Skip to Content

Medical Records Collection, Retention, and Access

Medical records are those records kept on individual patients by providers that include health history, diagnostic information, and provider notes, among other pieces of data. Medical records can be kept on paper or electronically. This topic covers records maintenance as a condition of provider licensure, recordkeeping requirements for a variety of facilities, and laws governing record retention and ownership, access to records, data collection, and storage and destruction. 



Click on a state to see more information on Medical Records Collection, Retention, and Access in that state


Retention Periods
  • 1-5 years
  • 6-10 years
  • > 10 years
  • No time period specified



Hide All

StateRetention PeriodsDetails
AlabamaNo time period specified

Medical records must be maintained by the treating physician for as long as may be necessary to treat the patient and for additional time as may be required for medical legal purposes.”  Ala. Admin. Code r. 545-X-4-.08

 

AlaskaNo time period specified
Arizona6-10 years

Physicians must maintain patient medical records for 6 years:  Arizona Revised Statutes § 12-2297

Arkansas1-5 years

Physicians, dentists, and other health care providers authorized to administer narcotic drugs must keep a record of each drug administered for 2 years from the date of administration: Arkansas Code § 20-64-209

Medicaid participating health care providers must maintain medical records for at least 5 years:  Arkansas Code § 20-77-907

CaliforniaNo time period specified
ColoradoNo time period specified
Connecticut6-10 years

Each licensed physician must retain medical records for 7 years from the last date of treatment, or for 3 years upon the death of the patient:  Regulations of Connecticut State Agencies § 19a-14-42

Delaware6-10 years

If a patient changes care from 1 physician to another and fails to notify the former physician, or leaves the care of the former physician for a period of 7 years from the last entry date on the patient's record and fails to notifyor request the trasnfer of records from the former physician, then the former physician is required to maintain the patient's records for a period of 7 years from the last entry date in the patient's medical record, after which time the records may be permanently disposed of in a manner that insures confidentiality of the records:  24 Del.C. § 1761

District of Columbia1-5 years

Physicians must retain patient medical records for 3 years:  District of Columbia Municipal Regulations tit. 17 § 4612

Florida1-5 years

A physician must maintain written medical records for a period of 5 years from the last patient contact:  Florida Administrative Code §§ 64B8-10.002

Georgia6-10 years

A health care provider, which includes a licensed physician, must retain information contained in a patient's medical record for no less than 10 years from the date such item was created:  Code of Georgia § 31-33-2. 

Hawaii6-10 years

Health care providers must retain medical records for at least 7 years unless it is for a minor in which case the records must be maintained for the time the individual is a minor plus 7 years after the minor turns the age of majority: HRS § 622-58

IdahoNo time period specified
IllinoisNo time period specified
Indiana6-10 years

Physicians must retain patient medical records for 7 years:  Indiana Code § 16-39-7-1

Iowa6-10 years

Physicians must maintain medical records for at least 7 years:  Iowa Admin. Code 653-13.7

Kansas6-10 years

Physicians must retain patient medical records for 10 years:  Kansas Administrative Regulations § 100-24-2

Kentucky6-10 years

Every provider who is required to file a health care provider tax, including physicians, must keep medical records for at least 6 years from the making of records unless the department in writing authorizes their destruction at an earlier date:  Kentucky Revised Statutes § 142.341

Louisiana6-10 years

Physicians must retain patient medical records for  years:  Louisiana Statutes § 40:1299.96

MaineNo time period specified
Maryland1-5 years

Health care providers must retain medical records for 5 years after the record is made:  MD. CODE ANN., HEALTH-GEN. § 4-403

Massachusetts6-10 years

The physician must keep the record for at least 7 years from the date of the last encounter with the patient or until the patient reaches the age of 9 (if more than 7 years):  243 MA ADC 2.07

Michigan6-10 years

A physician must keep and maintain records for each patient for at least 7 years after the patient’s last visit:  M.C.L.A. §333.16213

MinnesotaNo time period specified
Mississippi6-10 years

Physicians must retain the patient record for 7 years from the date the record was completed or from the time that the controlled substances or drugs were prescribed or administered:  30-17-2640 Miss. Code R. § 1.4

Missouri6-10 years

Physicians must maintain records for 7 years from the date of the last service:  V.A.M.S. 334.097

Montana1-5 years

Physicians must retain medical records for 3 years: MONT. CODE ANN. § 50-16-525

NebraskaNo time period specified
Nevada1-5 years

Physicians must retain medical records for 5 years:  Nev. Rev. Stat. § 629.051

New Hampshire6-10 years

The licensee shall retain a complete copy of all patient medical records for at least 7 years from the date of the patient’s last  contact with the licensee, unless, before that date, the patient has requested that the file be transferred to another health provider: N.H. Code R. Med 501.02

New Jersey6-10 years

Physicians must maintain medical records for 7 years: N.J.A.C. 13-35-6.5

New Mexico6-10 years

Physicians must retain patient medical records for at least 10 years after the date of last treatment, or as set forth by medical assistance programs:  N.M. Admin. Code 16.10.17.10

New York6-10 years

Physicians must maintain patient records for at least 6 years: N.Y. Comp. Codes R. & Regs. tit. 8 § 29.2

North CarolinaNo time period specified
North DakotaNo time period specified
Ohio1-5 years

The provider of a health care service, which includes a physician, must maintain a medical record for each patient for 5 years from the date of discharge:  Ohio Admin. Code 3701-84-11

OklahomaNo time period specified
OregonNo time period specified
Pennsylvania6-10 years

Physicians must retain patients’ medical records for at least 7 years after the date of the last medical service; medical records of minor patients must be retained for 1 year after majority:  49 PA. CODE § 16.95

Rhode Island1-5 years

Physicians (or their authorized agents) must store medical records for at least 5 years unless otherwise required by law or regulation:  31-5-41 R.I. Code R. § 11

South Carolina6-10 years

Physicians must retain medical records for 10 years:  S.C. CODE ANN. § 44-115-120

South Dakota6-10 years

A health care provider participating in the Medicaid program must retain patient records 6 years after the last claim is paid or denied:  S.D. ADMIN. R. 67:16:34:05

Tennessee6-10 years

Physicians must retain medical records for at least 10 years from the last contact with the patient:  Tenn. Comp. R. & Regs. 0880-02-.15 

Texas6-10 years

 

Physicians must retain medical records for 7 years: 22 Tex. Admin. Code § 165.1

UtahNo time period specified
VermontNo time period specified
Virginia1-5 years

Health care providers must retain patient medical records for 5 years: 18 Va. Admin. Code § 85-20-26

Washington1-5 years

 

Health care providers must maintain existing patient health care records for at least one year following an authorization to disclose that health care information, and during a pending request for examination and copying or request for correction or amendment:  Wash. Rev. Code § 70.02.160

West VirginiaNo time period specified
Wisconsin1-5 years

Physicians must retain medical records for 5 years:  Wisconsin Administrative Code MED §21.03 

Wyoming6-10 years

 

Medicaid participating providers and facilities must retain medical records for 6 years after the end of the state fiscal year in which payment for services was rendered:  3 WYO. CODE R. HLTH MDCD § 7

Myth Buster: Patients must always wait and get their clinical lab test results back from their provider only



Current View

Fast Facts: Patients’ Right to Access Lab Reports under New CLIA Regulations



Current View



Click on a state to see more information on Care Coordination/Care Management in that state


State Designated Entities (SDE) to Oversee Health Information Exchange (HIE)
  • HIE is a joint effort of a previously existing state agency and a newly created organization
  • State government directly runs the HIE via an existing agency
  • An organization is created to manage and operate the HIE
  • State government contracts HIE capabilities to an existing HIO(s)
  • No recent information on operating structure available



Hide All

StateState Designated Entities (SDE) to Oversee Health Information Exchange (HIE)Details
AlabamaState government directly runs the HIE via an existing agency

The Alabama Medicaid Agency works with the Governor-appointed Alabama Health Information Exchange Advisory Commission 

AlaskaAn organization is created to manage and operate the HIE

The Alaska eHealth Network (AeHN) 

ArizonaHIE is a joint effort of a previously existing state agency and a newly created organization

The existing Arizona Strategic Enterprise Technology (ASET) office and the newly created Arizona Health-e Connection (AzHeC)'s HIE Marketplace program 

ArkansasState government directly runs the HIE via an existing agency

The Arkansas Office of Health Information Technology 

CaliforniaState government contracts HIE capabilities to an existing HIO(s)

The California Office of Health Information Integrity (CalOHII) coordinates with the California Department of Public Health, as well as other state entities, to operate through a public-private partnership

ColoradoAn organization is created to manage and operate the HIE

Colorado Regional Health Information Organization (CORHIO)

ConnecticutNo recent information on operating structure available

CT uses the Rhode Island RIQI system, and subsequently does not have a dedicated system of its own

DelawareAn organization is created to manage and operate the HIE

Delaware Health Information Network (DHIN)

FloridaHIE is a joint effort of a previously existing state agency and a newly created organization

The newly created Florida Health Information Exchange and the existing Florida Agency for Health Care Administration

GeorgiaState government contracts HIE capabilities to an existing HIO(s)

Georgia Health Information Exchange (GHIE)

HawaiiAn organization is created to manage and operate the HIE

Hawaii Health Information Exchange

IdahoNo recent information on operating structure available
IllinoisState government directly runs the HIE via an existing agency

Illinois Health Information Exchange (ILHIE)

IndianaState government contracts HIE capabilities to an existing HIO(s)

Indiana Health Information Technology (IHIT)

IowaState government directly runs the HIE via an existing agency

Iowa Health Information Network created by the Iowa Department of Public Health

KansasState government directly runs the HIE via an existing agency

Kansas Health Information Technology (KanHIT) housed in the Kansas Department of Health and Environment

KentuckyState government directly runs the HIE via an existing agency

Kentucky Health Information Exchange (KHIE)

LouisianaState government contracts HIE capabilities to an existing HIO(s)

Louisiana Health Information Exchange (LaHIE) run by the Louisiana Health Care Quality Forum (LHCQF)

MaineState government contracts HIE capabilities to an existing HIO(s)

HealthInfoNet

MarylandAn organization is created to manage and operate the HIE

Chesapeake Regional Information System for our Patients (CRISP)

MassachusettsAn organization is created to manage and operate the HIE

Massachusetts eHealth Institute (MeHI) (created prior to 2009)

MichiganAn organization is created to manage and operate the HIE

Michigan Health Information Network (MiHIN)

MinnesotaAn organization is created to manage and operate the HIE

Minnesota e-Health Connect

MississippiAn organization is created to manage and operate the HIE

Mississippi Health Information Network (MS-HIN)

MissouriAn organization is created to manage and operate the HIE

Missouri Health Connection

MontanaState government contracts HIE capabilities to an existing HIO(s)

HealthShareMontana

NebraskaNo recent information on operating structure available
NevadaState government directly runs the HIE via an existing agency

Office of Health Information Technology (OHIT) in the Nevada Department of Health and Human Services (DHHS)

New HampshireAn organization is created to manage and operate the HIE

New Hampshire Health Information Organization (NH-HIO)

New JerseyState government contracts HIE capabilities to an existing HIO(s)

New Jersey Health Information Network (NJH)

New MexicoState government contracts HIE capabilities to an existing HIO(s)

New Mexico Health Information Collaborative (NMHIC)

New YorkAn organization is created to manage and operate the HIE

New York eHealth Collaborative (NYeC)

North CarolinaAn organization is created to manage and operate the HIE

North Carolina Health Information Exchange

North DakotaState government directly runs the HIE via an existing agency

North Dakota Health Information Technology 

OhioAn organization is created to manage and operate the HIE

CliniSync: Ohio Health Information Partnership

OklahomaState government directly runs the HIE via an existing agency

Oklahoma Health Information Exchange through the Oklahoma Health Care Authority

OregonHIE is a joint effort of a previously existing state agency and a newly created organization

CareAccord, Oregon's Health Information Exchange

PennsylvaniaAn organization is created to manage and operate the HIE

Pennsylvania eHealth Partnership Authority

Rhode IslandState government contracts HIE capabilities to an existing HIO(s)

Rhode Island Quality Institute (RIQI): Rhode Island Health Information Exchange 

South CarolinaAn organization is created to manage and operate the HIE

South Caroline Health Information Exchange (SCHIEx)

South DakotaAn organization is created to manage and operate the HIE

South Dakota Health Link (SDHL), formerly the South Dakota eHealth Collaborative

TennesseeState government directly runs the HIE via an existing agency

Tennessee Office of e-Health Initiatives

TexasState government contracts HIE capabilities to an existing HIO(s)

Texas Health Services Authority oversight

UtahAn organization is created to manage and operate the HIE

Utah Clinical Health Information Exchange (cHIE)

VermontAn organization is created to manage and operate the HIE

Vermont Information Technology Leaders, Inc.

VirginiaAn organization is created to manage and operate the HIE

ConnectVirginia

WashingtonHIE is a joint effort of a previously existing state agency and a newly created organization

Health Care Authority Washington & OneHealthPort

West VirginiaAn organization is created to manage and operate the HIE

West Virginia Health Information Network (WVHIN)

WisconsinState government contracts HIE capabilities to an existing HIO(s)

Wisconsin State Health Information Network (WISHIN)

WyomingAn organization is created to manage and operate the HIE

Wyoming e-Health Partnership

Syndicate content