HIPAA does not set how long you keep patient charts. Your state does. New York uses 6 years from the last visit, Florida 5 years from last contact, and Texas 7 years from last treatment. Charts for minors are kept longer. HIPAA's six-year rule covers your compliance paperwork, like policies and training records.
Ask this question in any practice manager forum and you will get the same confident answer: "HIPAA requires six years." That answer is wrong in a specific and expensive way. HIPAA does require six years, but not for patient charts. The six-year clock covers your compliance paperwork. Your charts are governed by a different set of rules entirely, and those rules come from your state.
This article separates the two clocks, shows what each one actually covers, and gives you a starting table for state retention periods, with one warning repeated on purpose: verify your own state before you shred anything.
Medical Record Retention: The Two Clocks That Get Confused
Clock One: HIPAA's Six Years (Compliance Documents)
The HIPAA Privacy Rule, at 45 CFR 164.530(j)(2), requires a covered entity to retain required documentation "for six years from the date of its creation or the date when it last was in effect, whichever is later." A covered entity is a provider, health plan, or clearinghouse that HIPAA covers. In plain words, keep each document for six years. Start counting from the day you made it or the last day it was in effect, whichever is later. The Security Rule uses the same six-year clock for its own paperwork, such as risk assessments (45 CFR 164.316(b)(2)(i)).
Read the "whichever is later" part twice, because it matters. A policy adopted in 2015 and retired in 2024 must be kept until 2030: six years from when it was last in effect, not from when it was written.
What counts as required documentation: your written policies and procedures, your Notice of Privacy Practices and its acknowledgments, risk assessments, training records, sanction records, BAAs (Business Associate Agreements), breach documentation, and patient authorizations. The full inventory is in the HIPAA documentation requirements article.
Notice what is not on that list: the medical record itself. HHS has stated plainly that the Privacy Rule does not include medical record retention requirements. Federal HIPAA has no opinion on how long the chart lives; that question belongs to state law.
Clock Two: State Law (The Chart Itself)
Chart retention comes from state statutes, medical board regulations, and hospital licensing rules. The periods vary by state, by provider type, and by patient age. A few examples of the ranges you will encounter:
| State | Commonly cited period (adult patients, physicians) | Where it comes from |
|---|---|---|
| New York | 6 years from last visit | Education Law and Board rules |
| Florida | 5 years from last contact | Board of Medicine rule |
| Texas | 7 years from last treatment | Texas Medical Board rule |
| California | No statute (written law passed by the legislature) sets a period for physician records. Hospital records: at least 7 years after the patient is discharged, set by regulation. | Hospital licensing regulation (22 CCR 70751(c)) |
Treat this table as a starting point, not an answer. Every row needs to be checked against your own board's current rule before it becomes your policy. The state-specific compliance articles for New York, Florida, Texas, and California cover more of each state's landscape.
Minors Extend Everything
Nearly every state extends retention for minors: typically some period past the age of majority, which can put a pediatric chart's destruction date twenty-plus years after the visit. If you treat children, your retention schedule needs a separate minors row.
The Other Clocks: Medicare, Malpractice, and Payers
Three more timers can outrun your state minimum. Federal program participation carries its own document retention conditions. Your malpractice carrier and your state's statute of limitations effectively set a floor, because a destroyed chart is a lost defense. And payer contracts routinely require records be available for audit for a stated period. Your policy follows the longest applicable clock, always.
Destruction Is Part of Retention
A retention schedule ends in destruction, and destruction has its own HIPAA rules. The Security Rule says you need policies and procedures for getting rid of electronic records and the devices that store them (45 CFR 164.310(d)(2)(i)). HHS guidance says PHI (Protected Health Information) should be made unreadable and impossible to put back together. Shredding for paper, sanitization or physical destruction for drives and devices. The specifics, including the copier-hard-drive problem, are in the physical safeguards article.
Keep a destruction log: what was destroyed, when, how, and by whom. When a records request arrives for a chart you lawfully destroyed, the log is your answer.
The One-Page Policy That Settles This
Most practices do not have a retention problem. They have a retention question that gets re-argued every time someone wants to clear a storage room. The fix is a one-page schedule: each record type, its clock, the trigger date, and the destruction method. Write it once, check it against your state, and the argument is over. Our policy template library gives you a place to start.
FAQ
Does HIPAA require keeping medical records for six years?
No. HIPAA's six-year rule at 45 CFR 164.530(j) covers compliance documentation: policies, training records, BAAs, authorizations. Retention of the medical record itself is set by state law.
How long should a practice keep records for minors?
Longer than for adults. Most states extend retention until some period after the patient reaches the age of majority. Check your state board's specific rule; pediatric charts may need to be kept 20 or more years.
Can we destroy paper charts after scanning them?
Generally yes, if the scanned copy is complete, legible, and retained for the full period, and the paper is destroyed by shredding or another method that makes PHI unreadable. Verify your state and payer contracts do not require original retention.
What happens to records when a practice closes?
The records must remain available for the remainder of the retention period. States commonly require notifying patients and arranging a custodian. Closing a practice does not end the retention obligation.
Is there a federal medical record retention law?
Not a general one. The HIPAA Privacy Rule contains no medical record retention requirement; its six-year clock at 45 CFR 164.530(j) covers compliance documentation only. The chart's baseline period comes from state law.
A retention schedule is one page: record type, clock, trigger date, destruction method. It settles a dozen future arguments at once. The Full-Scope plan includes the policy templates plus 4 hours a month of 1:1 implementation calls with Chuck to help adapt them to your state. Or start with a free 30-minute intro call. No obligation, no pressure.
Sources
- 45 CFR 164.530(j) (documentation retention)
- HHS: Summary of the HIPAA Privacy Rule
- Texas Medical Board rule, 22 TAC 163.2 (seven years)
- Florida Administrative Code 64B8-10 (medical records)
- California 22 CCR 70751(c) (hospital records, seven years)
Related Reading