Medical Records Retention: How Long to Keep Patient Files

The distinction that causes most of the confusion

Two separate bodies of paper live in your practice, and they are governed by two separate rules.

The first is HIPAA compliance documentation: the policies you adopted, the notices you issued, the authorizations patients signed, the risk analysis you performed, the training you delivered. The Privacy Rule at 45 CFR 164.530(j)(1) requires you to maintain this in written or electronic form, and 164.530(j)(2) sets the retention period at six years from the date of creation or the date when the document was last in effect, whichever is later. The Security Rule imposes the same six years on its documentation at 45 CFR 164.316(b)(2)(i).

The second is the clinical record itself: the intake, the good faith exam, the treatment notes, injection sites and product lot numbers, adverse event documentation, and clinical photographs. HHS has stated plainly that the HIPAA Privacy Rule does not include medical record retention requirements and that state laws generally govern how long medical records are retained. There is no federal chart-retention clock for a private aesthetics practice.

Read that pair carefully and one conclusion falls out. A practice that destroys charts at six years because "HIPAA says six years" may be destroying records its own state requires it to keep, and may be doing so while a malpractice limitations period is still open. The six-year number was never about charts.

What the six-year rule actually covers

Everything in this list is HIPAA documentation and carries the six-year obligation, with the clock running from creation or from the date the item was last in effect, whichever is later. That second trigger matters: a policy in force from 2018 to 2026 must be kept until 2032, not 2024.

Keep your policies and procedures, including superseded versions. Keep every version of the Notice of Privacy Practices and the acknowledgments of receipt collected under 164.520(c)(2)(ii). Keep signed 164.508 authorizations, including marketing and photo authorizations, and any revocations. Keep executed business associate agreements. Keep your security risk analyses and risk management plans. Keep training curricula and signed attestations. Keep your privacy official and security official designations, sanctions applied under 164.530(e), complaints and their dispositions, breach risk assessments under 164.402 whether or not you concluded a breach occurred, and any breach notifications sent. Keep the accounting of disclosures data, which under 164.528 must reach back six years from the date of the request.

What state law covers, and why it usually runs longer

State retention rules for the clinical record come from statutes, health department regulations, and professional board rules, and they can differ within the same state depending on whether the setting is a hospital, a licensed clinic, or an individual practitioner's office. A med spa is usually governed by the rule that applies to the supervising physician or to the license under which the service is delivered, which is not always obvious when the practice offers nursing, physician, and cosmetology services under one roof.

The table below shows the general outpatient or practitioner rule in several states as a sense of the range. Treat it as orientation, not authority, and confirm the rule for your own state, license type, and facility category.

Two patterns are worth extracting. First, most states measure from the last date of treatment rather than from the date a specific note was written, so a returning patient resets the clock for the entire chart. Second, states that appear short on paper are frequently longer in effect once malpractice limitations, minors, and payer rules are layered on top.

Minors, and the clock that does not start at treatment

The minor rules are the ones most likely to bite a practice that only reads the headline number. For a patient treated as a minor, retention typically runs to some age after majority rather than a fixed period after the visit.

Texas requires records of a patient younger than 18 at last treatment to be kept until the patient reaches age 21 or for seven years from last treatment, whichever is longer. Arizona runs to three years past the age of majority or six years after last services, whichever is later. California's clinic rule requires records of unemancipated minors to be kept at least one year after the minor turns 18, and in no event fewer than seven years. New York's professional conduct rule keeps obstetrical and minor records to age 19, and never fewer than six years.

Med spas treat more minors than they think. Acne protocols, laser hair removal, and some laser and skin treatments are performed on 16 and 17 year olds in many states with parental consent. A single 16-year-old patient can create a retention obligation stretching a decade beyond the visit, and your document management system has to be able to find that chart when it is asked for.

The other clocks nobody puts on the schedule

Malpractice limitations and repose periods sit underneath everything. Many states run two to three years from injury or discovery, but discovery rules and tolling for minors can extend exposure far past the retention minimum. If your carrier or defense counsel recommends holding records longer than the state minimum, that recommendation should override the minimum in your written schedule.

If you bill any federal program, records supporting claims are generally held for a longer window, and payer contracts frequently specify their own periods. Litigation and investigation holds override every schedule you have; once you have notice of a claim, an audit, or a board complaint, routine destruction of anything related must stop immediately, and Texas board rules make that explicit by allowing destruction of records related to a proceeding only after the proceeding is finally resolved.

Employment records run on a separate track worth knowing. Under OSHA's records access standard at 29 CFR 1910.1020, employee medical and exposure records generally must be preserved for the duration of employment plus 30 years, which covers hepatitis B vaccination records and declinations for staff handling sharps. The sharps injury log required by 29 CFR 1910.1030 is kept five years. Neither is a HIPAA record, and both are commonly missing in aesthetics practices.

Building a schedule you can actually follow

Write one document that lists each record category, the retention period, the trigger that starts the clock, the person responsible, and the destruction method. Give every category the longest applicable period among HIPAA, state law, payer requirements, and your carrier's advice. Where a med spa offers services under different licenses, apply the longest rule across the whole chart rather than splitting a single patient file.

Destruction is regulated too. Under 45 CFR 164.530(c) and 164.310(d)(2)(i), you must safeguard PHI through disposal. HHS guidance treats shredding, burning, pulping, or pulverizing as appropriate for paper, and clearing, purging, or destroying electronic media consistent with NIST media sanitization guidance for devices. Leaving charts in an unlocked dumpster is a classic and entirely avoidable enforcement fact pattern. Some states also require patient notice, or an opportunity to retrieve records, before a practice destroys them or closes, so check that before a clean-out.

Finally, log what you destroyed and when. A destruction log is your evidence that a missing record was disposed of under policy rather than lost, altered, or hidden, and that distinction matters enormously if a chart is ever demanded and cannot be produced.

The bottom line

HIPAA's six-year rule at 45 CFR 164.530(j)(2) governs compliance documentation such as policies, authorizations, notices, risk analyses, and training records, and nothing else. How long you keep the patient chart is a question of state law and board rules, commonly five to ten years from last treatment and far longer for minors. Build one retention schedule that applies the longest applicable clock to each category, respect litigation holds absolutely, and dispose of records by a method that actually destroys them. When state law and HIPAA point in different directions, the stricter requirement is the one to follow.

Frequently asked questions

Does HIPAA require me to keep medical records for six years?

No, and this is the most common misreading in the field. HIPAA contains no medical record retention requirement at all. The six-year rule at 45 CFR 164.530(j)(2) applies to HIPAA compliance documentation such as policies, authorizations, notices, risk analyses, and training records, while how long you keep the actual chart is governed by state law.

How long does state law require medical records to be kept?

It varies widely, commonly between five and ten years from the last date of treatment, and longer for minors. Texas requires seven years from last treatment under its medical board rules, Florida five years from last patient contact, and Georgia ten years. Always confirm the rule for your own state and license type.

Are before and after photos part of the medical record?

Clinical photographs taken to document a patient's condition, plan, or result are part of the medical record and follow the same retention rule as the chart. A photo used for marketing sits under a separate 45 CFR 164.508 authorization, which itself must be retained six years under 164.530(j)(2). Keep the clinical set and the marketing set in different places.

Related templates