Print Friendly, PDF & Email
| add this

Medical Record Retention Guidelines

Posted on 02/06/20

When it comes to medical record retention laws, most states have their own rules as to how long medical records should be held by physicians and hospitals. But with the enactment of HIPAA in 1996, Medicare record retention requirements in some instances supersede state laws. HIPAA’s administrative simplification rules require a covered entity, including health plans, healthcare clearing houses, and healthcare providers who transmit any health information (a physician billing Medicare), to retain required documentation for six years from the date of its creation or the date when it last was in effect, whichever is later. Individual states may require a longer retention period. If not, the HIPAA requirements preempt the shorter state laws. A full explanation of HIPAA documentation rules can be found under Standard 45 CFR 164.316(b)(2).

Under the HIPAA Privacy Rule, covered entities must apply appropriate administrative, technical and physical safeguards when it comes to protecting the privacy of medical records and other protected health information (PHI) for the period that the entity must maintain the records and through disposal. For examples of proper disposal methods and other requirements, refer to the Privacy Rule at 45 CFR 164.530(c).

When it comes to cost reports, the Centers for Medicare & Medicaid Services (CMS) requires these records to be maintained in their original or legally reproduced form for a period of at least five years after the closure of the cost report. Further details on all CMS records disposition schedules  can be accessed at the CMS Records Schedule.

CMS does not have specific requirements for the media formats for medical records, but documents do need to be in their original form or a legally reproduced form (which can be electronic) so that medical records may be reviewed and audited by authorized entities.

Physicians, non-physician practitioners, suppliers and providers should maintain a medical record for each Medicare beneficiary who is their patient. These records must be completed promptly, accurately written, easily accessible, properly filed and maintained. It’s a good practice to implement a system of author identification and record maintenance to safeguard all medical record entries and protect their security.

The KB Healthcare Consulting team works with healthcare providers to adopt medical records retention systems for their practices. Providers may also want to work with their legal partners for up-to-date information on changes in regulations and statutes when it comes to medical records retention, maintaining records after these time periods and proper medical document formats.

If you’re a healthcare provider and need further information regarding medical record retention requirements, contact Johna Kennedy-Preston with KB Healthcare Consulting at 941-365-4617 or .

About the Author

Johna Kennedy-Preston

Kerkering, Barberio & Co.
1990 Main St., Suite 801
Sarasota, FL 34236
(941) 365-4617

Ms. Kennedy-Preston is a senior-level healthcare business operations consultant. She provides clients with expertise in revenue cycle management, coding education, managed care contracting, mergers and start-up ventures, Medicare recoupment and reporting issues, credentialing with insurance carriers and assistance with state and federal licensing. 

Contact Us

location icon

Our Locations

Sarasota Office
1990 Main Street, Suite 801
Sarasota, FL 34236
Phone: 941.365.4617
Toll Free: 800.966.8676
Fax: 941.954.3207

Lakewood Ranch Office
9423 Town Center Parkway
Lakewood Ranch, FL 34202
Phone: 941.365.4617

Tampa Office
4350 West Cypress Street
Meridian One, Suite 930
Tampa, FL 33607
Phone: 813.675.8800

Lets Get Started.



leading edge alliance move project logo green business logo 2019 IPA 200
For Updates on COVID-19, click here.Learn More