Arkansas Medical Records Retention: What Closed Rural Health Clinics Must Do After a Change of Ownership

Medical Records Retention Periods

If your rural health clinic is closing or changing hands, you must preserve patient files under Arkansas medical records retention rules and federal program requirements. Build a written retention schedule that meets or exceeds the strictest requirement across state law, Medicare/RHC rules, payer contracts, HIPAA documentation duties, and malpractice limitation periods.

Define what starts the clock for each record set. For most clinical records, the trigger is the last date of service; for minors, retention commonly runs from the patient’s age of majority. Keep separate timelines for images, diagnostic tracings, immunization histories, billing records, logs, and quality reports so nothing is destroyed prematurely.

Adopt conservative timeframes when state or payer guidance is unclear. Many clinics use a 7–10 year baseline for adult records and a longer period for pediatric records (for example, counting from the 18th or 21st birthday). Maintain HIPAA-required documentation for at least six years, and retain OSHA exposure records much longer. When in doubt, choose the longer period and document the rationale in your rural health clinic compliance plan.

Place a litigation or audit hold on any records tied to open claims, subpoenas, government reviews, or audits. A hold pauses destruction until the matter is fully resolved. Keep an index of stored and destroyed records so you can prove compliance years later.

Procedures for Change of Ownership

A change of ownership shifts who is responsible for custody and access to records, but it does not erase retention duties. Your purchase or membership transfer agreement should explicitly name the legal records custodian, specify where records will reside, and confirm that the buyer assumes retention and access obligations under ownership transition regulations.

Plan the data transition like a clinical safety project. Map all sources of protected health information (EHR, scanning systems, imaging, billing, paper charts, backup media), validate migrations, and preserve audit logs. Create a chain-of-custody log that tracks who handled which data, when, and how, from pickup through delivery and acceptance.

Update your Notice of Privacy Practices and patient-facing materials to reflect the new custodian and request channels. Align business associate agreements, off-site storage contracts, and shredding arrangements with the new owner. If the seller retains limited read-only access (for payor recoupments, legal defense, or accounting), restrict it by agreement, role-based controls, and time limits.

Compliance Requirements for Clinic Closures

Develop a written closure plan early. Designate a records custodian, specify storage locations, and document how patients and other requestors will obtain copies. Incorporate healthcare facility closure policies into your plan so federal program rules, Arkansas requirements, and payer obligations are covered.

• Notify patients who received care in the recent period you define (for example, the past 12–24 months). Use multiple channels—letters, secure portal messages, phone, signage—so patients know where to request records.
• Notify relevant state agencies, licensing boards, Medicare/Medicaid enrollment, and major payers about the closure and records custodian. Update voicemail, website, and automated responses with instructions.
• Reconcile outstanding diagnostics, referrals, and test results before the last day. Communicate clearly to avoid gaps in care and to support patient record accessibility after closure.
• Document final inventory, storage handoffs, and access controls on closure day. Keep keys, credentials, and encryption materials under dual control with documented checklists.

Patient Access to Records

Patients keep the right to access their information after a closure or ownership change. Offer clear request options—mail, secure portal, or phone—and publish the custodian’s contact details and hours. Verify identity reasonably, and accommodate personal representatives, guardians, and executors as permitted by law.

Fulfill routine requests promptly, following HIPAA’s general 30-day timeline (with one written extension if needed). Provide electronic copies when requested and feasible, and use secure transmission. Fees must be reasonable and cost-based; if Arkansas caps fees for copies, follow the lower standard.

Prioritize continuity-of-care requests from active treating providers. Maintain a log of inbound requests, fulfillment dates, formats provided, and fees charged to demonstrate rural health clinic compliance.

Record Storage and Security

Select storage that protects confidentiality, integrity, and availability for the full retention period. For paper, use locked, access-controlled areas with environmental protections and documented key control. For electronic records, require encryption at rest and in transit, robust backups, and tested recovery procedures.

Limit access with role-based permissions and unique user IDs. Keep audit logs that capture viewing, printing, exporting, and destruction events. Vet off-site storage and scanning vendors carefully, execute business associate agreements, and review certificates of insurance and incident response commitments.

For closed clinics, arrange long-term read-only EHR access or archived image viewers so you can retrieve discrete data when needed. Keep encryption keys and administrator credentials sequestered and inventoried, with dual control and emergency access procedures.

Authorized Methods for Record Destruction

Destroy records only after the retention period ends and no litigation, audit, or investigation hold is in place. Your policy should list approved medical records destruction methods and require documentation for every job.

• Paper: cross-cut shredding, pulping, or incineration that renders PHI unreadable and irrecoverable.
• Electronic media: follow a recognized standard (such as NIST-style purge or destroy), including cryptographic erasure, degaussing of magnetic media, and physical destruction (shredding or crushing) of drives and removable media.
• Film and specialty media: incineration or certified shredding; verify residue handling and recycling practices.

Supervise destruction or use a vetted vendor, then retain a certificate of destruction showing date, method, media types, volume, and authorization. Keep the certificate as long as your policy requires so you can prove compliance.

Summary: Treat Arkansas medical records retention as a lifecycle—from inventory and custody decisions, to secure storage, patient-friendly access, and documented, irreversible destruction. A clear plan lets you close or transition ownership confidently while protecting patients and the clinic.

FAQs.

How long must medical records be retained after a rural clinic closes?

Use a written schedule that meets the longest applicable rule among Arkansas law, federal program requirements, payers, and HIPAA documentation duties. Many clinics adopt a 7–10 year baseline for adult records and a longer period for pediatric records counted from the age of majority. Apply holds for audits or litigation and keep proof of storage and destruction.

What happens to medical records during a change of ownership?

The purchase or transfer agreement should assign the legal records custodian and detail where and how records are stored, accessed, and protected. Retention and access duties continue unchanged, patients keep their rights, and the new owner updates privacy notices, vendor contracts, and request channels. Maintain chain-of-custody logs and preserve audit trails throughout the transition.

How can patients access their records after clinic closure?

Patients request copies from the designated records custodian using published contact options. Verify identity, accept requests from personal representatives where appropriate, and respond within HIPAA timelines. Provide electronic or paper copies per patient preference when feasible, apply only reasonable, cost-based fees, and track each request to completion.

What are the authorized methods for destroying medical records in Arkansas?

Use methods that make PHI unreadable and irrecoverable: cross-cut shredding, pulping, or incineration for paper; and standards-based purging or destruction for electronic media (for example, cryptographic erase, degaussing, and physical shredding). Release records only from destruction holds, supervise vendors, and keep certificates of destruction to document compliance.