. Federal HIPAA has no opinion on how long the chart lives; that question belongs to state law.
Clock Two: State Law (The Chart Itself)
Chart retention comes from state statutes, medical board regulations, and hospital licensing rules. The periods vary by state, by provider type, and by patient age. A few examples of the ranges you will encounter:
| State | Commonly cited period (adult patients, physicians) | Where it comes from |
|---|---|---|
| New York | 6 years from last visit | Education Law and Board rules |
| Florida | 5 years from last contact | Board of Medicine rule |
| Texas | 7 years from last treatment | Texas Medical Board rule |
| California | No physician-specific statute; the C.M.A. (California Medical Association) recommends at least 10 years (hospital records: 7 by statute) | CMA guidance; hospital licensing law |
Treat this table as a starting point, not an answer. Every row needs to be checked against your own board's current rule before it becomes your policy. The state-specific compliance articles for New York, Florida, Texas, and California cover more of each state's landscape.
Minors Extend Everything
Nearly every state extends retention for minors: typically some period past the age of majority, which can put a pediatric chart's destruction date twenty-plus years after the visit. If you treat children, your retention schedule needs a separate minors row. This is the single most common gap in the retention policies we review.
The Other Clocks: Medicare, Malpractice, and Payers
Three more timers can outrun your state minimum. Federal program participation carries its own document retention conditions. Your malpractice carrier and your state's statute of limitations effectively set a floor, because a destroyed chart is a lost defense. And payer contracts routinely require records be available for audit for a stated period. Your policy follows the longest applicable clock, always.
Destruction Is Part of Retention
A retention schedule ends in destruction, and destruction has its own HIPAA requirement: P.H.I. (Protected Health Information) must be rendered unreadable and unreconstructable. Shredding for paper, sanitization or physical destruction for drives and devices. The specifics, including the copier-hard-drive problem, are in the physical safeguards article. Keep a destruction log: what was destroyed, when, how, and by whom. When a records request arrives for a chart you lawfully destroyed, the log is your answer.
The One-Page Policy That Settles This
Most practices do not have a retention problem. They have a retention question that gets re-argued every time someone wants to clear a storage room. The fix is a one-page schedule: each record type, its clock, the trigger date, and the destruction method. Write it once, check it against your state, and the argument is over. Our policy template library includes a retention and destruction template built for exactly this.
---
FAQ
Does HIPAA require keeping medical records for six years?
No. HIPAA's six-year rule at 45 CFR 164.530(j) covers compliance documentation: policies, training records, BAAs, authorizations. Retention of the medical record itself is set by state law.
How long should a practice keep records for minors?
Longer than for adults. Most states extend retention until some period after the patient reaches the age of majority. Check your state board's specific rule; pediatric charts often must be kept 20 or more years.
Can we destroy paper charts after scanning them?
Generally yes, if the scanned copy is complete, legible, and retained for the full period, and the paper is destroyed by shredding or another method that makes PHI unreadable. Verify your state and payer contracts do not require original retention.
What happens to records when a practice closes?
The records must remain available for the remainder of the retention period. States commonly require notifying patients and arranging a custodian. Closing a practice does not end the retention obligation.
Is there a federal medical record retention law?
Not a general one. The HIPAA Privacy Rule contains no medical record retention requirement; its six-year clock at 45 CFR 164.530(j) covers compliance documentation only. The chart's baseline period comes from state law.
Conclusion
A retention schedule is one page: record type, clock, trigger date, destruction method. It is also one of the first documents One Guy Consulting builds with a new client, because it settles a dozen future arguments at once. The Full-Scope plan includes the policy templates and the consulting hours to adapt them to your state. Or start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.530(j) (documentation retention)
- HHS: Summary of the HIPAA Privacy Rule
- Texas Medical Board rule 165.1 (seven years)
- Florida Administrative Code 64B8-10 (medical records)
Related Reading