Medical Records Retention – Challenges and Solutions

Medical Records Retention

Electronic health record (EHR) systems are designed to improve the quality of care and patient safety, improve physician efficiency, and cut costs. EHRs have also reduced paperwork and eased patient record storage, accessibility, retrieval and retention. Integrating medical transcription services with electronic medical record (EMR) software ensures accurate and timely patient charting.

While EHRs ease storage and access, one concern is about how long a medical practice should retain patient records. Physicians keep medical charts for various reasons:

  • To providing good care and sharing information with other physicians
  • To meet patient requests for their records
  • A patient’s medical history may prove useful to diagnose a condition that a family member develops at some time in the future
  • An accurate, properly documented medical record is the best defense in the event of a malpractice suit

HIPAA does not have any specific rules about medical record retention and it is State law that mandates how long records should be kept. CMS states, “While the HIPAA Privacy Rule does not include medical record retention requirements, it does require that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records and other protected health information (PHI) for whatever period such information is maintained by a covered entity, including through disposal” (

However, while state laws on record retention exist, there are many challenges associated with developing a records retention policy:

  • One main problem is that record retention laws vary from state to state. Some states require medical records to be retained for a longer period of time than other states do, varying from 5 to 10 years.
  • Additionally, state and federal laws on mandatory record retention requirements for hospitals are different from those for physician practices.
  • The retention period for a pediatric patient’s record also varies. Minors’ records would have to be kept until they reach the age of majority in that state, or longer.

The minimum medical retention period for state and practice type are available on the Office of the National Coordinator for Health Information’s website.

The American Academy of Pediatrics (AAP) notes that to determine how long medical records must be maintained in every case, a practice would need to “piece together a patchwork of statutes, regulations, case law, and State Medical Board position statements”. The AAP recommends that every practice should develop a record retention policy based mainly on medical considerations and continuity of care.

Developing a records retention policy is important for many reasons. Practice transitions such as a change in ownership or EHR vendor can create record-related problems. If a partnership practice had a common EHR system, the records maintained by both physicians would likely be comingled as they would have treated each other’s patients. If the partnership is dissolved, each physician would have access to the other’s EHR system. This may lead to conflicts.

Practices can take the following steps to store and retain medical records:

  • Practices should make decisions about record segregation when forming a practice agreement or dissolving a practice (
  • In the event of closure of a practice, providers can consider various options for record storage: paid storage in a neighboring medical office, transfer to a secure document storage facility or in the practice of a colleague.
  • Patients should be informed about practice closure so that they can take a decision about their records and designate a physician or another provider who can receive a copy of the records.
  • If patients don’t designate another physician, the practice can designate a physician to act as the custodian of the records.
  • If two practices are merging, it should be decided upfront about how records are going to be handled.
  • If a physician chooses to destroy clinical records after the required period of time, confidentiality must not be compromised, says the AAP. The task can be assigned to record destruction services that guarantee records are properly destroyed without compromising any information.

Medical record safety and retention concerns also arise if practices decide to switch EHR vendors. In this case, too, the language in the contract should ensure that the transition a smooth one ( One way to safeguard records would be to get a weekly or monthly backup of the data from the EHR vendor.

Medical transcription outsourcing makes patient data available in the EHR systems of hospitals, physician practices and other health care entities. Healthcare providers need to work with other stakeholders to make informed business decisions about retaining medical records in order to provide patients with access to their information when they want it, to protect their own interests if a legal claim is made, and to comply with federal and state regulations.

Julie Clements

About Julie Clements

Joined the MOS team in March of 2008. Julie Clements has background in the healthcare staffing arena; as well as 6 years as Director of Sales and Marketing at a 4 star resort. Julie was instrumental in the creation of the medical record review division (and new web site); and has especially grown this division along with data conversion of all kinds.