How Long Do I Have to Keep Patient Records?

Published September 26, 2026 · 6 minute read · General information, not legal advice. Your licensing regulators decide what applies to you.

Somebody asked for a chart from four years ago and the practice does not have it. Or an accountant suggested clearing out a storage unit. Or a new hire asked what the policy is and found there is not one. However the question arrives, the answer that comes back from a search is usually a single number offered with no indication of where it came from. The most commonly repeated version of that number is a real requirement about something other than patient charts.

What the federal privacy rule actually says

The U.S. Department of Health and Human Services publishes an answer to this exact question. Asked whether the HIPAA Privacy Rule requires covered entities to keep patients' medical records for any period of time, the department's published guidance says: "No, the HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained."

So where does six years come from? From a separate paragraph of the same regulation, which is about the practice's own paperwork rather than its patients'. Under 45 CFR 164.530(j), a covered entity has to keep its privacy policies and procedures, any communication the rule requires in writing, and a written or electronic record of any action, activity or designation the rule requires to be documented. The retention period for that material is set out in the next paragraph: "A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later."

Read those two together and there are two clocks, running on two different piles of paper, with the well known number belonging to the smaller pile. A practice that applies six years to its charts and nothing at all to its privacy documentation has aimed the rule at the wrong target.

Both are cited here as descriptions of a federal rule and a federal agency's reading of it, not as a statement about how long this practice has to keep anything.

The clocks that actually run on a file

A patient file usually sits underneath several retention periods at once, set by different bodies for different reasons. The ones worth asking about:

• The licensing regulators for each profession working in the practice. A board that licenses one profession and a board that licenses another can name different periods, and the practice holds records made by both.
• Records for patients who were minors at the time of treatment. These commonly run on a separate and longer clock tied to age rather than to the treatment date.
• The facility or business licence, where one applies to the setting. Requirements attached to the premises are not always the same as those attached to the practitioners.
• The professional liability carrier. Insurers frequently name a period in the policy, and that period can be longer than anything a regulator asks for. It is a contract term rather than a rule, which means it is enforceable against the practice in a different way.
• Payer and vendor agreements. Anything that involves submitting claims, or a device or product supplier with reporting terms, can carry its own recordkeeping obligation.
• The window during which a claim can be brought. This is a legal question rather than a records question, and it is the one most likely to make a practice hold a file long after every other clock has stopped.
• Any active matter. A claim, a complaint, an inquiry from a regulator, a subpoena or a preservation notice from an attorney overrides an ordinary schedule for the files it touches.

So a retention schedule is not a number. It is the longest of several numbers, applied per record type, with a rule for what happens when a file is under an active matter. It is also not something an owner can settle alone. The regulator directory lists the bodies that set the professional side, and the guide on how to verify what your state actually requires covers getting an answer in writing from the body that issues it rather than from a summary of it.

What the decision looks like written down

Once somebody qualified has given an answer, the answer itself becomes a record. A retention decision that exists only in the owner's head fails the first time that owner is unavailable, and it fails permanently if the practice is ever sold or reviewed.

A written retention decision generally names, for each type of record the practice holds:

• The record type, described the way staff would recognise it rather than in legal language.
• The period the practice will hold it, and the event the period counts from. Date of treatment, date of last contact, date of creation and date of a patient reaching a particular age are all different starting points.
• Where that period came from: which body, which document or page, and the date somebody read it.
• Who gave the practice its answer, in what form, and when. A dated email from an attorney is a record. A recollection of a phone call is not.
• The format the record is held in, and where. A file that exists only inside software the practice no longer subscribes to has effectively been destroyed.
• What happens to a record under an active matter, and who has authority to place a hold.
• A review date, and a name against it.

The destruction side needs the same treatment. When a record does reach the end of its period and nothing is holding it, the practice should be able to show what was destroyed, when, by what method, and who authorised it. A destruction log is short and dull and it is the only thing that distinguishes an orderly disposal from a missing file.

Where our documents fit

The Complete Charting Bundle and the Patient Communication Set carry the identifiers and dating fields that make a file traceable in the first place, and the Emergency Documentation Set holds the incident and correction records that tend to be requested alongside charts. Retention periods themselves are blank fields. The practice fills them in from what its own regulators and counsel say, and the frameworks leave room to record who said it and when.

Do this next

Open one patient file from the earliest period the practice still holds and write down four things about it: what the record is, what date the retention clock would count from, where that file physically or digitally lives, and whether anyone could retrieve it today without the person who created it. Then send that one page to the practice's attorney with a single question attached, asking what period applies to that record type and to records for patients who were minors at the time of treatment. One file is enough to expose whether a schedule exists, and the written answer that comes back is the first line of the one you will build.

Questions this guide answers

Does the federal privacy rule set a retention period for medical records?

No. The Department of Health and Human Services answers this directly in its published guidance, which says the Privacy Rule does not include medical record retention requirements and that state laws generally govern how long medical records are retained. The six year period people repeat comes from a different requirement in the same regulation, which covers the practice's own privacy documentation rather than patient charts.

Can records be destroyed once the retention period has run?

That is a decision for the practice with its counsel, not a default. Several clocks can run on the same file at once, and the longest one governs. A file under a claim, a complaint, a request from a regulator or a preservation notice from a lawyer is held regardless of any ordinary schedule.

Who should decide the retention period for a practice?

The practice's attorney, working from the professions licensed there, the record types held, and any insurer or payer agreements. The useful thing for an owner to do is write down the answer that was given, who gave it, and when, so the next person does not have to guess or ask again.

Related guides

• A Patient Had a Complication. What Should the Record Show?
• Aesthetic Injector Training Options Compared
• Delegation vs. Supervision vs. Orders: Three Different Records