Medical Records Retention

The instinct to reduce records retention to one number — a single figure a practice can post on the wall — is understandable and is the source of most retention mistakes. Several different authorities each impose a retention obligation, they were written for different purposes, and they do not agree on a period. A record can be subject to more than one at the same time: a patient's chart supporting a Medicare claim is reached by a state medical-record law, by Medicare's own documentation rule, and by the windows in which that claim can still be reopened. When more than one rule covers the same record, the practice does not get to pick the shortest — it must satisfy all of them, which means keeping the record until the longest applicable period has run.

That reframing is the whole task. Retention is not a lookup; it is a determination a practice makes, record type by record type, by identifying every authority that applies and taking the longest floor among them. The rest of this article walks through the floors that most often govern a physician practice's records — what each one covers and where it comes from — and then how to combine them into a schedule and dispose of a record once its time is up.

Because HIPAA is the rule a billing team knows best, it is the one most often blamed for the retention period — and it is the wrong source. HIPAA does impose a six-year retention requirement, but it attaches to the wrong thing to serve as a medical-record clock. The HIPAA Security Rule requires a covered entity to retain its Security Rule documentation for six years from the date of creation or the date it was last in effect, whichever is later (45 CFR 164.316(b)(2)(i)), and the Privacy Rule imposes the same six-year requirement on its documentation (45 CFR 164.530(j)(2)). But read what that documentation is: policies and procedures, records of required actions and assessments, risk analyses, and — under the Privacy Rule — the written communications the rule requires a practice to keep, such as the notice of privacy practices and signed authorizations.

None of that is the patient's clinical record. HIPAA's six-year clock governs a practice's HIPAA compliance documentation — the paperwork that proves the practice met its HIPAA obligations — not the medical record that documents the care. HHS has said so directly: its Office for Civil Rights FAQ on the question states that the HIPAA Privacy Rule does not include medical-record retention requirements, and that state laws generally govern how long medical records are to be retained. So a practice that answers “how long do we keep charts?” with “six years, because HIPAA” has cited the right rule for the wrong record.

If not HIPAA, then where? For a physician practice, the retention floor for a medical or billing record is set by whichever of these applies — and usually more than one does:

State medical-record law

This is the primary source for the medical record itself, and it is the one HHS points to. Every state sets a retention period for medical records, and they differ — by the length of the period, by provider type, and, for a minor's record, by how long after the patient reaches the age of majority the clock runs. There is no national number to look up; the applicable period is the one in the practice's own state's statutes and licensing-board rules, so that is where to find it.

Medicare's documentation rule

For a practice that bills Medicare, federal law sets a concrete floor: providers, suppliers, and the physicians and eligible professionals who order, certify, refer, or prescribe must maintain the documentation supporting those orders and the requests for payment, and provide access to CMS, for seven years from the date of service (42 CFR 424.516(f)). This is a Medicare-enrollment obligation and applies directly to the practice.

Medicaid's provider agreement

Medicaid requires, as a condition of the provider agreement, that a provider keep any records necessary to disclose the extent of services furnished to beneficiaries and furnish them to the state Medicaid agency, the Secretary, or the state fraud control unit on request (42 CFR 431.107). The federal rule sets the duty but not a universal number of years — the specific retention period is set by each state's Medicaid program and varies, so a practice confirms it in its state Medicaid provider manual.

Payer contracts

A commercial or Medicare Advantage participation agreement can impose its own records-retention and audit-access terms, and those can run longer than the state or Medicare floor. A Medicare Advantage organization, for example, is bound under its CMS contract to make records available for ten years (42 CFR 422.504(e)(4)); where a plan flows a comparable term down to a participating practice, the contract governs. The period is in the agreement, not in a general rule — read it.

There is a second kind of floor, and it is the one practices most often overlook: a record has to outlive the window in which the claim it supports can still be challenged. A retention period expressed in a state statute is a minimum for the record; the practical minimum is longer if a payer or the government can still reopen the claim after that, because the record is the only defense. Two federal windows set that practical floor for claims involving federal health care programs.

• The overpayment lookback — the 60-day overpayment rule reaches an overpayment identified within six years of the date it was received (42 CFR 401.305). A claim can therefore be the subject of a return obligation years after it was paid, and the record that shows the claim was correct is what answers it.
• The False Claims Act limitations period — a civil False Claims Act action may generally be brought up to six years after the violation, or three years after the material facts are known to the responsible government official, but in no event more than ten years after the violation, whichever is last (31 U.S.C. 3731(b)). The outer limit is ten years, which means a claim can be contested long after an ordinary retention clock would have expired.

These windows do not, by themselves, order a practice to retain records for a set number of years — they are limitation and lookback periods, not retention statutes. But the reasoning is unavoidable: if a claim can be reopened for years, disposing of the record that substantiates it on a shorter schedule leaves the practice unable to defend a claim it could otherwise have proven correct. Aligning the retention period to the longest window in which a claim can still be reviewed — including the time it takes an audit to run — is how a practice keeps a records schedule from becoming a liability.

A blanket retention period for “the chart” is a starting point, not the whole policy, because certain record types are governed by rules that run differently — usually longer — and a schedule that ignores them will dispose of something too early.

• Minors' records — most states run a minor's retention clock not from the date of service but from the date the patient reaches the age of majority, plus a further period, so a pediatric record is often kept far longer than an adult's. The specific rule is state law, and it is one of the most common places a general schedule goes wrong.
• Substance-use-disorder records — records protected by 42 CFR Part 2 are subject to their own federal confidentiality regime, which governs how they are stored, disclosed, and eventually destroyed, on top of any retention period.
• Psychotherapy notes and other specially protected material — material that HIPAA or state law treats as more sensitive than the general record can carry different handling and retention expectations, and should be identified in the schedule rather than swept into the default.
• The HIPAA compliance file — the policies, authorizations, notices, and risk analyses HIPAA requires are the records the six-year rule in 45 CFR 164.316 and 164.530(j) does cover, and they are kept on that clock — separately from, and often on a different schedule than, the clinical record.

The way a practice makes all of this operational is a written record retention schedule — a document that lists each type of record the practice holds and states how long it is kept and when it is destroyed. It turns a set of overlapping rules into a single instruction a staff member can follow without re-deciding the law each time. Building one is a small project done once and reviewed periodically.

1. 01

   Inventory the record types

   List what the practice actually holds — clinical records, billing and claim records, explanations of benefits and remittances, signed authorizations and consents, the HIPAA compliance file, and any specially protected categories such as substance-use-disorder records. Different types can carry different periods, so they need to be named separately.
2. 02

   Find every authority that applies to each type

   For each record type, identify the rules that reach it: the state medical-record statute, Medicare's seven-year documentation rule where the practice bills Medicare, the state Medicaid period, the terms of each payer contract, and the claim-review and False Claims Act windows. Confirm the state and payer figures from the source — the state statute, the state Medicaid manual, the actual agreement — not from a general article.
3. 03

   Set the period to the longest floor

   For each record type, the retention period is the longest of the applicable authorities. Do not average them or pick a convenient middle — a period shorter than any single applicable floor is a violation of that rule and can leave a claim undefended.
4. 04

   Write it down and assign an owner

   Record the period and the disposal trigger for each type in the schedule, name who is responsible for applying it, and set a review cadence so the schedule keeps up with changes in state law and payer contracts. An undocumented practice is, to an auditor, indistinguishable from no practice.
5. 05

   Protect records for the whole retention period

   A record is only useful if it survives and can be found. Store records so they remain legible, complete, and retrievable by patient and date of service for the entire period, and keep protected health information safeguarded the whole time it is held, as HIPAA requires.
6. 06

   Dispose securely at end of life, and document it

   When a record's longest period has run, destroy it by a method that renders protected health information unreadable and unrecoverable, and keep a record of what was destroyed and when. Secure disposal is a HIPAA obligation, and the destruction log is what proves a record was disposed of on schedule rather than lost.

A retention schedule is not a standalone document; it is one of the operational controls a functioning compliance program maintains. It is what makes the practice able to answer a payer's request for records — a request can only be answered with a record the practice still has and can retrieve — and it is what lets the practice defend a claim reopened years after it was paid. The same schedule, applied at the other end, prevents the opposite failure: PHI kept indefinitely with no plan for secure disposal, which is its own exposure.