Utah Medical Records Retention Requirements for Providers: How Long to Keep Adult and Minor Patient Records

General Retention Periods

You should anchor your record retention policies to Utah’s licensed facility rules, which set a clear minimum retention duration. For hospitals, the rule is at least seven years from the last date of patient care, with longer time frames for minors detailed below. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

Across healthcare facility categories, Utah consistently requires robust Medical Records Confidentiality, secure storage, and timely retrieval. Hospitals must maintain secure access and indexing, while similar expectations apply in other licensed settings. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

• Hospitals: retain adult patient records for at least seven years after the last date of care. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))
• Small Health Care Facility — Type N: retain resident records for at least seven years after discharge. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-300/section-r432-300-9/))
• Ambulatory Surgical Centers (ASCs): retain adult patient records for at least seven years after the last date of care. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-500/section-r432-500-21/))

Minor Patient Record Retention

Patient age considerations change the clock. Hospitals must keep a minor’s record until the patient turns 18, plus four additional years, and in no case fewer than seven years. For ASCs, the rule is age 18 (or age of majority) plus three years. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

Example: If a child is treated on March 1, 2026, and turns 18 on July 15, 2038, a hospital would keep the record until July 15, 2042 (18 + 4). An ASC would keep it until July 15, 2041 (18 + 3). This approach aligns your policy with Division rules compliance while honoring minimum retention duration requirements. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

Retention in Small Healthcare Facilities

For small healthcare facilities (Type N), Utah requires you to keep each resident’s record for at least seven years following discharge. Build your internal policy to reflect this baseline while preserving confidentiality and rapid access for authorized users. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-300/section-r432-300-9/))

Ambulatory Surgical Center Requirements

ASCs follow facility-specific standards that combine retention and confidentiality. You must keep medical records at least seven years after the last date of patient care, or for minors until the patient reaches 18 (or the age of majority) plus three years. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-500/section-r432-500-21/))

• Ownership changes: a new owner must retain any patient records after a change of ownership. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-500/section-r432-500-21/))
• Medical records confidentiality and release: maintain written procedures and disclose information only to authorized persons under federal and state law, with written consent required for identifying information (such as photographs). ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-500/section-r432-500-21/))
• Electronic medical record standards: an automated record system is permitted if it meets the content requirements of the rule. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-500/section-r432-500-21/))

Retention for Private Physicians

Utah does not set one universal, explicit minimum retention period for office-based private physicians in the Medical Practice Act Rule. Instead, physicians must maintain medical records in accordance with applicable laws, regulations, and the AMA Code of Medical Ethics. Many practices mirror hospital standards (e.g., seven years for adults; extended periods for minors) to create defensible record retention policies. ([regulations.justia.com](https://regulations.justia.com/states/utah/commerce/title-r156/rule-r156-67/section-r156-67-803/))

If your private practice also operates a licensed facility (for example, an ASC), the facility-specific retention rules apply to records created in that setting. Aligning policies to the strictest applicable rule simplifies compliance across healthcare facility categories. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-500/section-r432-500-21/))

Managing Electronic Medical Records

Utah permits electronic medical records when your system safeguards access and preserves content integrity. Hospitals must implement policies for access controls, identification codes, security, and information retention for charting systems. ASCs must ensure any automated record system meets the rule’s content requirements. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

In practice, you should validate that backups, audit trails, and retention timers match your Record Retention Policies. The format—paper or electronic—does not change the minimum retention duration or your Medical Records Confidentiality obligations under Utah rules. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

Compliance and Documentation Standards

Beyond “how long,” Utah rules specify how you document, organize, and ultimately dispose of records. Use these compliance checkpoints to harden your policy and procedures. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

Key operational standards

• Timeliness and completeness: hospitals must collect, assemble, and authenticate discharged patient records within 30 days; physicians must complete the medical record. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))
• Permanent master index: hospitals must permanently maintain a master patient index with core identifiers (name, medical record number, date of birth, admission/discharge dates, and attending physician). ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))
• Destruction notices: before a hospital destroys records after the minimum period, it must publish notice in a statewide newspaper once per week for three consecutive weeks to allow former patients to obtain records. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))
• Change of ownership: in an ASC, the new owner must retain existing patient records. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-500/section-r432-500-21/))
• Confidentiality and controlled access: maintain secure storage, controlled access, and release only to authorized parties under facility policy and law. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

Conclusion

To meet Utah Medical Records Confidentiality and retention obligations, set a unified policy that covers adult and minor timelines, spells out EMR access and security controls, and maps responsibilities for indexing, release, and destruction. When in doubt, align private-practice policies with the strictest applicable facility rule to ensure Division rules compliance across settings. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

FAQs

How long must adult medical records be retained in Utah?

For licensed facilities, the minimum retention duration is generally seven years after the last date of care (hospitals and ASCs), and seven years after discharge in small health care facilities (Type N). Your policy should not go below these baselines. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

What are the retention requirements for minor patient records?

Hospitals must retain a minor’s record until the patient turns 18 plus four years (and never fewer than seven years). ASCs must retain until the patient turns 18 (or age of majority) plus three years. Consider using the stricter standard when creating a single, systemwide policy. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))

Are there specific rules for ambulatory surgical centers?

Yes. ASCs must keep records at least seven years (adults) or until a minor turns 18 plus three years; maintain confidentiality; have written release procedures; and ensure that a new owner retains records after a change of ownership. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-500/section-r432-500-21/))

Can medical records be stored electronically in Utah?

Yes. Hospitals must adopt access, authentication, and information-retention controls for electronic charting systems, and ASCs may use automated record systems that meet content requirements. Retention timelines and confidentiality rules apply regardless of format. ([regulations.justia.com](https://regulations.justia.com/states/utah/health/title-r432/rule-r432-100/section-r432-100-35/))