Medical Records Retention Guidelines

Requirements for how long you should keep medical records vary by state law and place of service (e.g., physician office vs. hospital). Note, however, that you may wish to keep records for longer than explicitly required. For example, in Florida, physicians must retain records, by law, for five years; however, Florida laws also allow certain medical malpractice lawsuits to be filed up to seven years from the date of the alleged negligent conduct.
Records retention for minor patients may differ than that for adult patients. For example, in North Carolina, hospitals must keep adult patients’ records for 11 years following discharge, while minor patients’ records must be kept until the patient’s 30th birthday. In North Dakota, hospitals must keep adult patients’ records for 10 years after the last treatment date, and minor patients’ records must be kept for 10 years after the last treatment date, or until the patient’s 21st birthday, whichever is later.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires that a covered entity (e.g., a physician billing Medicare) must retain required documentation for six years from the date of its creation or the date when it last was in effect, whichever is later. Your state may require a longer retention period, but HIPAA requirements preempt state laws that require shorter periods.
The Centers for Medicare & Medicaid Services (CMS) “requires records of providers submitting cost reports to be retained in their original or legally reproduced form for a period of at least 5 years after the closure of the cost report,” per CMS regulation. Medicare managed care program providers must retain records for 10 years.
To err on the side of caution, and to satisfy the many overlapping requirements, you typically will need to keep patient records for 12 years, or more. Records may be kept indefinitely when:

  • There was a risky situation or undesirable outcome
  • There was incompetency at the time of or after treatment (e.g., Alzheimer disease, brain damage, etc.)
  • A patient is unhappy with results
  • A patient threatens or files a lawsuit

For further advice, visit the AMA website.

John Verhovshek
Latest posts by John Verhovshek (see all)

About Has 584 Posts

John Verhovshek, MA, CPC, is a contributing editor at AAPC. He has been covering medical coding and billing, healthcare policy, and the business of medicine since 1999. He is an alumnus of York College of Pennsylvania and Clemson University.

Comments are closed.