Understanding medical record retention requirements by state

As a healthcare provider, you are responsible for keeping patients’ records safe and secure while ensuring compliance with HIPAA and state and federal regulations. This guide will help you navigate medical record retention by breaking down the differences between HIPAA and state requirements and outlining best practices for storing and sharing records.

Note: Not all types of documents are regulated under HIPAA and instead fall under state or federal regulations. 

HIPAA document retention rules

According to the Department of Health & Human Services, “the HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained.” In other words, HIPAA does not govern the length these records are retained but does govern how they’re secured and stored.

HIPAA does, however, require covered entities and business associates to retain specific types of documents to ensure the privacy and security of protected health information (PHI). 

The following table outlines the documents, their descriptions, and retention requirements:

It’s worth noting that these retention requirements are not exhaustive. Depending on your specific circumstances, you may need to keep additional documents. For example, healthcare providers participating in Medicare or Medicaid programs must retain all records related to program reimbursement for at least six years from the date of reimbursement or the final determination of costs. Similarly, if you’re a covered entity or business associate involved in clinical trials, you must retain research records for at least two years after completing the study.

Related: Email archiving and HIPAA compliance

State patient record retention policies

Each state has its own regulations dictating how long patient records must be kept. Some states require providers to retain records for as little as three years, while others mandate retention periods of up to ten years or longer. The retention timeframe only begins with the date of the last treatment.

Here’s a table outlining the retention policies for each state, listed alphabetically:

Some states have specific requirements for how records should be stored, such as requiring that paper records be retained in a secure location or that electronic records be encrypted. Be sure to double-check your state’s regulations for specific requirements. 

Federal laws on patient and medical record retention

In addition to HIPAA and state regulations, federal laws also dictate patient’s medical record retention requirements. 

The following table outlines some of the key federal laws:

Best practices for storing and sharing records:

In addition to understanding the regulations surrounding medical record retention, implement best practices for storing and sharing records securely. 

Here are a few tips to keep in mind:

• Store records in a secure location, such as a locked cabinet or a HIPAA-compliant cloud storage service.
• Back up electronic records regularly
• Use HIPAA-compliant methods to share documents, such as secure  HIPAA compliant email or a secure file-sharing service.
• Implement access controls to ensure that only authorized individuals can access patient records.
• Train employees on record-keeping policies and procedures to ensure compliance with regulations.

Better safe than sorry

Patient record retention is a critical aspect of healthcare providers’ responsibilities. By understanding the differences between HIPAA and state requirements, following best practices for storing and sharing records, and keeping up to date with federal laws, you can ensure that you’re meeting your obligations and protecting the privacy and security of your patients’ information.

Related: How to send HIPAA compliant emails