HIPAA Records Retention and Destruction Policy Template for Retiring Solo Physician Practices

Template use: Complete the bracketed fields and adapt this policy to the physician’s state, specialties, payer contracts, and other obligations before closing the practice. This general template is not a substitute for checking applicable law or obtaining legal advice.

Which laws determine medical record retention periods after a solo practice closes?

Policy statement: The practice will retain patient records for the longest period required by applicable state medical record retention statutes, other applicable laws, payer or contractual requirements, and any litigation hold. Records will not be destroyed while a hold or other legal restriction applies.

HIPAA does not set a general retention period for medical records. HHS explains that state law generally determines how long medical records must be kept, while HIPAA safeguards apply for as long as the practice maintains protected health information (PHI), including during disposal. See the HHS guidance on HIPAA and medical record retention.

Before setting a destruction date, identify the rules in every state where the practice provided care. Check requirements for adult and minor records separately, how the retention period is calculated, and any rules specific to the physician’s license or specialty. Also check applicable payer, program, and contractual requirements. For example, certain Medicare-enrolled physicians and other suppliers must maintain documentation for seven years from the date of service under 42 CFR § 424.516(f); this is not a universal HIPAA medical-record retention period.

Practice details: State(s) reviewed: [________]. Applicable retention schedule or legal source: [________]. Records subject to a hold or exception: [________]. Person responsible for confirming eligibility for destruction: [________].

How should the policy assign responsibility for records after retirement?

Policy statement: The practice designates [name or organization] as its records custodian, effective [date]. The custodian’s mailing address, phone number, email, and secure request method are [________]. The custodian will maintain records until the applicable retention period ends and will manage patient requests, transfers, safeguards, and authorized destruction.

Name a primary custodian and a backup contact. Document who may access records, how the custodian will respond to requests, how long the arrangement lasts, how records and fees will be handled, and what happens if the custodian can no longer serve. A designated record custodian is a practical role for continuity; do not assume that naming one replaces state-specific closure requirements or determines who is legally responsible.

If a records-storage, cloud, or other service provider will create, receive, maintain, or transmit PHI on the practice’s behalf, assess whether the provider is a business associate and put an appropriate business associate agreement (BAA) in place. The agreement should address safeguards, patient access support, and what happens to PHI when services end. HIPAA generally requires a BAA to provide for return or destruction of PHI at termination when feasible; if that is infeasible, the protections must continue and uses and disclosures must remain limited. See 45 CFR § 164.504(e) and HHS guidance on business associate agreements.

Practice details: Custodian: [________]. Backup: [________]. Agreement start and end dates: [________]. Vendor and BAA location, if applicable: [________].

How should patients be notified and request or transfer their records?

Policy statement: Before closure, the practice will notify patients using [methods] and explain the closure date, who will hold their records, how to contact the custodian, how to request a copy or transfer, and how to obtain urgent or continuing care. The practice will retain a copy of the notice and a record of when and how it was sent.

Send notice sufficiently early to give patients a practical opportunity to arrange continued care and, where appropriate, request copies or transfers before the office closes. Check state law and licensing-board rules for any required notice, content, timing, or publication method. HHS advises a practice winding up its business to consider giving patients an opportunity to pick up records before disposition and notes that state requirements may apply after dissolution; see HHS guidance on disposing of PHI.

Provide a reliable process for receiving, verifying, tracking, and completing requests. Under HIPAA, individuals generally have a right to access PHI in a designated record set maintained by or for a covered entity, subject to limited exceptions. A covered entity generally must act on an access request within 30 calendar days, with one additional 30-day extension when the required written notice is provided within the initial period. A patient may direct a copy to another person through a signed written request that identifies the recipient and where to send it. See HHS guidance on access-request timelines and HHS guidance on directing records to a third party.

Use a secure delivery method appropriate to the records and recipient. Confirm the patient’s identity and the recipient’s details before releasing records. Track the request date, verification, scope, delivery method, completion date, and any permitted reason for delay or denial.

Practice details: Notice methods and date(s): [________]. Request contact: [________]. Identity-verification process: [________]. Secure delivery options: [________].

How can paper and electronic records be stored securely after closure?

Policy statement: Until records are lawfully destroyed or transferred, the custodian will protect them against loss, unauthorized access, alteration, and disclosure. Access will be limited to people who need it for authorized duties and patient requests.

Store paper records in a locked, access-controlled location protected from water, fire, pests, and avoidable environmental damage. Keep an inventory, control keys, and maintain a process for retrieving and returning files. Do not leave boxes in an unsecured office, vehicle, or location where a landlord, visitor, or unauthorized person could access them.

Protect electronic protected health information (ePHI) with administrative, technical, and physical safeguards appropriate to the practice and its circumstances. A written security plan should address authorized accounts, access controls, secure remote access, backups, incident response, and how the custodian will retrieve records for requests. HIPAA’s Security Rule requires policies and procedures for disposing of ePHI and for removing ePHI from electronic media before reuse; see 45 CFR § 164.310(d). HIPAA’s general safeguard requirements also apply to PHI maintained during the closure process; see 45 CFR § 164.530(c).

Review vendor and service agreements before closure. Maintain access to records, necessary software, encryption keys, backups, and audit information for as long as needed to meet retention and access obligations. Do not assume that closing an account or ending a service deletes every copy, backup, or archived instance.

Practice details: Paper storage location and access controls: [________]. Electronic systems and backup location: [________]. Custodian access process: [________]. Security incident contact: [________].

What secure methods should be used to destroy records?

Policy statement: The custodian may destroy records only after confirming that the applicable retention period has ended, no legal hold or other restriction applies, and the destruction is authorized under this policy.

For paper records, use shredding, burning, pulping, or pulverizing so that PHI is essentially unreadable, indecipherable, and cannot be reconstructed. If a vendor performs the destruction, secure records during storage and transport and use a vendor arrangement that addresses the vendor’s role and safeguards. HHS describes these methods and recommends appropriate safeguards during disposal in its PHI disposal guidance.

For ePHI, use a secure media sanitization method appropriate to the device and data. Depending on the media, methods may include clearing, purging, or physical destruction; simply deleting files or reformatting a device may not ensure that the information cannot be recovered. Follow the current NIST SP 800-88 Rev. 2 Guidelines for Media Sanitization as applicable. HHS also describes electronic media disposal methods in its disposal guidance.

Include records on computers, servers, removable drives, phones, imaging equipment, printers, copiers, and backup media in the destruction review. Document any media that cannot be sanitized or destroyed immediately, why it remains, who can access it, and the plan and date for final disposition.

Practice details: Authorized destruction methods: [________]. Approved vendor and agreement location, if applicable: [________]. Person authorizing destruction: [________].

What destruction log should the practice maintain?

Policy statement: The custodian will maintain a record destruction log for each authorized destruction event. The log will contain enough information to show what was destroyed, why it was eligible, how and when destruction occurred, and who performed or verified it, without including unnecessary patient information.

• Date destruction was approved and date it was completed.
• Record type, date range, and approximate quantity or volume; use a batch identifier instead of patient names where practical.
• Retention schedule or other basis for determining that the records were eligible for destruction.
• Confirmation that legal holds, pending requests, and other known restrictions were checked.
• Destruction method, media type, and equipment or service provider used.
• Name and role of the authorizing person and the person or vendor performing the destruction.
• Verification or vendor certificate, any exceptions, and final disposition of the media.

Keep the log and supporting certificates in a secure location. Apply the longest applicable state, contractual, and legal-hold requirements to the log. HIPAA requires certain documentation to be retained for six years from its creation or the date it was last in effect, whichever is later; that rule concerns documentation required under HIPAA and is not a blanket medical-record retention period. See 45 CFR § 164.530(j)(2). Confirm with counsel which closure and destruction documents are subject to that requirement and any longer applicable period.

Log entry: Batch ID [________]; record types/date range [________]; quantity [________]; eligibility reviewed by/date [________]; method [________]; vendor or performer [________]; completion date [________]; verification or certificate reference [________]; exceptions [________].

What limitations apply to HIPAA retention requirements?

HIPAA’s lack of a general medical-record retention period does not mean records can be destroyed whenever the practice closes. State medical record retention statutes, other applicable laws, payer or program requirements, contracts, and legal holds may require longer retention. Apply the longest applicable requirement and confirm closure-specific duties with the relevant state authorities or legal counsel.

Do not confuse retention of patient records with HIPAA’s separate six-year requirement for certain HIPAA documentation. Nor does a destruction log by itself establish that the practice met every applicable legal, privacy, or security obligation. Continue to protect PHI for as long as it is maintained, including while it is stored, transferred, or disposed of.

Summary: Set retention periods from applicable law and other obligations, assign a reachable custodian, preserve patient access, safeguard records through the retention period, and document secure destruction only after confirming it is permitted.

FAQs

Does HIPAA set a medical record retention period?

No. HIPAA does not establish a general retention period for medical records. State law generally determines how long those records must be kept, while HIPAA safeguards apply for as long as PHI is maintained. HIPAA does require certain documentation to be retained for six years, which is distinct from a medical-record retention period.

How long must a retiring physician retain patient records?

There is no single period that applies to every retiring physician. The physician should check the state medical record retention statutes and any applicable specialty, payer, program, contract, or legal-hold requirements. Retain each record until the longest applicable period ends.

Who can serve as custodian of records after a practice closes?

The practice should identify a responsible person or organization that can securely store the records, respond to patient requests, and maintain access throughout the required retention period. Depending on the arrangement and applicable law, this may be another provider, a records-management service, or another designated custodian. If a vendor handles PHI on the practice’s behalf, assess whether a business associate agreement is required.

How should a physician document secure destruction of patient records?

Maintain a secure record destruction log showing the record batch or type and date range, the retention basis, confirmation that no hold or restriction applies, the destruction date and method, the person or vendor responsible, and verification or a vendor certificate. Avoid placing unnecessary patient-identifying details in the log, and retain the log for the longest applicable period.