California Medical Records Retention Requirements: How Long Providers Must Keep Patient Records

General Retention Period

In California, you should maintain adult patient records for at least seven years from the last date of service or discharge. This baseline aligns with common state licensure standards for facilities and the Medical Board’s expectations for physicians, and it fits typical Record Retention Periods adopted by risk managers.

When multiple rules apply, use the longest applicable period. Extend retention if any of the following is true:

• The patient is a minor (see the next section).
• You participate in federal or state programs (for example, Medi-Cal Program Compliance or Medicare), or operate under Knox-Keene Act obligations.
• There is active litigation, a subpoena, or an audit/investigation hold.

HIPAA does not set a single retention period for medical records, but it does require you to retain privacy and security documentation for six years; many organizations mirror that minimum while keeping clinical records longer to meet California requirements.

Records of Minors

For minor patients, keep records until the later of: (1) one year after the minor turns 18 (i.e., at least to age 19), or (2) seven years from the date of the last visit. This “later of” rule ensures continuity of care and protection during the period when claims or legal issues are most likely to arise.

Example: If a patient’s last visit occurred at age 17, retain the record until at least the 19th birthday. If the last visit was at age 5, the seven‑year rule would otherwise end at age 12, but many providers still retain to age 19 for consistency.

Medi-Cal Patient Records

For Medi-Cal beneficiaries, keep complete, legible documentation supporting each billed service—progress notes, orders, diagnostic reports, consents, itemized charges, and remittance advice. As a floor, retain records for at least three years from the date of service or final payment; if an audit, appeal, or cost settlement is pending, retain the records until the matter is fully resolved.

Contracts and program rules can require longer retention. Practical guidance:

• Fee-for-service Medi-Cal: minimum of three years, longer if any audit or recovery activity is open.
• Medi-Cal managed care and delegated risk arrangements: many agreements require up to 10 years after final payment or contract end—follow the contract’s longest clause.
• If federal cost reporting or grant conditions apply, align with those timelines as well.

Document control processes—indexing, versioning, audit trails—are essential to Medi-Cal Program Compliance and facilitate rapid response to record requests.

Emergency Medical Services Fund Records

If you submit claims to a county Emergency Medical Services Fund, retain supporting materials such as prehospital care reports, ED records, UB‑04/1500 claims, payment notices, and correspondence. Counties commonly require a minimum of three years from the close of the fiscal year in which payment was made; maintain longer if any appeal, audit, or overpayment action is in progress under local Emergency Medical Services Fund Regulations.

Because requirements vary by county, standardize on the longest period used in your service area, and keep a clear trail from incident through reimbursement.

Controlled Substances Documentation

Maintain controlled substances records in two places: (1) within the patient’s medical record (orders, administration, response), and (2) within your controlled‑substance inventory and ordering files (initial/biennial inventories, receipt logs, DEA Form 222/CSOS, chain-of-custody, wastage). Federal rules generally require at least two years for inventory and ordering records; California pharmacy and facility standards often require three years for prescription/dispensing records.

For Schedule II Controlled Substances, apply the strictest controls: perpetual inventory where required, separate filing where applicable, witnessed wasting, and prompt discrepancy resolution. As a practical rule, keep patient‑level clinical documentation for at least seven years and retain DEA‑related logs and ordering records no less than two to three years—longer if policy or investigation holds apply.

Knox-Keene Act Compliance

Entities regulated under the Knox-Keene Act—health care service plans and delegated IPAs/medical groups—must maintain books and records to demonstrate clinical quality, utilization management, claims payment, and grievance handling. In practice, keep plan-related clinical and administrative records for at least five years after the end of the benefit year or final disposition of a claim, grievance, or audit, and follow any contract that specifies longer retention.

Coordinate your provider retention schedule with plan delegation agreements to ensure consistent retrieval, audit readiness, and Medical Record Confidentiality across all parties.

Hospital Record Maintenance

California-licensed hospitals should retain medical records for at least seven years after discharge for adults. For minors, keep records for at least one year after the patient turns 18, but never fewer than seven years from the date of discharge. Apply this same “later of” standard across emergency, inpatient, outpatient, and ancillary departments for consistency.

Operationally, ensure timely completion and authentication, reliable indexing, and secure backups for electronic systems. Maintain audit trails, role-based access, and downtime/scan quality procedures to uphold availability and integrity throughout the retention period.

Physician Recordkeeping

For physician practices, retain adult patient records for at least seven years from the last encounter. For minors, follow the “age 19 or seven years from last visit—whichever is later” rule. Certain specialties or modalities may have longer best practices (for example, oncology or implantable device documentation); where timelines differ, default to the longest applicable requirement.

Effective physician recordkeeping includes problem lists, histories, exam findings, assessments, signed orders, consent, test results, care plans, and follow‑up instructions. Maintain EHR audit trails, version control for scanned items, and a written retention schedule that covers storage media, offsite archives, and disaster recovery.

Patient Record Access

Under California Patient Record Access Rights, patients may inspect their records and obtain copies. Provide in‑office inspection promptly (commonly within five business days) and supply copies within 15 days of a valid request unless a permitted exception applies. Offer electronic copies when feasible and disclose reasonable, cost‑based fees.

Maintain processes to verify identity, capture patient or representative authorization, document denials with rationale, and track turnaround times. Keep disclosure logs as required by privacy rules.

Confidential Record Destruction

When retention periods expire and no legal hold exists, destroy records in a manner that renders information unreadable and unreconstructable. Use secure shredding, pulping, or incineration for paper; for electronic media, apply encryption with verified key destruction, secure wiping, or physical destruction. Protect Medical Record Confidentiality throughout collection, transport, and disposal.

Maintain a destruction log or certificate noting the date, method, media type, general content range, and the individual or vendor responsible. Suspend destruction immediately if litigation, audit, or investigation is reasonably anticipated.

Summary

Most California providers can anchor on seven years for adult records and the “age 19 or seven years—whichever is later” rule for minors, then lengthen retention for Medi-Cal, Knox‑Keene Act obligations, controlled substances, and any audits or legal holds. Standardize policies, monitor contracts, and document both access and destruction to stay compliant and audit‑ready.

FAQs.

How long must California providers retain medical records?

For adult patients, keep records at least seven years from the last date of service or discharge. Use the longest rule that applies when state licensure, payer contracts, or federal program requirements differ, and pause destruction if any audit, appeal, or legal hold is open.

What are the retention rules for minor patients’ records?

Retain records until at least one year after the minor turns 18 (to at least age 19), but never fewer than seven years from the last visit. If those periods conflict, follow whichever is longer.

How are records of Medi-Cal patients maintained?

Maintain complete documentation supporting every billed service and retain it for at least three years from the date of service or final payment. Many Medi-Cal managed care or delegated contracts require longer—often up to 10 years—so follow the longest requirement and keep records longer if any audit or recovery action is pending.

What are the requirements for destroying medical records?

After required retention and absent any legal hold, destroy records so they cannot be read or reconstructed—secure shredding or pulping for paper; verified wiping, encryption key destruction, or physical destruction for electronic media. Keep a destruction log or certificate and ensure privacy safeguards during transport and disposal.