New Mexico Medical Records Retention Requirements: How Long Must Providers Keep Patient Records?

General Retention Periods

New Mexico’s legal retention periods set clear baselines for how long you must keep patient information. For most physician practices, adult patient medical records must be retained for at least 10 years after the date of last treatment. Hospitals must retain patient care records for at least 10 years following the last discharge. When multiple rules apply (for example, Medicare, Medicaid, or contractual obligations), adopt the longest applicable period to ensure compliance.

To keep your Patient Data Retention Policy defensible, treat the following as the core schedule for Legal Retention Periods New Mexico while maintaining strict Medical Records Confidentiality:

• Physicians/clinics (adult patients): retain the medical record for at least 10 years after last treatment.
• Hospitals (all patients): retain the hospital medical record for at least 10 years after last discharge.
• Medicaid-related medical and business records: retain for at least 6 years from the payment date; do not destroy earlier than any longer state rule that applies to the same record set.
• Medical billing maintained by physicians: retain for at least 2 years after last treatment.

What counts as a medical record?

A medical record encompasses clinical documentation you maintain for care: provider notes, histories, radiology reports and images, laboratory and other diagnostic test results, operative notes, and immunization records. It does not include purely financial records such as billing ledgers.

Risk management tip

Always suspend routine destruction if litigation, an investigation, or an audit is reasonably anticipated or ongoing. Resume only after the matter is fully resolved and the longest applicable retention period has run.

Retention Requirements for Minor Patients

For physician practices, New Mexico requires you to retain medical records for patients who are minors until the patient’s 21st birthday. This is a firm rule that often exceeds a “last treatment + years” formula for children.

• Physicians/clinics (minors): retain until the patient turns 21 years old.
• Hospitals: the statutory minimum is 10 years after the minor’s last discharge. Many facilities extend retention to at least the 21st birthday as a best practice.

Example

If you last treated a 16-year-old on May 15, 2026, keep the record until the patient turns 21 (not merely 10 years from last treatment). Build your schedule so it automatically applies the longer period for minors.

Management of Laboratory Test Records

Think in two layers: laboratory operations (CLIA) and the patient’s medical record. Place clinically relevant lab results in the patient’s chart and retain the chart per the provider schedule above; then apply laboratory retention rules to operational records and materials.

Hospitals (lab records)

• Laboratory test records and reports may be destroyed after 1 year if a copy is placed in the patient’s hospital record (which itself is kept for at least 10 years).
• If a copy is not filed in the patient’s hospital record, the laboratory must retain the test records and reports for 4 years.

CLIA requirements (applies to CLIA-certified labs)

• Test requisitions/authorizations, test reports, quality control, and most analytic system records: retain at least 2 years.
• Pathology test reports: retain at least 10 years after the date of reporting.
• Slides/blocks/tissue: retain cytology slides at least 5 years; histopathology slides at least 10 years; pathology blocks at least 2 years; preserve tissue remnants until a diagnosis is made.
• Immunohematology and blood/blood product records: follow FDA rules (21 CFR 606.160); many product records must be retained for 10 years (or longer based on product expiration).

Practice takeaway

File a copy of significant lab results in the patient’s chart for continuity of care and Electronic Health Records Compliance, and maintain separate laboratory operational files per CLIA. Your retention matrix should point each lab artifact to the right schedule.

Handling and Retention of X-ray Films

Radiology images and the official radiology interpretation are part of the medical record and must be preserved with strong Radiology Report Preservation controls.

Hospitals

• X-ray films may be destroyed 4 years after the date of exposure if the written radiologist’s findings are preserved in the hospital record.
• After 3 years from the date of exposure, a patient may, upon proper identification, retrieve their own X-ray films that the hospital still retains.
• The written radiology report remains in the hospital medical record and is retained for at least 10 years.

Physician practices and outpatient imaging

• Treat diagnostic images as part of the patient’s medical record and retain for at least 10 years after the last treatment; for minors, retain until age 21.
• For digital imaging (PACS), ensure long-term readability, documented migration plans, and rapid retrieval.

Standards for Electronic Medical Records

New Mexico recognizes properly maintained electronic records as satisfying retention requirements. To meet Electronic Health Records Compliance and HIPAA Medical Records Security, your EMR must accurately reflect the medical record and remain accessible and reproducible for later reference.

Required elements of your EMR retention policy

• Contact information for the responsible entity/agent (name, phone, mailing address) for records requests and transfers.
• How patients and authorized requestors can obtain or transfer records.
• How long records are retained before destruction or purge.
• A documented data backup plan, disaster recovery plan, and methods that ensure timely retrieval in a reasonably usable form.
• Safeguards that maintain confidentiality during transfer (encryption, secure exchange).
• If converting paper to electronic, retain the paper originals for at least 30 days after a verified, legible transfer.

Operational safeguards you should enforce

• Role-based access, minimum-necessary use, unique user credentials, and multifactor authentication.
• Encryption of data at rest and in transit; secure device and media controls for backups and images.
• Audit logs and regular review; prompt patching and vendor risk management/BAAs.
• Staff training, incident response, and routine drills tied to your Patient Data Retention Policy.

Procedures for Safe Destruction of Records

Destruction must maintain confidentiality and be consistent, documented, and repeatable—your Medical Record Destruction Methods should be explicit and enforced.

Paper and film

• Use cross-cut shredding or, where permitted, incineration for paper records.
• For film (e.g., X-rays), use certified vendors that provide secure destruction (often with silver recovery) and a certificate of destruction.

Electronic media

• Use validated secure-wipe utilities or cryptographic erasure for drives and removable media.
• When reuse is not intended, physically destroy media (e.g., pulverize, shred) per your policy.

Process controls

• Maintain a destruction log that includes at least the patient’s name (or another unique identifier consistent with confidentiality) and the date of destruction; keep the log for the same period you keep the records.
• Hospitals must destroy in the ordinary course of business under a routine schedule; do not single out individual records for special destruction.

Policies on Medical Record Access and Safeguarding

Access and safeguarding obligations are integral to Medical Records Confidentiality. You must provide complete copies of medical records to patients or their legally authorized representatives—and to other providers upon proper request—in a timely manner. Records cannot be withheld because a bill is unpaid.

Reasonable, cost-based copy fees (physician practices)

• Up to $30 for the first 15 pages; $0.25 per page thereafter.
• For electronic formats and radiology images, you may charge the actual cost of reproduction.

Psychotherapy notes

Psychotherapy notes must be maintained separately from the general medical record. Patients do not have the right to access those notes, and releasing them to another provider requires the patient’s express authorization.

What your written policy must tell patients

• Who to contact and how to request or transfer records.
• How records are accessed and the expected timelines.
• How long records are kept and how they are ultimately destroyed.
• Any applicable fees and how confidentiality is protected.

Summary

For New Mexico providers, anchor your retention program to the state’s 10-year baseline (hospitals: 10 years post-discharge; physician practices: 10 years post-treatment; minors: until age 21), apply specialized rules for labs and imaging, and operationalize EMR, security, and destruction controls that make compliance routine. When multiple rules apply, keep the record for the longest period and document every step.

FAQs

How long must medical providers keep adult patient records in New Mexico?

Physician practices must keep adult patient medical records for at least 10 years after the patient’s last treatment. Hospitals must keep patient care records for at least 10 years after the last discharge. If payer rules (e.g., Medicare/Medicaid) or contracts require longer retention for related records, follow the longest applicable period.

What are the retention rules for medical records of minors?

For physician practices, retain the record until the patient turns 21 years old. Hospitals must keep the hospital record at least 10 years after the minor’s last discharge; many facilities extend that to at least the 21st birthday as a risk-management policy.

How should electronic medical records be maintained?

Electronic records fully satisfy retention requirements if they accurately reflect the medical record and remain accessible and reproducible for later reference. Your policy should specify retention length, backup and disaster recovery, retrieval in a usable format, secure transfer, and a 30-day retention of paper originals after verified scanning. Enforce HIPAA-aligned administrative, physical, and technical safeguards.

What are the required methods for destroying medical records securely?

Use cross-cut shredding or permitted incineration for paper, certified destruction for films, and secure wiping or physical destruction for electronic media. Keep a destruction log (identifier and date) and destroy records as part of a routine, scheduled process—never selectively—after confirming all applicable retention periods have run.