Q&A: Retaining the records of out-of-state patients

Q: How long are we required to retain the records of out-of-state patients? Do we follow HIPAA’s record retention requirements, our state record retention requirements, or the record retention requirements of the state in which the patient lives?

A: You must comply with federal laws/regulations and the laws/regulation of the state in which your facility is located.  You must keep the records of out-of-state patients for the same time periods as you keep the records of other patients who live within your state.

The HIPAA Privacy Rule does not address medical record retention. It only requires certain compliance records to be maintained for 6 years. 

Editor’s note: Mary Brandt is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Associate Editor Heidi Samuelson at hsamuelson@hcpro.com.