# Does HIPAA require keeping every medical record for six years?

Canonical: https://prospyrmed.com/resources/practice-answers/medical-record-retention
Sources reviewed: 2026-09-16 · Prepared by Prospyr

No. HIPAA does not set a general medical-record retention period. HIPAA documentation requirements are different from clinical record retention. Determine the applicable state, professional, payer and other requirements for your practice, including special rules for minors and legal holds.

## Separate record categories

HHS specifically explains that the Privacy Rule does not include medical-record retention requirements. Do not convert the familiar HIPAA six-year documentation rule into a universal schedule for clinical charts, images, billing evidence or consent records.

Source: [HHS: Does HIPAA require medical record retention?](https://www.hhs.gov/hipaa/for-professionals/faq/580/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html) — HIPAA FAQ; state retention laws still apply

## Create an approved retention matrix

This is an operational planning recommendation: classify records, identify controlling requirements, calculate the retention trigger and document who approved the schedule. Suspend routine destruction when a legal hold or other applicable duty requires preservation. Confirm secure destruction procedures separately.

Source: [HHS: Does HIPAA require medical record retention?](https://www.hhs.gov/hipaa/for-professionals/faq/580/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html) — HIPAA FAQ; state retention laws still apply

## Practical checklist

1. List clinical, image, consent, billing and privacy-policy record categories.
2. Identify applicable state and other retention requirements.
3. Document trigger dates, minors’ rules and legal-hold handling.
4. Approve the schedule before deleting records or migrating systems.

## Worked example

A practice changes EMRs and proposes deleting all charts older than six years. That is not a safe conclusion from HIPAA alone. Review the actual retention rules and holds, then reconcile the migrated archive before any approved disposal.

## Mistakes to avoid

- Using six years as a universal chart-deletion rule.
- Assuming a software subscription ending removes retention obligations.
- Deleting old photos without checking whether they are part of the record.

## Related questions

- [Can a practice withhold patient records because a bill is unpaid?](https://prospyrmed.com/resources/practice-answers/patient-record-access)
- [Can a med spa post before-and-after photos with treatment consent?](https://prospyrmed.com/resources/practice-answers/patient-photo-marketing-authorization)
- [What should an injectable lot and recall log track?](https://prospyrmed.com/resources/practice-answers/drug-lot-recall-tracking)

Prepared by Prospyr from the cited primary sources. These are educational workflow resources, not individualized clinical, coding, legal or tax advice. No clinician, certified-coder or attorney review is claimed. Confirm current code instructions, payer terms and applicable law for the actual service and date. CPT is a registered trademark of the American Medical Association; this is not a substitute for a licensed current code set.