Ohio Medical Records Retention Requirements: How Long to Keep Patient Records

Ohio’s rules for how long you must keep patient records vary by setting and license type, so your Medical Records Retention Policy should anchor to the strictest rule that applies to your organization. Below you’ll find clear, Ohio-specific timeframes, plus practical steps to align with Regulatory Compliance in Medical Records while safeguarding Healthcare Data Protection and Patient Confidentiality Compliance.

General Retention Period

At‑a‑glance timeframes (adults)

• Hospitals and certain licensed health care services: keep records needed to verify required reports for at least 6 years from the date of discharge. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-3701-83-11?utm_source=openai))
• Physicians operating a pain management clinic: keep patient and billing records 7 years from the last date of treatment. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/chapter-4731-29))
• Chiropractors: keep records 5 years from the last clinical encounter (longer rules apply for minors and litigation; see below). ([codes.ohio.gov](https://codes.ohio.gov/assets/laws/administrative-code/authenticated/4734/0/8/4734-8-04_20251225.pdf?utm_source=openai))
• Psychologists: keep records at least 7 years after the last service (longer for minors; see below). ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-4732-17-01?utm_source=openai))
• Optometrists: keep records at least 7 years. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-4725-5-11?utm_source=openai))
• EMS/Mobile medical services: keep patient transport records at least 7 years. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-4766-4-05?utm_source=openai))

Practical baseline for mixed settings

Because multiple Ohio licensing rules cluster at 6–7 years, many providers adopt a conservative baseline of at least 7 years from the last encounter for adult patient records unless a longer program, contract, or specialty rule applies. Note that HIPAA does not set a general clinical record-retention period; it does, however, require you to retain HIPAA compliance documentation (not the medical chart itself) for 6 years. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/580/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html?utm_source=openai))

Records of Minor Patients

Ohio rules commonly require you to retain a minor’s record beyond the age of majority. For example, chiropractors must keep minor records for 2 years after the patient turns 18 or 5 years from the last encounter, whichever is longer; psychologists must retain for at least 2 years beyond majority or 7 years after last service, whichever is longer. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-4734-8-04?utm_source=openai))

As a practical policy, keep minor records until at least age 20 and apply any longer specialty‑specific duration that fits your practice. If your organization treats minors across multiple disciplines, default to the longest applicable rule to ensure Patient Confidentiality Compliance and uninterrupted continuity of care. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-4732-17-01?utm_source=openai))

Records Pertaining to Legal Proceedings

When litigation is reasonably anticipated, served, or ongoing, immediately place a legal hold that suspends normal destruction. For chiropractors, records “pertinent to contemplated or ongoing legal proceedings” must be kept 2 years beyond the conclusion of the proceeding or 5 years from last encounter, whichever is longer—illustrating Ohio’s expectation to preserve evidence. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-4734-8-04?utm_source=openai))

More broadly, medical‑malpractice claims in Ohio face a 1‑year statute of limitations and a 4‑year statute of repose; destroying relevant records before those periods (or a court order) can create significant risk. Work with counsel to time any release of a legal hold accordingly. ([codes.ohio.gov](https://codes.ohio.gov/ohio-revised-code/section-2305.113/10-3-2023?utm_source=openai))

Electronic Records Management

Align EHR practices with enforceable standards

• Retain HIPAA Privacy/Security documentation—policies, procedures, risk analyses, sanctions, and other required records—for at least 6 years from creation or last effective date. This complements, but does not replace, your clinical record‑retention timelines. ([govinfo.gov](https://www.govinfo.gov/content/pkg/CFR-2018-title45-vol1/pdf/CFR-2018-title45-vol1-part164.pdf?utm_source=openai))
• Maintain EHR integrity: preserve original entries, amendments, e‑signatures, and relevant audit trails in a system of record that remains queryable for the full Legal Record Retention Duration you adopt. ([govinfo.gov](https://www.govinfo.gov/content/pkg/CFR-2018-title45-vol1/pdf/CFR-2018-title45-vol1-part164.pdf?utm_source=openai))
• Engineer for continuity: implement redundant backups, tested restores, and documented data‑migration plans so historical records stay accessible and complete. ([govinfo.gov](https://www.govinfo.gov/content/pkg/CFR-2018-title45-vol1/pdf/CFR-2018-title45-vol1-part164.pdf?utm_source=openai))
• Apply secure media controls: for ePHI, implement device/media receipt, transfer, disposal, and re‑use procedures per the HIPAA Security Rule. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.310?utm_source=openai))

Destruction of Records

Only destroy records after confirming that all federal, state, licensing‑board, payer, contractual, and legal‑hold obligations have been met. For electronic media, HIPAA requires policies for final disposition and for removing ePHI before re‑use; acceptable methods include shredding, pulverizing, degaussing, or cryptographic erasure so data are unreadable and unrecoverable. Maintain a destruction log or vendor certificate as part of your Confidential Destruction Procedures. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/575/what-does-hipaa-require-of-covered-entities-when-they-dispose-information/index.html?utm_source=openai))

Confidentiality Measures

Ohio law and the HIPAA Rules require robust safeguards. Facilities must maintain adequate record‑keeping systems and protect medical records from theft, loss, destruction, and unauthorized use—core elements of Healthcare Data Protection. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-3701-83-11?utm_source=openai))

Ohio’s public‑records law excludes “medical records” from disclosure and defines them broadly, reinforcing your duty to keep PHI confidential while honoring authorized disclosures and patient rights. ([codes.ohio.gov](https://codes.ohio.gov/ohio-revised-code/section-149.43/9-30-2025?utm_source=openai))

Record Accessibility and Protection

Patients have a right to inspect or receive copies of their records. Under Ohio law, providers must permit examination during business hours or provide copies within a reasonable time; specific fees and processes are set by statute. ([codes.ohio.gov](https://codes.ohio.gov/ohio-revised-code/section-3701.74?utm_source=openai))

Under HIPAA, you must act on access requests within 30 days (one additional 30‑day extension allowed with written notice), and you should leverage your Electronic Health Record (EHR) Standards to streamline secure delivery. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html?utm_source=openai))

Summary

In Ohio, retention is provider‑specific: hospitals 6 years from discharge; many licensed practitioners 7 years; chiropractors 5 years; longer rules for minors and litigation. Build a single, written policy that defaults to the longest applicable rule, preserves records under legal hold, and documents HIPAA compliance for 6 years. This approach keeps you aligned with Patient Confidentiality Compliance and strengthens operational resilience. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-3701-83-11?utm_source=openai))

FAQs

How long must Ohio medical records be retained?

It depends on the setting and license: hospitals and certain licensed services must retain records needed to verify required reports for at least 6 years from discharge; many practitioner rules set a 7‑year minimum; chiropractors require 5 years. As a practical baseline, keep adult records at least 7 years from the last encounter unless a longer rule applies. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-3701-83-11?utm_source=openai))

What are the retention requirements for minor patients' records?

Ohio commonly requires retention beyond age 18. For example, chiropractors must keep minor records until at least age 20 or 5 years from last encounter (whichever is longer), and psychologists must keep them at least 2 years beyond majority or 7 years after last service, whichever is longer. As a policy, keep minor records until at least age 20 and follow any longer specialty rule. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-4734-8-04?utm_source=openai))

How should electronic medical records be maintained?

Maintain EHRs so entries, amendments, signatures, and audit trails remain intact and retrievable for the full retention period; retain HIPAA compliance documentation for 6 years; and implement device/media controls for secure storage, re‑use, and disposal. ([govinfo.gov](https://www.govinfo.gov/content/pkg/CFR-2018-title45-vol1/pdf/CFR-2018-title45-vol1-part164.pdf?utm_source=openai))

What are the legal considerations for retaining records during litigation?

Implement an immediate legal hold, suspend routine destruction, and preserve all relevant paper and electronic data until the matter is fully resolved and any counsel‑directed buffer has elapsed. Ohio rules illustrate this: chiropractic records tied to legal proceedings must be kept 2 years beyond the proceeding’s conclusion (or 5 years from last encounter, whichever is longer), and malpractice claims are further bounded by a 1‑year statute of limitations and 4‑year statute of repose. ([codes.ohio.gov](https://codes.ohio.gov/ohio-administrative-code/rule-4734-8-04?utm_source=openai))