How Long Should We Keep Medical Records?

Published on: December 14, 2018

One of the most common questions asked of MIEC’s Patient Safety & Risk Management Department is how long physicians should maintain their medical records after a patient leaves the practice, or upon retirement. While many might assume that there are clear laws and regulations around this issue, in fact there are few laws that address it (please see the table below for information on state laws). MIEC’s recommendations are as follows:

What Attorneys Advise

“Keep medical records forever.” This is the advice of many malpractice defense attorneys, because in the event of a medical malpractice claim, the medical records provide the single most effective tool for corroborating treatment and defending a physician’s care. State law imposes a “Statute of Limitations” which limits the amount of time an adult patient has to initiate a legal action; however, there are various reasons courts do permit lawsuits to be filed years after the statute of limitations has expired. Thus, keeping records only until the applicable Statute of Limitations has run may deprive a physician of necessary evidence, and compromise his or her defense in a case allowed to proceed after the statute has expired.

Additionally, old medical records are often needed by patients, family members, or current treaters to facilitate the treatment of a current disease or condition. While not absolutely required, maintaining medical records for as long as possible ensures they are available for these contingencies.

Alternatives to “Forever”

For many physicians, keeping medical records “forever” is not practical or physically possible. Therefore, MIEC’s defense attorneys recommend that physicians retain most medical records for a minimum of eight to ten (8-10) years after the patient’s last medical treatment. Some records should be retained for longer periods, up to 25 years or more, such as in situations in which the patient:

• Suffered significant complications of treatment or surgery
• Was left with a major disability
• Was treated for a pregnancy

In general, physicians can destroy the records of deceased patients after five (5) years from the date of death. MIEC recommends that for situations in which the patient’s death was related to the care they received, physicians should retain their records for longer periods in case a claim were to arise from the patient’s death.

Minors’ Records

Most states require that minors’ medical records be retained at least until the minor patient reaches the “age of majority” (18 years), plus an additional period of time which varies from state to state. As with adults’ medical records, defense attorneys suggest that minors’ records be retained for at least eight to ten (8-10) years after the date of the patient’s last treatment. Therefore, depending on the age of a minor patient at the time of the last treatment, it may be prudent to the patient’s medical record beyond the statutory retention period mandated by the state in which you practice.

For example, a physician in California is only required by law to retain a minor’s record until the patient reaches age nineteen (19). If the patient was age fourteen (14) at the date of the last treatment, they would reach the age at which their record is required by law to be retained after only five years. The prudent physician may wish to retain the record for an additional 3-5 years to be in keeping with defense attorneys’ recommendations that records be kept for at least 8-10 years after the date of last treatment.

Hawaii’s 25-Year Retention Law

Hawaii law requires that medical records be retained for a minimum of seven (7) years after the last entry was made. Importantly, while medical records can be destroyed after seven years, basic patient information must be retained for twenty-five (25) years after the last chart entry. “Basic information” includes a patient’s name, birth date, a list of diagnoses and intrusive treatments with dates, and a record of all drugs prescribed or otherwise administered. Medical records of minors must be retained for seven (7) years after the minor’s eighteenth birthday; “basic information” must be retained for twenty-five (25) years after the minor’s eighteenth birthday.

Storing Records After Retirement

Since both federal and state law gives patients the right of access to their existing protected health information (PHI), it is important for retiring physicians to arrange for storage and disclosure of the records following their retirement.

Physicians retiring from a medical group often will arrange to have the group maintain the records, as many patients will choose to transfer to another provider within the group. Alternatively, physicians can arrange with a practicing colleague to have them become the formal custodian of records for their charts. The custodian must agree to preserve the records for the required or recommended time, and to make them available when appropriate to patients and/or their representatives, or to third parties in response to subpoenas or authorized requests.

Importantly, physicians who sell their practice cannot sell their medical records to another physician. The physician could, however, become custodian of the records. For more information on this, please see MIEC’s publication entitled, “Closing a Medical Practice Upon Retirement.”

Physicians who choose to store their own records following retirement, whether on their own property or in a professional storage facility, should be careful to keep them in a safe, dry, secure place. Records should be stored in locked cabinets, and the premises should be secure with limited access by authorized individuals only. For off-site storage, be careful to pay rent on time and otherwise avoid violating any lease agreement. Also, consider making contingency arrangements to avoid the loss of PHI in case you are unable to actively manage the storage agreement, for example due to illness or injury.

Paper records can be copied to microfilm or scanned into electronic form; if you do this, be sure to store the records on read-only disks or other permanent storage media that cannot be altered. Here are a few caveats:

• A responsible person should transfer the records to the storage medium;
• Use clear identifiers for easy information retrieval;
• Use a storage medium that has a long-term shelf life;
• Store the media in a safe place.

How to Safely Discard Records

Medical records, whether in paper or electronic form, must be disposed of in a manner that protects patient confidentiality. Do not, under any circumstances, place old medical records in ordinary, open trash bins for curbside collection. Ideally, paper records should be shredded or incinerated by a commercial secure document destruction service. Local hospitals may also have the capacity to safely dispose of paper charts.

Whenever hardware or back-up media containing confidential information is disposed of, use software to “wipe clean” or re-format the disk drive. On most computers, simply using the “delete” function will remove the information from use, but it will still be present on the hard drive and can be recovered forensically.

Records Retention Laws by State