How Long to Maintain Medical Records?

Providers keep medical charts for the purpose of providing good care, retaining accurate notes and, when necessary, sharing valuable information with colleagues.  Even after a patient has left care, it is not unusual to receive a request for records.  Patients may move or there may be important medical history that can help diagnose another family member at some point in the future (e.g., heritable cancer syndromes).  Additionally, a well-documented medical record is always the best defense against a medical malpractice lawsuit.  As courtroom adage goes, if it isn’t documented, it didn’t happen.

Notes made in the medical record at or near the time of treatment are regarded as highly reliable evidence. Without medical records, healthcare providers might not be able to show what care was provided and whether it met the standard of care. Simply stating the level of care and treatment rendered without providing documentation will often not succeed in a court of law, thus leaving the provider liable for the patient’s alleged injuries.

State and Federal Laws

State and federal laws regarding mandatory record retention requirements for hospitals or similar facilities differ from the laws for physician practices. The retention period for a minor’s records also varies. This variation exists to allow minors to bring suit for medical malpractice after they reach the age of majority for injuries that occurred when they were under age.

Generally, the Medicare Conditions of Participation (COP) require hospitals to retain records for five years (six years for critical access hospitals).  HIPAA privacy regulations require records to be retained for six years from when the record was created to adhere to the federal statute of limitations for civil penalties for HIPAA violations.  See record retention requirements from the healthit.gov site in ‘Learn More – Primary Sources’ below.

Medical Board and Medical Association Policies and Recommendations

When a direct state or federal law does not specify the retention period for physicians, medical boards may be able to provide policies or recommendations on how long a physician should keep records. For example, the Colorado State Board of Medical Examiners Policy 40-07 requires retaining all patient records for a minimum of 7 years after the last date of treatment, or 7 years after the patient reaches age 18 – whichever occurs later.

Storage and Safety Considerations

With the near mandatory use of electronic medical records, the storage of paper records will slowly be eliminated. However, attendant with the use of EMR comes the ever increasing need to prevent loss of data, or worse, hacking and cyber attacks on the electronic data across all industries.  Antiquated infrastructure and uncorrected network vulnerabilities are frequent causes of successful attacks.

Learn More – Primary Sources

HealthIT.gov: State Medical Record Laws: Minimum Medical Record Retention Periods for Records Held by Medical Doctors and Hospital

County of San Bernardino/California Code

From papyrus to the electronic tablet: a brief history of the clinical medical record with lessons for the digital age

Patient experiences with electronic medical records: Lessons learned

Barriers and Facilitators to Online Portal Use Among Patients and Caregivers in a Safety Net Health Care System: A Qualitative Study