Kentucky Medical Records Retention Requirements: How Long to Keep Patient Records (2026 Guide)

As of March 18, 2026, Kentucky sets medical record retention periods primarily by facility type, with additional obligations from HIPAA documentation rules and Medicaid program requirements. Use the longest applicable timeframe to cover overlapping obligations and ensure continuity of care.

General Retention Periods

In Kentucky, minimum retention timelines differ by setting. The following baselines reflect current state regulations and program rules; keep records longer when clinical, legal, payer, or risk considerations warrant it.

• Hospitals: retain at least 6 years from discharge; for a minor, at least 3 years after the patient reaches the age of majority, whichever is longer. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/016/))
• Ambulatory surgical centers: retain at least 6 years; for a minor, 3 years after reaching majority, whichever is longer. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/106/))
• Outpatient health care centers: retain for 5 years following the last treatment, assessment, or visit. ([law.cornell.edu](https://www.law.cornell.edu/regulations/kentucky/902-KAR-20-074))
• Behavioral health services organizations (including SUD programs): retain 6 years; for a minor, 3 years after majority, whichever is longer; Part 2 confidentiality also applies to SUD records. ([kyrules.elaws.us](https://kyrules.elaws.us/rule/902kar20%3A430))
• Residential hospice facilities: retain 5 years after death or discharge; for a minor, 5 years after the event or 3 years after majority, whichever is longer. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/380/))
• Assisted living communities: retain a resident’s record for at least 6 years following move‑out or termination of services. ([law.cornell.edu](https://www.law.cornell.edu/regulations/kentucky/902-KAR-20-480))
• Freestanding or mobile technology units (e.g., MRI/PET/cath labs): retain 6 years; for a minor, 3 years after majority, whichever is longer. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/Law/kar/titles/902/020/275/))
• Intermediate care facilities: retain 5 years; for a minor, 3 years after majority, whichever is longer. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/051/))
• Abortion facilities: retain 6 years; for a minor, 3 years after majority, whichever is longer. ([casemine.com](https://www.casemine.com/regulation/us/643cdf122cf7ad52582a583f))
• Local health department regulations (records schedules): adult patient medical records—retain 10 years after last service; minor patient records—retain 5 years after the patient turns 18 or 10 years from last service, whichever is longer; home health records—retain 7 years after last service (adults) and 7 years after turning 18 or 7 years from last service (minors), whichever is longer; Master Patient Index—permanent. ([kdla.ky.gov](https://kdla.ky.gov/records/RetentionSchedules/Documents/Local%20Records%20Schedules/LocalHealthDepartmentRecordsRetentionSchedule.pdf))
• Medicaid record retention (provider): retain recipient health records at least 5 years from the date of service, or longer if a federal requirement applies. ([law.cornell.edu](https://www.law.cornell.edu/regulations/kentucky/907-KAR-3-005))
• HIPAA documentation retention: retain HIPAA policies, procedures, training records, and other required privacy/security documentation for 6 years; note that HIPAA itself does not set a medical-record retention period—state and payer rules govern the record itself. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.530))

Specific Facility Regulations

Hospitals

Hospitals must maintain a medical record for every inpatient and outpatient, keep records centralized, and retain them at least 6 years (minors: 3 years after majority, whichever is longer). Hospitals must also safeguard against loss, tampering, and environmental damage and designate where records will be stored if the hospital closes. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/016/))

Ambulatory Surgical Centers (ASCs)

ASCs are required to keep complete operative and anesthesia documentation, ensure the record is signed within 10 days of discharge, and retain records for a minimum of 6 years (minors: 3 years after majority, whichever is longer). ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/106/))

Outpatient Health Care Centers

For outpatient record management, centers must maintain comprehensive visit documentation and keep records at least 5 years after the last treatment, assessment, or visit. Policies must support timely access, linkage agreements, and transfer protocols to sustain continuity of care. ([law.cornell.edu](https://www.law.cornell.edu/regulations/kentucky/902-KAR-20-074))

Behavioral Health Services Organizations (BHSOs)

BHSOs must maintain a client record for each person served, retain records for 6 years (minors: 3 years after majority, whichever is longer), and comply with HIPAA and, for SUD services, 42 CFR Part 2 confidentiality. ([kyrules.elaws.us](https://kyrules.elaws.us/rule/902kar20%3A430))

Residential Hospice Facilities

Hospice facilities must keep a comprehensive record, place it inactive upon death or discharge, and retain it 5 years (with a longer rule for minors). Care planning, orders, and updates must be promptly documented. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/380/))

Assisted Living Communities

Assisted living providers must maintain resident records and, after move‑out or termination, keep them for at least 6 years, with safeguards for secure storage and retrieval. ([law.cornell.edu](https://www.law.cornell.edu/regulations/kentucky/902-KAR-20-480))

Freestanding or Mobile Technology Units

Units providing diagnostic or therapeutic technologies (e.g., MRI, PET) must keep records 6 years (minors: 3 years after majority) and have written procedures for transferring records upon request to support continuity of care. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/Law/kar/titles/902/020/275/))

Intermediate Care Facilities

Intermediate care facilities must maintain a complete record and retain it at least 5 years (minors: 3 years after majority). Policies must enable prompt location, confidentiality, and continuity at transfer or discharge. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/051/))

Local Health Departments

Local health department regulations set longer retention: 10 years for adult medical records, specific longer schedules for minors, and permanent retention of the Master Patient Index. Home health records have separate 7‑year timelines. Always verify the current KDLA schedule your program falls under. ([kdla.ky.gov](https://kdla.ky.gov/records/RetentionSchedules/Documents/Local%20Records%20Schedules/LocalHealthDepartmentRecordsRetentionSchedule.pdf))

Confidentiality and Security Compliance

Across Kentucky regulations, you must maintain confidentiality and security consistent with HIPAA’s Privacy and Security Rules (45 CFR Parts 160 and 164). Facilities are expressly required to prevent loss, defacement, and tampering; originals typically may not be removed except by court order or subpoena. Behavioral health/SUD programs must also comply with 42 CFR Part 2. Keep required HIPAA documentation (policies, training, authorizations) for at least 6 years. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/016/))

Transfer and Continuity of Care Procedures

Medical record transfer protocols should ensure continuity of care with timely, authorized sharing. Kentucky rules require centers and technology units to maintain systematic procedures to assist continuity if a patient moves, and to transfer the medical record or an abstract upon proper release. Outpatient centers must maintain linkage agreements and cooperate on discharge planning and information exchange. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/Law/kar/titles/902/020/275/))

Hospitals and other facilities also must coordinate inpatient and outpatient information in one record and plan for record custody if the organization ceases operations, so patients and new providers can access critical history. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/016/))

Storage and Safeguarding Protocols

Ensure secure storage (physical and electronic), indexed filing for prompt retrieval, and protections against fire and water damage. Kentucky regulations also require designating a specific storage location if a facility ceases operations, and many facilities restrict removal of original records to court order or subpoena. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/016/))

Summary: In Kentucky, medical record retention hinges on your setting (5–10 years, commonly) with longer timelines for minor patients and certain public‑health programs. Add HIPAA’s 6‑year documentation rule and Medicaid’s 5‑year provider requirement, then default to the longest period that applies to your practice model and payers to stay compliant and support patient care. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.530))

FAQs

What is the minimum retention period for medical records in Kentucky?

It depends on the setting. Examples: hospitals and ASCs—6 years (minors: 3 years after majority, whichever is longer); outpatient health care centers—5 years from the last treatment; residential hospice—5 years; local health departments—often 10 years for adult medical records per the KDLA schedule. Always apply the longest rule that applies to you. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/016/))

How long must records be kept for minor patients?

Most Kentucky facility regulations require keeping a minor’s record at least 3 years after the patient reaches the age of majority, or the general adult period, whichever is longer. Some public‑health programs require longer (e.g., local health department schedules commonly extend to 5 or 10 years depending on program). ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/016/))

What are the security requirements for medical records under Kentucky law?

Facilities must maintain confidentiality and security consistent with HIPAA (45 CFR Parts 160 and 164), prevent loss/tampering, and limit removal of originals to a court order or subpoena. For SUD records, 42 CFR Part 2 applies. HIPAA also requires retaining privacy/security documentation (e.g., policies, training) for at least 6 years. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/016/))

How should clinics handle the transfer of patient medical records?

Adopt medical record transfer protocols that prioritize continuity of care: obtain proper authorization, send the complete record or an abstract when appropriate, and use written linkage/transfer agreements with receiving providers. Kentucky regulations for outpatient centers and technology units explicitly require such procedures. ([law.cornell.edu](https://www.law.cornell.edu/regulations/kentucky/902-KAR-20-074))