Enter the password to open this PDF file:
Medical Records Collection, Retention, and Access
Medical records are those records kept on individual patients by providers that include health history, diagnostic information, and provider notes, among other pieces of data. Medical records can be kept on paper or electronically. This topic covers records maintenance as a condition of provider licensure, recordkeeping requirements for a variety of facilities, and laws governing record retention and ownership, access to records, data collection, and storage and destruction.

Click on a state to see more information on Medical Records Collection, Retention, and Access in that state
- 1-5 years
- 6-10 years
- > 10 years
- No time period specified
Hide All
State | Retention Periods | Details |
---|---|---|
Alabama | No time period specified | Medical records must be maintained by the treating physician for as long as may be necessary to treat the patient and for additional time as may be required for medical legal purposes.” Ala. Admin. Code r. 545-X-4-.08
|
Alaska | No time period specified | |
Arizona | 6-10 years | Physicians must maintain patient medical records for 6 years: Arizona Revised Statutes § 12-2297 |
Arkansas | 1-5 years | Physicians, dentists, and other health care providers authorized to administer narcotic drugs must keep a record of each drug administered for 2 years from the date of administration: Arkansas Code § 20-64-209 Medicaid participating health care providers must maintain medical records for at least 5 years: Arkansas Code § 20-77-907 |
California | No time period specified | |
Colorado | No time period specified | |
Connecticut | 6-10 years | Each licensed physician must retain medical records for 7 years from the last date of treatment, or for 3 years upon the death of the patient: Regulations of Connecticut State Agencies § 19a-14-42 |
Delaware | 6-10 years | If a patient changes care from 1 physician to another and fails to notify the former physician, or leaves the care of the former physician for a period of 7 years from the last entry date on the patient's record and fails to notifyor request the trasnfer of records from the former physician, then the former physician is required to maintain the patient's records for a period of 7 years from the last entry date in the patient's medical record, after which time the records may be permanently disposed of in a manner that insures confidentiality of the records: 24 Del.C. § 1761 |
District of Columbia | 1-5 years | Physicians must retain patient medical records for 3 years: District of Columbia Municipal Regulations tit. 17 § 4612 |
Florida | 1-5 years | A physician must maintain written medical records for a period of 5 years from the last patient contact: Florida Administrative Code §§ 64B8-10.002 |
Georgia | 6-10 years | A health care provider, which includes a licensed physician, must retain information contained in a patient's medical record for no less than 10 years from the date such item was created: Code of Georgia § 31-33-2. |
Hawaii | 6-10 years | Health care providers must retain medical records for at least 7 years unless it is for a minor in which case the records must be maintained for the time the individual is a minor plus 7 years after the minor turns the age of majority: HRS § 622-58 |
Idaho | No time period specified | |
Illinois | No time period specified | |
Indiana | 6-10 years | Physicians must retain patient medical records for 7 years: Indiana Code § 16-39-7-1 |
Iowa | 6-10 years | Physicians must maintain medical records for at least 7 years: Iowa Admin. Code 653-13.7 |
Kansas | 6-10 years | Physicians must retain patient medical records for 10 years: Kansas Administrative Regulations § 100-24-2 |
Kentucky | 6-10 years | Every provider who is required to file a health care provider tax, including physicians, must keep medical records for at least 6 years from the making of records unless the department in writing authorizes their destruction at an earlier date: Kentucky Revised Statutes § 142.341 |
Louisiana | 6-10 years | Physicians must retain patient medical records for years: Louisiana Statutes § 40:1299.96 |
Maine | No time period specified | |
Maryland | 1-5 years | Health care providers must retain medical records for 5 years after the record is made: MD. CODE ANN., HEALTH-GEN. § 4-403 |
Massachusetts | 6-10 years | The physician must keep the record for at least 7 years from the date of the last encounter with the patient or until the patient reaches the age of 9 (if more than 7 years): 243 MA ADC 2.07 |
Michigan | 6-10 years | A physician must keep and maintain records for each patient for at least 7 years after the patient’s last visit: M.C.L.A. §333.16213 |
Minnesota | No time period specified | |
Mississippi | 6-10 years | Physicians must retain the patient record for 7 years from the date the record was completed or from the time that the controlled substances or drugs were prescribed or administered: 30-17-2640 Miss. Code R. § 1.4 |
Missouri | 6-10 years | Physicians must maintain records for 7 years from the date of the last service: V.A.M.S. 334.097 |
Montana | 1-5 years | Physicians must retain medical records for 3 years: MONT. CODE ANN. § 50-16-525 |
Nebraska | No time period specified | |
Nevada | 1-5 years | Physicians must retain medical records for 5 years: Nev. Rev. Stat. § 629.051 |
New Hampshire | 6-10 years | The licensee shall retain a complete copy of all patient medical records for at least 7 years from the date of the patient’s last contact with the licensee, unless, before that date, the patient has requested that the file be transferred to another health provider: N.H. Code R. Med 501.02 |
New Jersey | 6-10 years | Physicians must maintain medical records for 7 years: N.J.A.C. 13-35-6.5 |
New Mexico | 6-10 years | Physicians must retain patient medical records for at least 10 years after the date of last treatment, or as set forth by medical assistance programs: N.M. Admin. Code 16.10.17.10 |
New York | 6-10 years | Physicians must maintain patient records for at least 6 years: N.Y. Comp. Codes R. & Regs. tit. 8 § 29.2 |
North Carolina | No time period specified | |
North Dakota | No time period specified | |
Ohio | 1-5 years | The provider of a health care service, which includes a physician, must maintain a medical record for each patient for 5 years from the date of discharge: Ohio Admin. Code 3701-84-11 |
Oklahoma | No time period specified | |
Oregon | No time period specified | |
Pennsylvania | 6-10 years | Physicians must retain patients’ medical records for at least 7 years after the date of the last medical service; medical records of minor patients must be retained for 1 year after majority: 49 PA. CODE § 16.95 |
Rhode Island | 1-5 years | Physicians (or their authorized agents) must store medical records for at least 5 years unless otherwise required by law or regulation: 31-5-41 R.I. Code R. § 11 |
South Carolina | 6-10 years | Physicians must retain medical records for 10 years: S.C. CODE ANN. § 44-115-120 |
South Dakota | 6-10 years | A health care provider participating in the Medicaid program must retain patient records 6 years after the last claim is paid or denied: S.D. ADMIN. R. 67:16:34:05 |
Tennessee | 6-10 years | Physicians must retain medical records for at least 10 years from the last contact with the patient: Tenn. Comp. R. & Regs. 0880-02-.15 |
Texas | 6-10 years |
Physicians must retain medical records for 7 years: 22 Tex. Admin. Code § 165.1 |
Utah | No time period specified | |
Vermont | No time period specified | |
Virginia | 1-5 years | Health care providers must retain patient medical records for 5 years: 18 Va. Admin. Code § 85-20-26 |
Washington | 1-5 years |
Health care providers must maintain existing patient health care records for at least one year following an authorization to disclose that health care information, and during a pending request for examination and copying or request for correction or amendment: Wash. Rev. Code § 70.02.160 |
West Virginia | No time period specified | |
Wisconsin | 1-5 years | Physicians must retain medical records for 5 years: Wisconsin Administrative Code MED §21.03 |
Wyoming | 6-10 years |
Medicaid participating providers and facilities must retain medical records for 6 years after the end of the state fiscal year in which payment for services was rendered: 3 WYO. CODE R. HLTH MDCD § 7 |

Click on a state to see more information on Care Coordination/Care Management in that state
- HIE is a joint effort of a previously existing state agency and a newly created organization
- State government directly runs the HIE via an existing agency
- An organization is created to manage and operate the HIE
- State government contracts HIE capabilities to an existing HIO(s)
- No recent information on operating structure available
Hide All
State | State Designated Entities (SDE) to Oversee Health Information Exchange (HIE) | Details |
---|---|---|
Alabama | State government directly runs the HIE via an existing agency | The Alabama Medicaid Agency works with the Governor-appointed Alabama Health Information Exchange Advisory Commission |
Alaska | An organization is created to manage and operate the HIE | The Alaska eHealth Network (AeHN) |
Arizona | HIE is a joint effort of a previously existing state agency and a newly created organization | The existing Arizona Strategic Enterprise Technology (ASET) office and the newly created Arizona Health-e Connection (AzHeC)'s HIE Marketplace program |
Arkansas | State government directly runs the HIE via an existing agency | The Arkansas Office of Health Information Technology |
California | State government contracts HIE capabilities to an existing HIO(s) | The California Office of Health Information Integrity (CalOHII) coordinates with the California Department of Public Health, as well as other state entities, to operate through a public-private partnership |
Colorado | An organization is created to manage and operate the HIE | Colorado Regional Health Information Organization (CORHIO) |
Connecticut | No recent information on operating structure available | CT uses the Rhode Island RIQI system, and subsequently does not have a dedicated system of its own |
Delaware | An organization is created to manage and operate the HIE | Delaware Health Information Network (DHIN) |
Florida | HIE is a joint effort of a previously existing state agency and a newly created organization | The newly created Florida Health Information Exchange and the existing Florida Agency for Health Care Administration |
Georgia | State government contracts HIE capabilities to an existing HIO(s) | Georgia Health Information Exchange (GHIE) |
Hawaii | An organization is created to manage and operate the HIE | Hawaii Health Information Exchange |
Idaho | No recent information on operating structure available | |
Illinois | State government directly runs the HIE via an existing agency | Illinois Health Information Exchange (ILHIE) |
Indiana | State government contracts HIE capabilities to an existing HIO(s) | Indiana Health Information Technology (IHIT) |
Iowa | State government directly runs the HIE via an existing agency | Iowa Health Information Network created by the Iowa Department of Public Health |
Kansas | State government directly runs the HIE via an existing agency | Kansas Health Information Technology (KanHIT) housed in the Kansas Department of Health and Environment |
Kentucky | State government directly runs the HIE via an existing agency | Kentucky Health Information Exchange (KHIE) |
Louisiana | State government contracts HIE capabilities to an existing HIO(s) | Louisiana Health Information Exchange (LaHIE) run by the Louisiana Health Care Quality Forum (LHCQF) |
Maine | State government contracts HIE capabilities to an existing HIO(s) | HealthInfoNet |
Maryland | An organization is created to manage and operate the HIE | Chesapeake Regional Information System for our Patients (CRISP) |
Massachusetts | An organization is created to manage and operate the HIE | Massachusetts eHealth Institute (MeHI) (created prior to 2009) |
Michigan | An organization is created to manage and operate the HIE | Michigan Health Information Network (MiHIN) |
Minnesota | An organization is created to manage and operate the HIE | Minnesota e-Health Connect |
Mississippi | An organization is created to manage and operate the HIE | Mississippi Health Information Network (MS-HIN) |
Missouri | An organization is created to manage and operate the HIE | Missouri Health Connection |
Montana | State government contracts HIE capabilities to an existing HIO(s) | HealthShareMontana |
Nebraska | No recent information on operating structure available | |
Nevada | State government directly runs the HIE via an existing agency | Office of Health Information Technology (OHIT) in the Nevada Department of Health and Human Services (DHHS) |
New Hampshire | An organization is created to manage and operate the HIE | New Hampshire Health Information Organization (NH-HIO) |
New Jersey | State government contracts HIE capabilities to an existing HIO(s) | New Jersey Health Information Network (NJH) |
New Mexico | State government contracts HIE capabilities to an existing HIO(s) | New Mexico Health Information Collaborative (NMHIC) |
New York | An organization is created to manage and operate the HIE | New York eHealth Collaborative (NYeC) |
North Carolina | An organization is created to manage and operate the HIE | North Carolina Health Information Exchange |
North Dakota | State government directly runs the HIE via an existing agency | North Dakota Health Information Technology |
Ohio | An organization is created to manage and operate the HIE | CliniSync: Ohio Health Information Partnership |
Oklahoma | State government directly runs the HIE via an existing agency | Oklahoma Health Information Exchange through the Oklahoma Health Care Authority |
Oregon | HIE is a joint effort of a previously existing state agency and a newly created organization | CareAccord, Oregon's Health Information Exchange |
Pennsylvania | An organization is created to manage and operate the HIE | Pennsylvania eHealth Partnership Authority |
Rhode Island | State government contracts HIE capabilities to an existing HIO(s) | Rhode Island Quality Institute (RIQI): Rhode Island Health Information Exchange |
South Carolina | An organization is created to manage and operate the HIE | South Caroline Health Information Exchange (SCHIEx) |
South Dakota | An organization is created to manage and operate the HIE | South Dakota Health Link (SDHL), formerly the South Dakota eHealth Collaborative |
Tennessee | State government directly runs the HIE via an existing agency | Tennessee Office of e-Health Initiatives |
Texas | State government contracts HIE capabilities to an existing HIO(s) | Texas Health Services Authority oversight |
Utah | An organization is created to manage and operate the HIE | Utah Clinical Health Information Exchange (cHIE) |
Vermont | An organization is created to manage and operate the HIE | Vermont Information Technology Leaders, Inc. |
Virginia | An organization is created to manage and operate the HIE | ConnectVirginia |
Washington | HIE is a joint effort of a previously existing state agency and a newly created organization | Health Care Authority Washington & OneHealthPort |
West Virginia | An organization is created to manage and operate the HIE | West Virginia Health Information Network (WVHIN) |
Wisconsin | State government contracts HIE capabilities to an existing HIO(s) | Wisconsin State Health Information Network (WISHIN) |
Wyoming | An organization is created to manage and operate the HIE | Wyoming e-Health Partnership |
