Alabama Medical Records Retention Requirements: State Law Beyond HIPAA Minimums

Physician Record Retention Guidelines

Minimum retention periods

Under the Alabama Board of Medical Examiners retention rules, physicians must keep each patient’s medical record for at least seven years from the date of the last professional contact. For a minor patient, you must retain the record for at least two years after the patient reaches Alabama’s age of majority (19) or seven years from last contact, whichever is longer. Do not destroy any record that is the subject of a known dispute until the dispute is resolved.

These requirements are codified in Alabama’s medical records management rule, which also clarifies that records may not be destroyed earlier simply because a practice has migrated to a new EHR or storage medium; they must still meet the minimum retention period. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))

Access and production duties

You must be able to retrieve and produce complete records promptly upon a legally compliant request, including records created via telemedicine. The Board emphasizes maintaining records that meet minimum content standards and being able to furnish copies or summaries consistent with state and federal law. ([albme.gov](https://www.albme.gov/resources/licensees/medical-records?utm_source=openai))

Hospital Medical Records Retention

Core timelines and discharge documentation

• Retention: Alabama-licensed hospitals must retain medical records in original or legally reproduced form for at least five years. For minors, retain records for at least five years after the patient reaches the age of majority (19 in Alabama). ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/420-5-7-.13))
• Discharge documentation: Hospitals must complete final diagnoses and close medical records within 30 days following discharge, supporting continuity and audit readiness. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/420-5-7-.13))
• Contingency: Hospitals must have a plan to transfer records if the facility ceases operation. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/420-5-7-.13))

Immunization Records Retention

Physicians must retain immunization records that have not been transmitted to Alabama’s state immunization registry for at least two years after the minor reaches the age of majority or seven years from the last professional contact—whichever is longer. If immunization data are in the registry, the general medical record retention periods still apply to the patient’s chart you maintain. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))

Alabama law establishes the state immunization registry as the central repository for vaccination data, which providers use and update according to State Board of Health rules. ([law.justia.com](https://law.justia.com/codes/alabama/title-22/title-1/chapter-11b/section-22-11b-2/?utm_source=openai))

X-rays and Imaging Retention Requirements

• X-rays, radiographs, and other imaging products must be retained for at least five years. After five years, you may destroy the image if a separate interpretive report exists and is kept with the medical record. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))
• Mammography: Imaging and reports must be maintained for ten years—this Alabama standard exceeds common medical imaging retention standards and aligns with a more protective approach for breast imaging history. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))

Medical Records Destruction Procedures

Method, timing, and documentation

• Destroy only in the ordinary course of business under written procedures consistent with privacy laws; never single out a specific record outside those procedures. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))
• Permissible methods include burning, shredding, permanent deletion, or other effective measures that preserve confidentiality. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))
• Maintain a record destruction compliance log that captures the time, date, and circumstances of each destruction event; keep this log for at least four years. The log does not have to list each individual chart if the batch can be reliably identified. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))
• Do not destroy any record under dispute when you have formal notice of the dispute before the retention period ends. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))

Practice Closure and Records Transfer

Practice transitions and patient notification

• Retirement: Notify active patients not less than 30 days before retirement. Include how to obtain records, a HIPAA-compliant authorization, how long records will remain available, and the intended disposition if you receive no instructions. Arrange a HIPAA-compliant custodian if needed. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))
• Death of a physician: In a group, the practice sends notice within 30 days of the physician’s death; in solo practice, the personal representative sends notice within 30 days of appointment by the probate court and manages custody for the required retention periods. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))
• License suspension or revocation: Notify active patients within 30 days of the action and facilitate record transfers; costs are borne by the affected physician. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))
• Departure from a group: If the contract is silent and the group will not notify patients, the departing physician must notify active patients and bear related costs. Patients must be offered a choice of physician, and authorized records must be transferred without interference. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))

The Board also advises ensuring records are transferred to another physician or a HIPAA-compliant custodian, with availability to active patients during the entire retention window—this includes telemedicine-originated records. ([albme.gov](https://www.albme.gov/resources/licensees/medical-records?utm_source=openai))

Comparison of State and Federal Retention Rules

How Alabama’s rules interact with HIPAA and Medicare

• HIPAA: The HIPAA Privacy Rule does not set a medical record retention period. It requires safeguarding records for as long as you maintain them and mandates that HIPAA compliance documentation (for example, policies, risk analyses) be kept for at least six years. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/580/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html?utm_source=openai))
• Medicare: For providers and suppliers that furnish covered ordered/certified items and services billed to Medicare, federal regulations require you to maintain the supporting medical records and ordering/certifying documentation for seven years from the date of service. ([govinfo.gov](https://www.govinfo.gov/content/pkg/CFR-2022-title42-vol3/pdf/CFR-2022-title42-vol3-part424.pdf?utm_source=openai))
• Hospitals: Medicare’s Conditions of Participation call for retaining hospital medical records for at least five years (some federal programs or modalities may require longer), which dovetails with Alabama’s five-year hospital minimum. ([cms.gov](https://www.cms.gov/Regulations-and-Guidance/Guidance/Transmittals/Downloads/R37SOMA.pdf?utm_source=openai))

What to follow in practice

Apply the longest applicable rule. For example, a pediatric record in Alabama typically must be kept until at least age 21 (two years after reaching 19) or seven years from last contact—whichever is longer—while Medicare-participating physicians also must keep documentation supporting Medicare services for seven years from the date of service. For mammography, Alabama’s ten-year requirement controls even if other frameworks would allow a shorter period. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))

Conclusion

Alabama state law establishes clear, often longer retention periods—seven years for physician records, special timelines for minors and immunizations, five years for hospital records, and specific imaging standards—going beyond HIPAA’s minimum documentation rule. Align your policy to Alabama’s timelines first, layer on Medicare’s seven-year documentation rule when you bill Medicare, and keep a defensible destruction log to prove compliance end to end. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))

FAQs

How long must physicians retain medical records for minors in Alabama?

Keep a minor’s record for at least two years after the patient reaches 19 (the age of majority in Alabama) or seven years from the date of last professional contact—whichever period ends later. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))

What are the retention requirements for hospital records after patient discharge?

Hospitals must retain records for at least five years (and for minors, at least five years after the patient reaches 19). Hospitals must also complete final diagnoses and close the record within 30 days after discharge. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/420-5-7-.13))

How should medical records be destroyed according to Alabama law?

Destroy records only under written, routine procedures that protect confidentiality—such as shredding, burning, or permanent deletion—and never single out individual charts. Maintain a record destruction compliance log with the time, date, and circumstances of destruction for at least four years. Do not destroy records under known dispute until the dispute is resolved. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))

What notifications are required before a practice closure occurs?

For retirement, notify active patients at least 30 days in advance; after a physician’s death, notice goes out within 30 days (or within 30 days of appointing a personal representative in solo practice). Include how to request records, a HIPAA authorization, the time window for availability, and the intended disposition. Arrange a HIPAA-compliant custodian if needed and ensure active patients can obtain their charts during the full retention period. ([admincode.legislature.state.al.us](https://admincode.legislature.state.al.us/api/rule/540-X-9-.10))