I am often asked how long a practice must maintain medical records. The answer depends on the type of provider you are and your risk tolerance. Providers should generally consider the following in establishing their record retention policies:

1. Patient care. The primary consideration should be patient care. Some practices (e.g., oncology) may want to retain medical records longer than the relevant regulatory requirement or statute of limitations period because the records may be important to future patient care. If your electronic records program allows, you may want to retain the records permanently.

2. Statutory or Regulatory Requirements. State and federal regulations require hospitals and certain other institutional providers to maintain medical records for specified periods, but those laws usually do not apply directly to physicians or physician groups. There are numerous guides online. For example, HealthIT.gov published a 50-state survey of record retention requirements. The Idaho Department of Health and Welfare published a helpful but incomplete summary of federal record retention regulations. CMS published a MedLearn article on record retention. AHIMA is usually a good source for online guidance about record retention laws and regulations.

3. Accreditation, payer or other contract requirements. Some provider contracts, payer requirements, or accreditation standards may require providers to keep records for a certain time. For example, Idaho’s Medicaid Provider Handbook requires providers to maintain records to support claims for five years. Check your relevant contracts to ensure your record retention policies comply with any such requirements. You may also want to check with your liability insurer to determine if they have any record retention requirements or suggestions.

4. Statute of limitations. If there are no more paramount concerns, physicians should generally retain medical records for at least the applicable statute of limitations period to ensure the practice has the records necessary to defend its care or charges if challenged. In most cases, maintaining the records for ten (10) years should get you past relevant state or federal limitations periods, including those for malpractice, contract, or fraud and abuse claims. Beware that many states toll the statute of limitations period for claims by minors; if so, you may want to keep records of minors until the later of either (i) six years after the date of treatment, or (ii) three years after the minor reaches the age of majority, depending on your applicable state statute of limitations for malpractice claims.

If your records are subject to a pending claim or investigation, you should retain the records through the resolution of the claim or investigation. Destroying records that are subject to pending claims or investigations may result in liability under state or federal laws; common law claims for destruction of evidence; or adverse judgments because you lack the evidence to defend yourself.