COVID-19 CORONA VIRUS: Please visit our COVID-19 Resources for Providers and COVID-19 FAQs or call our office for more information.


Read the Latest News

What is a Medical Retention Records Policy?

Why Should I Keep Medical Records?

Healthcare organizations maintain medical records for several key purposes and proper maintenance and destruction of records is an important consideration for any medical or dental practice.  While storing patient records can be a financial concern, nothing can take the place of the medical record with an accurate account of the patient’s care.  Well-documented medical and dental records can protect you and your practice and provide essential evidence when defending against claims of malpractice or violations of statutes like the False Claims Act (FCA). Among the key reasons for maintaining good records are:

      • Continuity of Care: The most important reason for keeping medical and dental records is to ensure continuity of care to a patient by providing information to other healthcare professionals regarding the patient’s care.
      • Billing and Reimbursement: They can provide documentation to substantiate billing and reimbursement information in the event of an audit by the Centers for Medicare and Medicaid Services or commercial third-party-payers.
      • Research and Quality Management: They can be used to monitor the quality of care provided for research and quality management.
      • Defense in a Malpractice Action: A major reason to have accurate medical records is that they can provide legal documentation in the event of a malpractice action.  A medical record establishes facts from the time the care is provided and is a source for understanding the care of a patient that may have happened years earlier.  Records noted at the time of the event can support the provider’s defense and help to establish facts that support that the treatment was appropriate and met the standard of care. Records should be thorough – what is in the record can be as important as what is not – as that information will be analyzed and dissected by expert witnesses for the plaintiff and the defense.
      • Board and Peer Review: Medical and Dental records are also important information when facing a professional licensing board or peer review inquiry. A patient’s recollections in a complaint can often be mistaken or a misunderstanding of the treatment or its adverse consequences.  Accurate records may be able to facilitate a speedy resolution before a formal administrative process is started.
      • Significant Fines: Failure to comply with regulations and requirements can result in significant fines.  If multiple violations are identified, your financial penalties can be huge before you know what happened

 Desert Mountain Insurance is an independent agency which means we can contact multiple carriers so you have a wider choice of options in coverage and price.  For more information about Professional Liability Policies or a FREE Consultation and Quote, please complete our questionnaire!  No Agency Fees!  No Obligation!

What Medical Records Should I Keep

Physicians,  medical, and dental practices should develop and maintain a Medical Record Retention Policy.  It should include an outline of the office’s specific requirements and procedures for medical record retention based on State and Federal minimum periods for which records must be kept.

As an essential part of patient care, the Medical Record documents all the information regarding the patient’s history and clinical care and should be retained, including, but not limited to*:

        • the patient’s examination and treatment, his medical history
        • the physician’s findings, progress notes, nurse’s notes, etc.
        • the results of diagnostic tests and procedures, medications and therapeutic procedures, photos, videos, x-ray films, dental models, or casts.
        • Any records from other providers that are directly related to the patient’s care should also be kept for the same period that you retain your records. This is especially true if you have relied on any of the previous records or information when making clinical decisions.

The Medical Record Retention Policy should also explicitly detail the office’s requirements and procedures for medical record destruction under state and federal requirements and regulations.  For example, HIPAA requires that appropriate administrative, technical, and physical safeguards be used to protect the privacy of medical records and other protected health information (PHI) for whatever period such information is maintained by a covered entity, including through disposal. (45 CFR 164.530 c )  Destruction of records should only be made in accordance with record retention policies.  There are record destruction services that guarantee a method of destroying records that does not allow further access to the information. Records that are destroyed should be listed on a log with the date of destruction.

 *This list should not be considered as all-inclusive. Legal counsel should be sought when preparing a medical record policy.  

How Long Do I Have to Keep Records?  Where to Look for the Information*

 State Regulations

Record retention periods generally range from five to ten years with separate rules for medical records for minors.  Record retention rules for minors often require that all their records be retained for a period of time after they attain the age of majority (usually 18). Regulations will differ from state to state and they may be regulated by statute or through their medical professional licensing rules.  It is important to check individual state requirements periodically as retention requirements may change.

Record retention policies should not be based solely on the statute of limitations as case law may extend the times allowed for the patient to bring a malpractice action, for example, when a patient could not have discovered that the injuries were caused by wrongdoing within the statutory time frame.

Your attorney, state licensing board, or professional association may provide specific information about state requirements.

 Federal Regulations

Various federal agencies have laws that impose mandatory record retention requirements for medical facilities and medical and dental practices.  The Centers for Medicare and Medicaid Services (CMS), the Federal Drug Administration (FDA), and the Center for Disease Control (CDC), and the Occupational Safety and Health Administration just to mention a few.

        • The Medicare Conditions of Participation, for example, require hospitals to retain records for five years, and longer if by State statute (six years for critical access hospitals). (42 CFR § 24(b)(1) and 42 CFR § 485.638(c)
        • OSHA requires an employer to retain records for the duration of the employees’ employment plus 30 years for employees who have been exposed to toxic substances and harmful agents. (29 CFR § 1910.1020(d)).
        • HIPAA requires covered entities to retain documents created in compliance with the Privacy Rule, for at least six years from the date of its creation or the date it was last in effect, whichever is later. (45 CFR § 164.530(j)(2)) That documentation includes all policies and procedures required under HIPAA, training logs, and related communications. (45 CFR §164.530(j))

Contracted Healthcare Plans / Managed Care Agreements /Federally-Funded Programs

Contracted healthcare plans or signed managed care agreements often have their own record retention requirements. For example, Centers for Medicare and Medicaid Services (CMS) regulations require that providers who participate in Medicare Advantage plans retain medical records, financial records, and source reports for ten years. (42 CFR § 422.504(d))

Other federally-established standards for federally-funded programs may have laws or regulations that specifically address the retention of records.

Board and Association Policies

* This list should not be considered as all-inclusive. Legal counsel should be sought when preparing a medical record policy


Proper maintenance and destruction of records is an important consideration for any medical or dental practice.  Records should be kept in a HIPAA-compliant format and stored in a secure location where they are safe from damage or unauthorized access. Incomplete records or records that have been destroyed make it challenging, if not impossible, to provide a defense in a malpractice case. Medical and dental professionals should consult with their legal counsel regarding the laws in their jurisdictions that are relevant to their practice.

Let us be your one-stop shop for business insurance.  We can help you avoid overlapping policies and consolidate your business insurance portfolio, so you get only the insurance you need and no more.  For available coverages, see our Management Liability,  Cyber/Privacy Insurance,  and Group Benefits sections.




The information contained here is provided for informational purposes only.  It should not be considered a substitute for legal advice, or a guarantee of a successful outcome. The final judgment concerning any specific treatment must be made by the physician or healthcare provider taking into account the individual patient’s situation and in accordance with the laws of the jurisdiction in which the care is provided.  We strongly suggest consulting legal counsel when preparing a medical record policy.





Have a Question?
Contact Us


  • This field is for validation purposes and should be left unchanged.

Request a Free Quote