Federal Law on Medical Records Retention Requirements

In 1996, Congress passed the Health Insurance Portability and Accountability Act--HIPAA--which set national standards for handling of electronic medical records, including restricting who has access to them and how long records have to be retained before they're destroyed. HIPAA isn't the only federal program that sets record-retention requirements, and many states have set their own stricter standards for how long records must be preserved. HMOs and groups such as the American Medical Association may set added requirements based on what they consider necessary.

HIPAA

• The American Speech and Hearing Association says members who are covered by HIPAA must keep medical records on file for 6 years. If a patient dies, records must be kept for 2 years after his death. Health plans and healthcare providers who transmit records electronically are covered by HIPAA.

Medicare and Medicaid

• Medicare requires healthcare providers to retain records for Medicare patients for 5 years; if the provider is covered by HIPAA, the HIPAA 6-year requirement takes precedence. Medicaid requirements vary by state.

Non-HIPAA Information

• If a medical practice falls outside HIPAA, other federal rules apply. The American Health Information Management Association has a downloadable list on its website covering rules for laboratory tests, radiology labs, mammographies and other tests.