California Medical Records Retention Laws (2026 Guide)

California has some of the most detailed medical records retention laws in the country. Whether you are a patient trying to access old health records, a physician managing your practice, or a hospital administrator overseeing compliance, understanding these rules is essential.

This guide covers every aspect of California medical records retention law, including the specific statutes, how they apply to different provider types, federal interactions with HIPAA and Medicare, patient access rights, copy fees, destruction rules, practice closure requirements, and special rules for mental health records.

Last verified: March 2026. This page reflects current California Health and Safety Code Sections 123100 through 123149.5, Business and Professions Code Section 2266, and California Code of Regulations Title 22.

Table of Contents

• General Retention Requirements
• Hospital Records Retention
• Physician and Surgeon Requirements
• Skilled Nursing Facility Records
• Minor Patient Records
• Mental Health Records
• HIPAA and Federal Interaction
• CMS and Medicare Requirements
• Patient Access Rights
• Copy Fees and Costs
• Records Destruction Rules
• Practice Closure Requirements
• Penalties for Non-Compliance
• Frequently Asked Questions
• Sources and References

General Retention Requirements

California law establishes a baseline retention period of 7 years for medical records. This requirement comes from multiple overlapping statutes and regulations that apply to different types of healthcare providers.

The primary statute is California Health and Safety Code Section 123145, which requires licensed providers of health services to preserve patient records for a minimum of 7 years following the discharge of the patient.

This 7-year minimum applies broadly to providers licensed under Health and Safety Code Sections 1205, 1253, 1575, and 1726. These sections cover general acute care hospitals, skilled nursing facilities, intermediate care facilities, and home health agencies.

For physicians and surgeons specifically, Business and Professions Code Section 2266 separately mandates the same 7-year retention period, measured from the last date of service to the patient rather than from discharge.

The distinction between "date of discharge" and "last date of service" matters. For hospitals, the clock starts when the patient is discharged from the facility. For physicians in outpatient settings, it starts from the most recent appointment or service provided to that patient.

Hospital Records Retention

California Code of Regulations, Title 22, Section 70751 sets specific rules for general acute care hospitals.

Hospitals must retain patient records, including X-ray films or reproductions, for a minimum of 7 years following discharge. Records must be:

• Maintained in their original or legally reproduced form
• Filed in an easily accessible manner within the hospital or in an approved off-site storage facility
• Indexed by patient name, disease, operation, and treating practitioner
• Safeguarded against loss, defacement, tampering, or use by unauthorized persons

Medical records at hospitals must be completed promptly and authenticated or signed by a licensed healthcare practitioner within two weeks following the patient's discharge.

The hospital owns the medical record itself but maintains it for the benefit of the patient, the medical staff, and the institution. When a hospital closes or changes ownership, the California Department of Public Health must receive written documentation confirming safe preservation and continued availability of all patient records.

Physician and Surgeon Requirements

Business and Professions Code Section 2266 makes it explicit: failing to maintain adequate and accurate medical records for at least 7 years after the last date of service constitutes unprofessional conduct.

This is not just an administrative rule. Unprofessional conduct can lead to disciplinary action by the Medical Board of California, including license suspension or revocation.

The law requires that records be both "adequate" and "accurate." This means physicians must maintain records that are detailed enough to support continuity of care and that correctly reflect the services provided.

This provision was amended by SB 815, effective January 1, 2024, clarifying the retention period and professional obligations for physicians and surgeons.

Skilled Nursing Facility Records

California Code of Regulations, Title 22, Section 72543 governs records for skilled nursing facilities (SNFs).

SNFs must maintain permanent health records that are typewritten or legibly written in ink and capable of being photocopied. Key requirements include:

• All health records of discharged patients must be completed and filed within 30 days after the discharge date
• Records must be kept for a minimum of 7 years after discharge
• Records for minor patients must be kept until at least 1 year after the minor reaches age 18, but never less than 7 years
• X-ray films must also be retained for 7 years

Health record information in SNFs is confidential and may only be disclosed to authorized persons under federal, state, and local law. Records must remain legible and readily available to attending healthcare practitioners, facility staff, and authorized officials.

Facilities must notify the California Department of Public Health within three business days if records are defaced or destroyed before the required retention period ends. When ownership changes, both the outgoing and incoming licensees must document custody arrangements and record availability in writing.

Intermediate care facilities follow similar rules under Title 22, Section 73543, with the same 7-year retention period and minor patient protections.

Minor Patient Records

California provides extra protection for records of minor patients. Under multiple overlapping provisions, records for unemancipated minors must be retained until at least 1 year after the minor reaches age 18, but in no case less than 7 years.

Here is how this works in practice:

• A child treated at age 5 would have records retained until at least age 19 (1 year past age 18), which is 14 years from treatment
• A teenager treated at age 16 would have records retained until at least age 19, which is only 3 years. However, the 7-year minimum still applies, so the records would be kept until age 23
• A child treated at birth would have records retained until at least age 19, which is 19 years from treatment

This extended retention period applies across all facility types: hospitals (Title 22, Section 70751), skilled nursing facilities (Section 72543), intermediate care facilities (Section 73543), and providers covered by Health and Safety Code Section 123145.

The rule exists because minors cannot make their own medical or legal decisions during childhood. The extra retention time ensures they can access their health records as adults.

Mental Health Records

Mental health records in California receive additional protections under several laws.

Retention Period

Mental health records are subject to the same 7-year minimum retention period as other medical records. Licensed marriage and family therapists, clinical social workers, educational psychologists, and professional clinical counselors must retain client health service records for a minimum of 7 years from the date therapy is terminated, under Business and Professions Code Section 4980.49.

For minor patients in mental health treatment, records must be retained for at least 7 years from the date the patient reaches age 18.

Confidentiality Protections

The Lanterman-Petris-Short Act (Welfare and Institutions Code Section 5328) establishes that all information and records obtained in providing mental health services to both voluntary and involuntary recipients are confidential. This has been the law since 1972.

No one can share information about your mental health services or treatment without your permission, with limited exceptions for situations involving danger of violence to identifiable victims, law enforcement necessity, or child welfare protection.

Patient Access Restrictions

Health and Safety Code Section 123115 allows healthcare providers to restrict a patient's access to their own mental health records if the provider determines there is a "substantial risk of significant adverse or detrimental consequences" to the patient.

When a provider restricts access, they must:

• Document the refusal in writing with specific reasons
• Allow a licensed mental health professional designated by the patient to review the records instead
• Notify the patient of this alternative option
• Note the request in the patient's mental health record

The designated professional who reviews the records is not permitted to let the patient inspect or copy the records directly.

HIPAA and Federal Interaction

One of the most common misconceptions about medical records retention is that HIPAA sets a specific retention period for patient medical records. It does not.

HIPAA requires covered entities to retain HIPAA-related administrative documentation for 6 years from the date of creation or the date the document was last in effect, whichever is later. This applies to privacy policies, training records, business associate agreements, complaint records, and similar compliance paperwork under 45 CFR 164.530(j).

This 6-year requirement covers HIPAA compliance documents, not patient medical records themselves.

For actual patient medical records, HIPAA defers to state law. In California, that means the 7-year retention period under state statutes controls.

However, HIPAA does require that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records and other protected health information for whatever period the information is maintained. So while HIPAA does not tell you how long to keep records, it does tell you how to protect them for as long as you have them.

Which Law Wins?

When federal and state retention requirements overlap, providers must follow whichever law is more stringent. In California, the state 7-year minimum exceeds the federal HIPAA documentation requirement of 6 years, so providers should follow the California standard as a baseline.

CMS and Medicare Requirements

Providers who participate in Medicare and Medicaid face additional federal retention requirements from the Centers for Medicare and Medicaid Services (CMS).

Hospital Conditions of Participation

Under 42 CFR 482.24, hospitals participating in Medicare must retain medical records in their original or legally reproduced form for at least 5 years. California's 7-year requirement exceeds this federal minimum, so hospitals in California must follow the state standard.

Physician and Provider Requirements

CMS requires physicians and providers participating in Medicare Fee-for-Service to maintain medical records for 7 years from the date of service. This aligns with California's state law requirement.

For Medicare Managed Care programs (such as Medicare Advantage plans), the CMS record retention requirement extends to 10 years. California physicians participating in Medicare Advantage should follow this longer 10-year period.

Practical Guidance

Because different programs have different requirements, many California healthcare providers adopt a retention period longer than 7 years as a best practice. Retaining records for 10 years provides a buffer that covers most federal program requirements while also protecting against potential malpractice claims, which in California have a statute of limitations that can extend several years after discovery of injury.

Patient Access Rights

California law gives patients strong rights to access their own medical records under the Patient Access to Health Records Act, Health and Safety Code Sections 123100 through 123149.5.

Legislative Foundation

Section 123100 declares that every person who has ultimate responsibility for decisions about their own healthcare also has a "concomitant right of access to complete information" about their condition and care.

Who Can Access Records

Under Section 123110, the following individuals may inspect and obtain copies of patient records:

• The patient themselves
• The patient's personal representative or legal guardian
• Minors who are lawfully authorized to consent to their own treatment (for those specific records only)
• Authorized agents with a valid written authorization

Response Timeframes

Providers must respond to records requests within strict deadlines:

• Inspection: Providers must allow the patient to inspect records during business hours within 5 working days of receiving the request
• Paper or electronic copies: Must be delivered within 15 days of receiving the request
• Public benefit claims: Providers have up to 30 days for records requested to support eligibility for public benefit programs

These timeframes are enforceable. Providers who willfully violate these requirements face professional discipline.

Unpaid Medical Bills

Providers cannot withhold medical records because a patient has unpaid bills. California law specifically prohibits this practice, and providers who refuse to release records due to outstanding balances face sanctions.

Copy Fees and Costs

California law caps the fees that providers can charge for copies of medical records.

Under Health and Safety Code Section 123110, providers may charge cost-based fees limited to:

• Paper copies: Up to $0.25 per page
• Copies from microfilm: Up to $0.50 per page
• Labor costs for locating and copying the records
• Postage for mailing copies
• Summary preparation costs, but only if the patient specifically agrees to receive a summary instead of the full record

Free Records

Patients are entitled to receive copies of their records at no charge when the records are needed to support:

• Applications for public benefit programs
• U visa petitions under immigration law
• Claims under the Violence Against Women Act

The provider must furnish these records without cost once the patient presents proof that the records support one of these purposes.

Patient Notification

Under Health and Safety Code Section 123106, healthcare providers who create patient records must give the patient a statement at the time the initial record is created explaining the patient's rights to inspect and obtain copies of their records.

Records Destruction Rules

When the required retention period has expired, California law still imposes rules on how medical records must be destroyed.

Proper Destruction Methods

Under California Civil Code Section 1798.81, businesses must take all reasonable steps to dispose of records containing personal information by:

• Shredding paper documents
• Burning or pulping paper records to render them unreadable
• Erasing electronic media using software or hardware that overwrites data
• Degaussing magnetic media by exposing it to a strong magnetic field
• Physical destruction of electronic media through disintegration, pulverization, melting, or shredding

The goal is that protected health information must be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed."

Notification of Early Destruction

For licensed healthcare facilities, if records are defaced or destroyed before the required 7-year retention period ends, the facility must notify the California Department of Public Health within 3 business days under Title 22, Section 72543.

Liability for Improper Destruction

If a provider or business fails to properly destroy records and a patient suffers harm as a result (such as identity theft or unauthorized disclosure of health information), the patient can bring a lawsuit for damages.

Practice Closure Requirements

When a California physician or healthcare facility closes, specific rules protect patients and their records.

Patient Notification

The Medical Board of California requires physicians who are closing their practice to:

• Notify patients in writing of the closure, typically with 30 to 60 days advance notice
• Inform patients of the last day the physician will be available to provide care
• Provide at least 15 days of emergency treatment and prescription coverage before closing
• Tell patients where their records will be stored and how to access them
• Send notification letters by certified mail with return receipt requested

Records Preservation

Under Health and Safety Code Section 123145, providers who cease operations must still preserve records for the full 7-year minimum period. For minor patients, records must be preserved until at least 1 year after the minor reaches age 18.

Physicians must either retain the records themselves or designate a licensed custodian and disclose that custodian's contact information in the patient notification letter.

Records Abandonment

Section 123145 defines "abandonment" as occurring when a provider violates the retention requirements and denies patients access to their medical records guaranteed under Section 123110.

The California Department of Health Services or any injured individual may pursue legal action against licensees for damages resulting from records abandonment. If the licensee is a dissolved corporation or partnership, claims can be brought against the entity's principal officers.

Medical Board Notification

Physicians must also notify the Medical Board of California about the practice closure, relinquish hospital privileges, and update their NPI (National Provider Identifier) profile.

Penalties for Non-Compliance

California imposes serious consequences for violations of medical records retention and access laws.

Professional Discipline

For physicians and surgeons, failure to maintain records for 7 years constitutes unprofessional conduct under BPC Section 2266. Consequences can include:

• Formal reprimand or citation
• Probationary conditions on the medical license
• License suspension
• License revocation in severe cases

Civil Liability

Providers who abandon records or deny patient access face potential lawsuits for damages under HSC Section 123145(b). Both the state Department of Health Services and individual patients can bring these claims.

Facility Sanctions

Hospitals and skilled nursing facilities that fail to comply with Title 22 records requirements may face:

• Deficiency citations from the California Department of Public Health
• Fines and corrective action plans
• Potential impact on facility licensing and Medicare/Medicaid participation

Withholding Records

Providers who willfully withhold records from patients in violation of HSC Section 123110 face professional discipline and potential sanctions.