Maryland Medical Records Retention Requirements (2026): How Long Providers Must Keep Patient Records

General Retention Periods

As of 2026, Maryland law requires healthcare providers to retain adult patient medical records, laboratory reports, and X‑ray reports for at least seven years from the date each record is made. Treat seven years as the statewide floor for adult records. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&enactments=false§ion=4-403))

For compliance planning, align your organization’s retention policy to the longest applicable rule. Maryland’s Department of Health regulations also require every provider to maintain a written records retention schedule; where a regulation is less stringent than statute, the statute’s longer period controls. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))

During the entire retention period, keep records legible, readily retrievable, and protected from loss, consistent with your healthcare provider obligations and HIPAA compliance duties. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))

Minor Patient Records Retention

For minors, you must retain the medical record until the patient reaches the age of majority (18) plus seven additional years—effectively until age 25. Early destruction is only permissible if you follow Maryland’s specific notice rules to the parent/guardian or, in certain circumstances, the minor. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&enactments=false§ion=4-403))

Secure Storage Requirements

What Maryland expects

• Maintain secure record storage and limit access to authorized staff only, whether records are on paper or in electronic health records (EHR) systems. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))
• Store records in one of the following: a restricted‑access office, secure computing environment (with passwords/encryption), or a commercial storage site with appropriate environmental and security controls. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))
• Preserve patient confidentiality throughout retention and storage consistent with state law and the HIPAA Privacy and Security Rules (which COMAR incorporates by reference). ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01.16.01?utm_source=openai))

Practical safeguards

• Physical: locked rooms, visitor controls, and monitored file access (patient confidentiality and secure record storage). ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))
• Administrative: role‑based access, minimum‑necessary policies, staff training, and retention schedule enforcement. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))
• Technical: encryption, unique user IDs, automatic logoff, and audit trails appropriate to your systems (HIPAA compliance). ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01.16.01?utm_source=openai))

Electronic Records Management

If you keep electronic health records, you must be able to generate a legible copy for patients and regulators and maintain a current backup of all EHR files. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))

When an EHR system is in use, patients who request their records in electronic form must be provided an electronic copy; this operates alongside HIPAA’s individual right of access. ([oag.maryland.gov](https://oag.maryland.gov/resources-info/Pages/How-to-Get-and-Use-Your-Medical-Records.aspx?utm_source=openai))

Record Disposal Procedures

When records are eligible for destruction

• Confirm the record has met the applicable retention period (e.g., 7 years for adults; age 25 for minors) under Maryland law. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&enactments=false§ion=4-403))
• If considering early destruction before the minimum period, send required written notice that includes the proposed disposal date and retrieval instructions; allow at least 30 days for pickup. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01.16.07?utm_source=openai))

How to destroy records

• Use methods that render information permanently unreadable: incineration, cross‑cut shredding, pulping, complete media sanitization for electronic/magnetic media, and destruction of films/discs with no possibility of recovery (medical record destruction). Keep a destruction log. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01.16.05?utm_source=openai))
• Destruction methods must protect confidentiality throughout the process and comply with HIPAA Security standards for media disposal. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01.16.05?utm_source=openai))

If a provider retires or passes away

• Immediately secure records and either transfer them to a successor, deliver to patients on request, or destroy them in accordance with Maryland rules. ([law.cornell.edu](https://www.law.cornell.edu/regulations/maryland/COMAR-10-01-16-06?utm_source=openai))
• The provider, estate administrator, or designee must notify patients (or, for minors, parents/guardians in most cases) before records are destroyed or transferred, and notify the appropriate health occupations board. Publishing two weeks of local newspaper notice is an accepted option. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&enactments=false§ion=4-403))

Ownership and Access Rights

In Maryland, medical records are the personal property of the entity that provides care; however, patients retain strong rights to access and obtain copies. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))

Upon a written request by a person in interest, you must disclose or provide copies within a reasonable time, and knowingly refusing to do so within 21 working days can trigger penalties. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&enactments=false§ion=4-309&utm_source=openai))

Fees: Providers may charge up to $0.76 per page plus actual postage/handling, and a retrieval/preparation fee up to $22.88 in some circumstances. Any fee must also comply with HIPAA’s “reasonable, cost‑based” limits, and special caps apply to Medical Assistance (Medicaid) enrollees. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&enactments=false§ion=4-304&utm_source=openai))

Retention Schedule and Compliance

Build and maintain a written retention schedule

• Create a records retention schedule covering all record series, the minimum period to keep each, and approved disposal methods; maintain it and follow it consistently. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))
• Where multiple rules apply (state statute, COMAR, payer, malpractice risk), adopt the longest applicable period to simplify retention schedule enforcement. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01.16.01?utm_source=openai))

Operationalize compliance

• Designate a records custodian, conduct periodic audits, and document holds for litigation or audits. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))
• Train workforce members on patient confidentiality, secure record storage, and medical record destruction procedures. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01.16.05?utm_source=openai))
• For electronic health records, test backups and verify you can produce legible records throughout the retention period. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))

Summary

For 2026, plan around a seven‑year minimum for adult records and age‑25 for minors; safeguard records to meet HIPAA compliance; and dispose of records only after confirming eligibility and sending any required notices. A current, enforced retention schedule is your best defense against risk and noncompliance. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&enactments=false§ion=4-403))

FAQs

How long must medical records be kept for minors in Maryland?

Keep a minor’s record until the patient turns 25 (age of majority—18—plus seven years). Maryland allows earlier destruction only if specific notice requirements are met; most providers avoid early destruction to protect access and reduce risk. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&enactments=false§ion=4-403))

What are the secure storage requirements for medical records?

Store records in restricted‑access locations or secure IT systems, ensure confidentiality and limited access, and maintain environmental and security controls. COMAR also expects compatible hardware/software for legible copies and backup of electronic files. ([regs.maryland.gov](https://regs.maryland.gov/us/md/exec/comar/10.01/index.full.html))

Can providers charge fees for medical record copies?

Yes. State law permits up to $0.76 per page plus actual postage/handling, and a retrieval/preparation fee up to $22.88 in certain cases. These amounts are subject to HIPAA’s “reasonable, cost‑based” limitations; for direct patient requests, HIPAA restricts or eliminates some charges. Special caps apply for Medical Assistance enrollees. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&enactments=false§ion=4-304&utm_source=openai))

What happens to records if a provider retires or passes away?

The provider, estate administrator, or a designated custodian must secure the records, notify the appropriate board, and either transfer records to a successor, make them available to patients, or destroy them using approved methods after required notices (mail or local newspaper) are provided. ([mgaleg.maryland.gov](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=ghg&enactments=false§ion=4-403))