Get the Latest COVID-19 Updates


Medical Record Retention

Richard Cahill, JD, Vice President and Associate General Counsel

Updated November 10, 2020: The unexpected advent of the COVID-19 pandemic and the subsequent dramatic shift to delivering more medical care via telehealth underscore the importance of complete and accurate charting for maintaining continuity of care and defending claims of professional liability. Accurate charting can also help protect physicians against licensing board complaints and hospital peer review queries, or respond to investigations by governmental compliance agencies. The potential for billing audits by the Centers for Medicare and Medicaid Services (CMS) or commercial third-party payers provides further motivation to create—and store—complete documentation.

A number of variables affect the length of time a physician should keep a medical record. Factors include state and federal laws, medical board and association policies, and the type of record (for example, that of an adult patient versus that of a pediatric patient). The following information can guide you in developing a medical record retention policy.

Basis for Keeping Medical Records

The most important reason for keeping a medical record is to provide information on a patient’s care to other healthcare professionals. Accurately charting an individual’s presenting complaints, signs, and symptoms derived from a careful physical examination, differential diagnoses, and treatment plan help to optimize patient well-being and promote more effective continuity of care.

Patient health records serve a number of other vital functions. For example, billing audits require clear documentation demonstrating medical necessity and the nature and scope of the services provided.

Another major rationale is that a well-documented medical record provides support for the physician’s defense in the event of a medical malpractice action. Entries made in the medical record at or near the time of the event are regarded as highly reliable evidence in subsequent judicial procedures. The chart and progress notes—key evidence in a professional liability action—are critical to help refresh the provider’s recollections of events (which might have occurred years earlier) and to establish facts at a time when no conflict or other motivation shaded or otherwise embellished the circumstances at issue.  

Without the medical record, the physician might not be able to show that the care he or she provided was appropriate and that it met the standard of care. Relying on the practitioner’s testimony of general habit and practice to show that the standard of care was met—without supporting documentation to establish the treatment that was rendered—often fails to convince a jury that the treatment the patient received was consistent with community standards.

Medical records are also important in establishing the quality of care rendered in the event of a medical board or peer review inquiry. Patient complaints are often based on an individual’s mistaken recollection of events, or on a failure to understand the course of treatment or adverse consequences involved in the dispute. With complete charting, frivolous allegations are readily resolved, frequently well before a formal administrative process is even initiated.

Federal Law, State Law, and Case Law

Federal and state laws impose mandatory medical record retention requirements on medical facilities and physician practices. The Medicare Conditions of Participation, for example, require hospitals to retain records for five years (six years for critical access hospitals),1 whereas OSHA requires an employer to retain medical records for 30 years for employees who have been exposed to toxic substances and harmful agents.2 

Federal legislation such as HIPAA and HITECH have also added new requirements. HIPAA privacy regulations, for example, require that documents created in compliance with the Privacy Rule, such as policies, procedures, and accountings of disclosures, be retained for six years from when the document was created,3 which follows the federal statute of limitations for civil penalties.4

The healthcare professions have primarily been regulated by the states rather than by a federal oversight agency. As a result, certain facets of medicine are governed differently in numerous jurisdictions across the country. These variations are especially evident in the way that healthcare record retention has been regulated, so it is important for physicians to check and follow state requirements.

Record retention policies should not be based solely on the state statute of limitations. This is because case law in various jurisdictions may extend the allowable time for the patient to bring a malpractice action. An example of this situation is when a patient could not have discovered that the injuries were caused by wrongdoing within the statutory timeframe.

Medical Board and Medical Association Policies and Recommendations

When state or federal laws are silent on medical record retention, medical boards may be able to provide policies or recommendations on how long a physician should keep records. For example, the Colorado State Board of Medical Examiners Policy 40-07 recommends retaining medical records for a minimum of seven years after the last date of treatment for an adult and for seven years after a minor has reached the age of majority, or age 25. In California, where no statutory requirement exists, the California Medical Association concluded that, while a retention period of at least 10 years may be sufficient, all medical records should be retained indefinitely or, in the alternative, for 25 years.5

The Doctors Company Recommendations

Medical record retention laws and regulations differ from state to state. It should be emphasized that once a record is destroyed, it is difficult—if not impossible—to defend the case. We encourage physicians to consult with their own legal counsel regarding how the law in the jurisdictions relevant to their practice has been interpreted by the judicial system.

You must follow your state’s specific guidelines or laws. Where no statutory requirement exists, The Doctors Company makes the following recommendations for retaining medical records:

  • Adult patients, 10 years from the date the patient was last seen.
  • Minor patients, 28 years from the date of birth.
  • Deceased patients, five years from the date of death.

Check any signed HMO or managed care agreements to ensure compliance with the medical records retention requirements of those agreements. For example, Medicare managed care plans require providers to maintain records for 10 years.

Medical records, whether paper or electronic, must be maintained in a HIPAA-compliant format. If using a commercial service, the records should be stored with a reputable document storage company. Many companies offer alternative methods for paper document management, such as electronic scanning and storage, and may offer storage of previous electronic records when software formats change. Storing closed or archived records at a residence or on a home computer puts the records at risk of damage from fire, flood, or other weather-related disasters, vermin, loss due to theft, or unauthorized access. Check state statutes and professional licensing agencies for state-specific requirements or recommendations.

If a physician chooses to destroy clinical records after a set time period, confidentiality must not be compromised. Use a record destruction service that guarantees records will be properly destroyed without releasing any information. Records that are destroyed should be listed on a log with the date of destruction.

What Records Should You Retain?

Retain all records that reflect the clinical care provided to a patient, including provider notes, nurses’ notes, diagnostic testing, photos, and medication lists. Additionally, records from other providers that are directly related to your care and are maintained as a regular part of your chart should be kept for the same period of time that you retain your own records. This is especially true if you have relied on any of the previous records or information when making clinical decisions.

Review patient bills for any reference to care provided. For example, review a bill to determine if it shows a limited examination or an annual physical with diagnostic tests obtained or requested. If the billing document shows that care was provided, it may be in your best interest to keep the bill for as long as you retain the medical record. Otherwise, retain the bill for the same length of time as other business records and in accordance with federal and state income tax requirements.

Storing medical records for the recommended time can generate a financial expense for the physician or practice. Given the importance of the medical record in defending a malpractice action, however, it is vital to ensure that the record is available to defend proper care.


  1. 42 CFR § 482.24(b)(1) and 42 CFR § 485.638(c).
  2. 29 CFR § 1910.1020(d)(1).
  3. 45 CFR § 164.530(j)(2).
  4. 42 CFR Part 1003.132
  5. Retention of Medical Records, Document #4005, CMA On-Call,

The guidelines suggested here are not rules, do not constitute legal advice, and do not ensure a successful outcome. The ultimate decision regarding the appropriateness of any treatment must be made by each healthcare provider considering the circumstances of the individual situation and in accordance with the laws of the jurisdiction in which the care is rendered.

J12227 11/20

Subscribe for Updates