Cambridge University Hospitals states that since 1998 it has imaged records for patients who haven't attended for 4 years and retained that image for 30 years, according to the Cambridge University Hospitals records retention schedule. That single example reframes retention of medical records for a personal injury firm. Retention isn't one deadline. It's a set of clocks tied to record type, provider type, patient age, and the event that starts the count. Treat the shortest clock as a destruction date and you'll lose evidence you still need. Treat every minimum as a preservation floor and you'll ask the right question first. Which record is this, who created it, and what is the latest date that applies?
Retention Periods at a Glance by Record Type
A disposal date set from memory is a malpractice problem waiting for a file to prove it. Start with the record category, not the patient's name or the date you received the file, because category determines which authority controls and which event starts the clock.
| Record category | Minimum or typical period | Governing source | Notes |
|---|---|---|---|
| HIPAA policies, procedures and related documentation | 6 years from creation or last effective date, whichever is later | HIPAA Privacy and Security Rules | Compliance documents, not the medical chart itself |
| Accounting of disclosures | 6 years | HIPAA Privacy Rule | Keep with the disclosure log |
| Hospital medical records | 5 years after discharge to permanent retention; 10 years most common | State statutes, with 45 states regulating hospital retention | State and facility type set the period |
| Physician office records | Set by state statute and licensing rules, which vary by state | State statutes, with 27 states regulating physician retention | State and physician licensing rules set the period |
| Institutional legal medical record example | 21 years after last date of service | Columbia University hospital policy | Institutional policy that exceeds the typical state range |
| Records of minor patients | Adult period or until age of majority plus added years, whichever state law makes later | State law | Confirm the age rule and added years in the statute |
| Records of deceased patients | The adult period stated in state law, measured from the start date that law specifies | State law | Confirm period and start date before disposal |
How to Read Each Row
The first two rows aren't patient charts at all. They're the compliance paperwork around a chart, and they're the only rows where HIPAA itself supplies a fixed period. If you're looking for the rule for a client's emergency department chart or treating physician's notes, don't stop there.
The hospital and physician rows show why a national answer doesn't exist. Two providers who treated the same client for the same injury can hold records under different state rules, different facility rules, and different trigger dates. The hospital may count from discharge. The physician may count from last service. Those dates can be months apart even when the stated number of years looks identical, and the earlier-destroying record is usually the one a defense expert asks for first.
Columbia's institutional row is the useful warning against shortcuts. A provider's own policy can run far longer than the state range you'd expect, which means a record you assume is gone may still exist. It also means the reverse. You can't infer one hospital's schedule from another hospital in the same state.
For minors and deceased patients, don't fill the blank from memory. State law controls, and states often write a separate age-based or post-death rule. A schedule that records only a treatment date will miscalculate a minor's record because the end date may turn on a birthday.
Practical rule: Every value in this table is a minimum or a typical period. None of them is permission to destroy a record on that date.
The Three Step Check
- Identify the record type. Separate compliance documentation, the provider chart, imaging, billing, and your firm's copy.
- Find the governing state rule. Match the rule to provider type and patient category, not just to the state.
- Confirm the period in the current statute. Record the citation, trigger event, and verification date before you set a disposal date.
Step three is where firms get casual. A statute's trigger event matters as much as its number of years: a ten year period measured from discharge ends differently than ten years measured from last treatment, and imaging or billing records may sit under a separate clock than the chart they document. Write down the citation and the event you counted from. If destruction is later questioned, that note is the difference between a defensible schedule and a guess.
The Federal Floor Under HIPAA
HIPAA separates into two obligations that firms routinely merge. The Columbia University HIPAA record retention grid lists 6 years as the legal minimum for HIPAA accounting of disclosures records, while noting its hospitals retain the legal medical record for 21 years after the last date of service. That contrast is the whole point. One clock governs compliance documentation. Another, set elsewhere, governs the chart.
The diagram below separates the federal floor from the start point that firms most often misstate.
What the Six Year Floor Covers
Covered entities must retain required privacy and security policies, procedures, communications, and related documentation for at least six years from creation or from the date the document was last in effect, whichever is later. An accounting of disclosures carries the same six year minimum. A policy retired and replaced doesn't become disposable on the replacement date. Its clock runs from when it was last in effect.
That floor doesn't tell a hospital when it may destroy a patient's chart. State laws, licensing rules, malpractice statutes, payer requirements, institutional policies, and the patient's age can all require longer retention. A firm that applies a single six year purge date to everything in a file will eventually destroy material under a longer duty.
Which Authority Wins
Apply this check order to every record set, then keep the record until the latest resulting date.
- Federal floor. Does HIPAA set a period for this compliance document category?
- State statute. What period applies to this facility type in the state where care occurred?
- Licensing rules. Does a board rule add a period for this profession or specialty?
- Payer and contract terms. Does a participation agreement preserve records for audit beyond the state period?
- Institutional policy. Has the provider adopted a longer schedule of its own?
- Patient specific duties. Does minority, incapacity, or another status extend the date?
Federal hospital conditions interplay with this analysis, including the medical record services requirements discussed in our guide to 42 CFR 482.24. Read the federal condition alongside the state rule rather than treating either one as the complete answer.
Safeguards don't expire when a retention minimum does. Administrative, technical, and physical protections continue for as long as you hold protected health information and through disposal. If records sit with a cloud vendor during that period, the hosting arrangement needs the same scrutiny as your own servers, and the Cloudvara guide to HIPAA hosting is a useful reference for what compliant hosting should include.
How State Statutes Set Hospital and Physician Periods
State verification is tedious work, and it's the work that makes a schedule defensible. I wouldn't let a paralegal pull a period from a secondary summary and enter it as final. Summaries go stale, and they often quote the hospital rule when your record came from a physician practice, or the reverse.
A Verification Sequence You Can Repeat
- Identify each provider type. List hospital, physician group, nursing facility, and ambulatory surgery center separately. One patient's care usually crosses several types.
- Locate the controlling text. Find the state statute or administrative code for that provider type. Hospital licensing rules and medical board rules often live in different titles.
- Check special categories. Look for separate provisions for minors, deceased patients, obstetric records, and psychiatric records. States frequently pull these out of the general rule.
- Separate imaging and billing. Confirm whether films, scans, and billing ledgers follow the chart period or carry their own. Don't assume a chart rule covers the images a causation expert needs.
- Pin down the trigger. Note whether the statute counts from last date of service, discharge date, or date the record was created. Same number of years, different end date.
- Record your source. Enter the citation, trigger date, calculated end date, and the date you verified the text. Initial it.
Pitfalls That Produce Wrong Dates
Statutes get amended. A period you verified for a disposal two years ago may not be the period that applies today, so recheck the text before each destruction batch. That recheck takes minutes. Defending a premature destruction takes far longer.
Silence is the second trap. A state may regulate hospitals and say nothing general about a particular outpatient category. Document that gap as unverified and escalate it. Don't convert silence into an assumed period, and don't borrow the hospital number to fill the space.
Care delivered across state lines adds a third trap. The state where care was given generally supplies the retention rule, but counsel should confirm that for the specific provider and record type. A client injured while traveling may have an emergency record under one state's rule and follow up records under another's.
Telehealth creates the same problem in quieter form. The encounter note may sit in a platform record while the treating clinician's own chart sits elsewhere. Identify both custodians before you conclude you hold the complete record.
A Provider Level Checklist
Keep one short entry for each provider in the file.
- Provider and type. Legal name, facility category, and state of care.
- Citation. Statute or code section, checked on a stated date.
- Trigger and end date. The event, the actual date, and the calculated result.
- Special category flag. Minor, obstetric, psychiatric, imaging, or billing.
- Custodian contact. Who answers record requests today, including after a merger or closure.
That entry becomes the first thing you hand a new case manager. It also becomes your evidence that the schedule came from a source rather than from habit.
Triggers That Extend Retention Beyond the Legal Minimum
A 2025 federal comparison of state law reported through the 2025 federal state law access report found that 45 states expressly regulate hospital retention and 27 regulate physician retention, with hospital periods ranging from five years after discharge to permanent retention and 10 years the most common period. Even a perfectly identified period answers only one question. It tells you the earliest point at which a provider's statutory duty may end. It doesn't prove the record still exists, and it doesn't prove destruction was proper.
The timeline below shows the duties that can push a date past that statutory floor.
The Triggers Firms Miss
Statute of limitations. Your client's claim may remain timely long after a provider's minimum expires. When that happens, the record is evidence under your control, and your firm's copy may become the only complete copy.
Discovery rule. A latent injury can start the limitations clock when the client discovers the harm rather than when treatment occurred. Surgical complications, progressive conditions, and delayed diagnoses all create that pattern. Destroying early treatment records on a provider schedule can remove the very pages that establish when symptoms began.
Minority tolling. A child's claim often can't be resolved on an adult timetable. The chart has to survive the tolling period and the litigation that follows it.
Anticipated litigation and subpoenas. Once a claim or dispute is reasonably anticipated, preservation duties attach to relevant material. A pending subpoena overrides a routine purge without exception.
Litigation hold. A hold issued by counsel freezes the records it covers. Staff don't get to weigh the hold against storage cost or a default schedule.
Audits, liens, and appeals. An insurer audit, a disputed medical lien, or a pending appeal can each require the underlying pages after the main claim looks finished. Closing the liability file doesn't close those duties.
Provider closure or transfer. A merger, acquisition, or practice closure moves custody and sometimes moves the records into a successor system. Your copy and your custodian contact both need updating at that moment, not when a later request bounces.
The short video below walks through how preservation duties change once litigation is anticipated.
A Worked Example
Say a child is injured at age 10 and treated at a hospital and two physician practices. The shortest provider period in that group might expire while the child is still in school. Minority tolling keeps the claim alive into adulthood, and the damages proof depends on growth, development, and later treatment that must be compared against the original chart. If your firm destroyed its copies on the earliest provider date, you'd be asking providers for records they may lawfully no longer hold.
The decision rule prevents that outcome. List every applicable date for each record set. Keep the record until the latest date. Write down the reason that date controls. A provider can be fully compliant with its own minimum while your firm still needs the record for causation and damages. Those are separate duties, and conflating them is how evidence disappears without anyone breaking a rule.
Building a Firm Retention Policy and Schedule
Text in the HHS HIPAA medical record retention FAQ confirms that HIPAA doesn't establish a universal retention period for patients' medical records and that state law and other legal or contractual requirements generally govern. For a personal injury firm, that makes your written policy the control. Without one, retention decisions get made by whoever needs storage space.
What the Policy Must Contain
Start with scope and definitions. Say which records the policy covers and define case file, provider original, firm copy, imaging record, billing ledger, and derived summary. Staff can't apply different rules to categories the policy never distinguishes.
Name the roles. The responsible attorney owns retention decisions on the matter. The records custodian maintains the schedule, runs reviews, and files destruction proof. The IT administrator controls access, audit logging, backups, and deletion from systems staff can't reach. State who can place a legal hold and who alone can release one. I would never let the person requesting destruction also approve it.
Then set the operating rules. Cover the retention schedule, the legal hold procedure, role based access, export and deletion logging, the review required before destruction, and approval authority. Add an annual review of the schedule against changes in state law, plus an immediate review when a relevant statute or limitation period changes.
The Schedule Fields That Matter
| Schedule field | What to record | Example entry |
|---|---|---|
| Record category | Case file, provider original or billing ledger | Provider original, hospital chart from a 2024 admission |
| Legal trigger | The event that starts the retention clock | Discharge date or last date of service |
| Retention end date | Latest of statutory period, limitation period and any hold | Calculated date, reviewed by the responsible attorney before disposal |
| Hold status | Whether a hold is active, its owner and release date | Hold active on the matter pending appeal, released by counsel |
| Access and disposal log | Who viewed, exported, transferred or destroyed the record and when | Export logged on the matter, destruction certificate filed |
A completed row reads like a decision, not a guess. For example, a hospital chart row would name the provider, cite the state rule, show discharge as the trigger, carry the later of the statutory end date and the appeal hold as the retention end date, and show hold status as active with the responsible attorney as releaser. Anyone reviewing that row can see why the record still exists.
The hardest habit to build is the distinction between your client's case file and the underlying provider record. Your copy follows your policy, your ethical duties, and the matter's posture. The provider's original follows the provider's governing law. Keep them as separate schedule rows even when the pages look identical, because destroying your copy doesn't affect the original and losing the original makes your copy irreplaceable.
The shortest default period never overrides a hold, a limitation period, or a pending subpoena.
That sentence belongs in the policy itself. It's the rule staff reach for when a system prompts them to purge on schedule and the matter isn't fully finished.
How to Store, Restrict and Destroy Records Safely
Good retention fails at the storage layer more often than at the legal layer. Firms calculate a sound end date, then keep the file in a shared drive that a departing employee can copy, or destroy the paper chart and leave the scan in an unlogged backup. Work through the procedure in order and don't skip steps because a file looks routine. Our detailed guidance on secure medical records storage covers the system requirements behind several of these steps.
The process below sets out the storage, access, and destruction sequence in visual form.
The Procedure
- Inventory and label every record. Mark each item as provider original, firm copy, or derived summary. Each label carries a different disposal rule, and an unlabeled PDF in a matter folder invites the wrong one.
- Check for holds and open periods. Confirm no legal hold, open limitation period, appeal, audit, or subpoena applies before anything enters a destruction queue. The common slip is checking the schedule date and skipping hold status.
- Store encrypted with role based access. Limit access to the case team and others with a defined need. We restrict access to PHI through role based access controls with audit logging, and your own systems should meet that same standard.
- Turn on audit logging and use it. Log every export, access grant, and transfer with user, date, and purpose. A log nobody reviews won't catch the bulk export that matters, so assign review of unusual activity to a named person.
- Get attorney sign off on the end date. The responsible attorney confirms the retention end date has passed and no trigger extends it. That sign off belongs in the file, dated, before destruction is scheduled.
- Destroy so restoration isn't possible. Cross cut shred or use certified pulping for paper. Use deletion methods for electronic files that prevent recovery, and include backups in the plan. Forgetting backups is the most frequent electronic slip. A file deleted from the matter folder but alive in three backup cycles hasn't been destroyed.
- File the destruction certificate. Record what was destroyed, under which authority, by whom, and on what date. Then confirm that any vendor holding copies deletes them too.
Vendor Copies and Derived Summaries
Vendor deletion deserves its own check because it runs on the vendor's clock, not yours. We keep customer content for the length of the subscription and up to 30 days after termination for data export, then securely delete it. Whatever platform you use, get the export window and deletion commitment in writing before the matter ends, and calendar the export deadline the day the contract starts.
Derived summaries create the opposite error. Teams destroy the summary at file closing and keep no source pages, or keep the summary and casually purge the pages it was built from. A summary without source pages can't be verified or defended. Keep the source document set for as long as the summary could be challenged, and keep the summary traceable to page and document.
Test retrieval while the file is quiet. Pick a stored record, restore it, and confirm it opens in a readable format with its metadata intact. Files stored in a retired format or a system you've migrated away from may be present and still be unusable when an expert asks for them.
Gaps That Weaken Medical Evidence and How to Document Them
A retained record isn't necessarily a usable record. Material submitted in the CMS 2025 0050 stakeholder comment describes records remaining fragmented across EHRs, health information networks, portals, scanned PDFs, imaging systems, and disconnected specialists even where they still exist. For litigation, that's the practical problem. You don't need proof a record exists somewhere. You need a complete, authenticated set you can put in front of an expert.
Gap Types and Your Response
| Gap in the record | Why it matters | Documentation step |
|---|---|---|
| Provider says the record was destroyed | Retention may have ended, but the destruction may still be questioned | Request the written retention policy and the destruction record |
| Portal export instead of full chart | The export may omit metadata, imaging or an audit trail | Request native records and audit logs in writing |
| Record held in another system | The record exists but is fragmented, so the chart looks incomplete | Document each system named and the escalation request made |
| Imaging or billing records missing | Causation and damages depend on imaging reports and charges | List the missing file type and request it separately |
| Provider delays or refuses release | Information blocking and access concerns may apply | Record dates of each request, response and any fee charged |
Work each row as an evidence problem. A destroyed record answer ends the records request, but it starts a different inquiry. Ask for the policy the provider relied on and the destruction record for that chart. If a hold, subpoena, or preservation letter predates destruction, that paper trail supports a spoliation analysis. If none existed, you have an honest gap to address in your causation proof rather than a surprise at deposition.
A portal export looks complete and often isn't. Problem lists and visit summaries render neatly while audit trails, amendment history, attachments, and imaging sit outside the export. Request native records, audit trails, and metadata in writing, and name the specific elements you need. Vague requests produce vague productions.
When a provider says another system holds the data, write down the system name, the person who told you, and the date. Then direct a separate request to that custodian. Radiology images may sit in a picture archiving system, therapy notes in a specialty platform, and billing in a revenue cycle system that the chart request never reaches.
Request Imaging and Billing Separately
Request imaging reports, the images themselves where an expert needs them, and billing ledgers as separate line items. Charges support special damages. A billing ledger also reveals encounters nobody mentioned, which can surface a provider missing from your chronology. Our guidance on handling incomplete medical records sets out how to spot those breaks before they reach an expert.
Build the Paper Trail as You Go
For every gap, record the date and method of each request, the response received, any fee charged, and your escalation contact. Federal information blocking rules prohibit practices that interfere with access, exchange, or use of electronic health information, yet delayed responses and disputed fees still occur. Your contemporaneous log is what turns frustration into a documented access problem you can raise in discovery.
Documentation habit: Write the gap note the day the response arrives. A note reconstructed months later from email threads won't carry the same weight.
Finally, check the copying chain. Any subcontractor or vendor handling protected health information while records move between provider, firm, and experts should be covered by a business associate agreement. We maintain business associate agreements with all subcontractors and service providers who may access PHI. Ask every vendor in your chain for the same commitment in writing, and keep it with the vendor file rather than in someone's inbox.
Confirm Your Retention Schedule Before Closing a File
File closing is where retention decisions become permanent, so give it a fixed closeout sequence. Don't let a closing checklist that covers trust accounting and client letters treat records as an afterthought. I'd run this audit before the next file closes, not at the next annual review.
The Closeout Sequence
- Audit the schedule against the record types. Walk your schedule row by row and flag every record set whose state citation is still unverified. Those sets don't move toward destruction until the citation is confirmed.
- List every active hold. Pull all open matters with a hold in place and confirm none of their records appears in a destruction queue. Reconcile the hold list against the queue by hand the first time.
- Read each vendor clause. For every platform holding case records, find the retention and deletion terms. Write down the export window and the deletion date that follows the end of the engagement, then calendar both.
- Name two owners. Assign one owner for the schedule itself and a different owner who alone can release a hold. Separation here prevents a well meaning cleanup from undoing a preservation decision.
- Run a retrieval test. Pull one closed file and try to produce the source pages, the metadata, and the access log. If the team can't do it quickly, your storage and indexing need work before you rely on them in a dispute.
- Set the review dates. Calendar an annual review plus a triggered review whenever a state statute or a limitation period affecting your caseload changes.
- Recompute before destroying anything. Take the latest of the statutory minimum, the limitation period, minority or discovery tolling, and any hold. File the responsible attorney's sign off with the destruction certificate for that batch.
Two ownership points close the loop. Customers retain all rights to the data, documents, and materials they upload or generate through our service, which means your firm's control over its records doesn't transfer to a vendor by using one. Keep uploaded files under your firm's direction and export them on your schedule.
Software doesn't change the verification duty either. If a tool summarizes records or drafts from them, customers are responsible for reviewing and verifying all outputs before using them in legal proceedings or client communications. Check every summary against the source pages before it goes into a filing or a client letter, and keep the pages you checked against for as long as that work product could be questioned.
A schedule confirmed this way gives you a defensible answer for every record in the building. You can say what it is, which rule governs it, when its clock started, and who decided it stays. That's the standard a retention policy should meet.
If your team is spending hours turning retained records into chronologies and demand drafts, Ares can structure those case files into cited medical summaries and demands while your firm keeps control of the underlying records. Visit Ares to see how it fits alongside the retention schedule, access controls, and review steps your practice already runs.
