Delaware Medical Records Retention Laws (2026 Guide)

Delaware law requires physicians to keep patient medical records for a minimum of 7 years from the last entry date in the patient's chart. This requirement is established under Del. Code tit. 24, Section 1761, which is part of the state's Medical Practice Act.

Whether you are a healthcare provider working to maintain compliance, a patient trying to access old records, or an administrator managing a practice closure, this guide covers every aspect of Delaware's medical records retention laws. It includes the state statute requirements, federal rules from HIPAA and CMS, patient access rights, proper destruction methods, and practice closure obligations.

Physician Medical Records Retention in Delaware

The primary statute governing medical records retention for physicians in Delaware is Del. Code tit. 24, Section 1761. The law establishes a clear 7-year retention period measured from the last entry date in the patient's medical record.

Under this statute, a physician who stops treating a patient, discontinues a medical practice, or leaves the state must retain that patient's records for 7 years from the date of the last entry. After those 7 years have passed and the patient has not requested their records, the physician may permanently dispose of them.

When the 7-Year Clock Starts

The retention period begins on the date of the last entry in the patient's record. This is not the date of the patient's first visit, the date the practice opened, or the date the physician stopped seeing the patient. It is specifically tied to the final documented entry.

For example, if a physician's last documented note for a patient is dated March 15, 2020, the earliest that record may be destroyed is March 15, 2027. If the physician adds a late entry, addendum, or correction to the chart, the clock resets from the date of that new entry.

What Records Must Be Retained

Delaware's statute applies broadly to "patient records" without narrowly defining which specific documents are included. In standard medical practice, this covers:

• Progress notes and visit summaries
• Lab results and diagnostic imaging reports
• Treatment plans and medication records
• Referral correspondence
• Signed consent forms
• Operative reports and procedure notes
• Immunization records
• Allergy documentation

Physicians should retain the complete medical chart rather than selectively keeping only portions of it.

Hospital Medical Records Retention

Delaware does not have a specific state statute that establishes a retention period for hospital medical records. Unlike physicians, who are governed by Del. Code tit. 24, Section 1761, hospitals in Delaware must look to federal regulations for their baseline retention requirements.

Federal CMS Requirements for Hospitals

Hospitals participating in Medicare must comply with the Conditions of Participation under 42 CFR 482.24, which requires medical records to be retained for at least 5 years from the date of discharge. This federal standard serves as the minimum for Delaware hospitals.

Other facility types have different federal minimums:

Facility Type	Minimum Retention Period	Federal Authority
Hospitals (Medicare)	5 years after discharge	42 CFR 482.24
Critical Access Hospitals	6 years from last entry	42 CFR 485.638
Rural Emergency Hospitals	5 years from last entry	42 CFR 485.540
Medicare providers (general)	7 years from date of service	CMS guidelines
Medicare Part D sponsors	10 years from date of service	CMS guidelines

Because Delaware has no state-level hospital retention statute, the federal requirement is the controlling standard. However, many Delaware hospitals adopt internal policies that exceed the federal minimum, often matching the 7-year physician standard or going beyond it.

Nursing Facility and Long-Term Care Records

Delaware's administrative regulations for nursing facilities include specific records retention rules under 16 Del. Admin. Code Section 3201-9.0. Nursing homes and skilled nursing facilities in Delaware must retain resident records for 6 years after discharge.

For records involving minor patients in nursing or long-term care settings, the requirement extends to 3 years after the patient reaches the age of majority (age 18 in Delaware), meaning records must be kept until the former minor turns 21.

Medical Records for Minor Patients

Delaware's physician records statute (Del. Code tit. 24, Section 1761) does not include a separate, extended retention period specifically for records of minor patients. The standard 7-year retention period applies to both adult and minor patients in physician practices.

However, managed care organizations (MCOs) operating in Delaware face a significantly longer requirement. Under 18 Del. Admin. Code Section 1403-12.0, MCOs must preserve medical records of minors for the period of minority plus 5 years. In practical terms, this means records must be kept until the patient reaches age 23.

Retention Summary by Provider Type

Provider Type	Adult Records	Minor Records
Physicians	7 years from last entry	7 years from last entry (no separate minor rule)
Hospitals	5 years (federal CMS minimum)	5 years (federal CMS minimum)
Nursing facilities	6 years after discharge	3 years after age of majority (until age 21)
Managed care organizations	5 years from last use	Period of minority plus 5 years (until age 23)

Best Practice for Minor Records

Even though Delaware's physician statute does not mandate an extended retention period for minors, healthcare attorneys and risk management professionals widely recommend keeping records of minor patients for at least the period of minority plus the applicable statute of limitations. In Delaware, the medical malpractice statute of limitations is generally 2 years from the date of injury, with a 3-year discovery rule. This means retaining minor records until at least age 20 or 21 provides stronger legal protection.

HIPAA and Federal Requirements

One of the most widely misunderstood aspects of medical records law is the role of HIPAA. HIPAA does not require healthcare providers to retain patient medical records for any specific period of time. The U.S. Department of Health and Human Services has confirmed this directly.

What HIPAA Does Require

HIPAA requires covered entities to retain certain administrative documentation for 6 years under 45 CFR 164.530(j). This 6-year requirement applies to:

• Privacy policies and procedures
• Privacy practices notices
• Disposition of complaints
• Business associate agreements
• Training records
• Other HIPAA compliance documentation

This is entirely separate from patient medical records. The 6-year HIPAA retention rule covers the paperwork proving you followed the rules, not the actual patient charts.

HIPAA Privacy Protections During Retention

While HIPAA does not dictate how long to keep records, it does require that all protected health information (PHI) be safeguarded for as long as it exists. This includes physical security measures, access controls, and encryption for electronic records. These protections apply from the moment a record is created until it is properly destroyed.

Which Law Controls?

When state and federal requirements conflict, the stricter standard applies. A Delaware physician must retain records for 7 years under state law, which exceeds the general CMS minimum. A hospital in Delaware without a state requirement defaults to the 5-year CMS standard. If that hospital also accepts Medicare, the CMS Conditions of Participation requirement of 5 years is the controlling minimum.

CMS and Medicare Requirements

Healthcare providers who participate in Medicare or Medicaid must comply with CMS record retention requirements in addition to state law. For general Medicare providers, CMS requires records to be kept for 7 years from the date of service.

Since Delaware's state requirement for physicians is also 7 years, the two standards align. However, the measurement differs slightly. Delaware measures from the last entry date, while CMS measures from the date of service. Providers should use whichever calculation yields the longer retention period to ensure compliance with both.

Patient Access to Medical Records in Delaware

Delaware law guarantees patients the right to obtain copies of their medical records. Under Del. Code tit. 24, Section 1761, patients may request copies from any physician certified to practice medicine in the state.

Copy Fees

The Delaware Board of Medical Licensure and Discipline sets the maximum fees that physicians may charge for copying medical records:

Pages	Maximum Fee Per Page
Pages 1 through 10	$2.00
Pages 11 through 20	$1.00
Pages 21 through 60	$0.90
Pages 61 and above	$0.50
Microfilm and other media	Actual cost of reproduction
Postage or shipping	Actual cost

These fee limits apply regardless of whether the practice provides copies directly to the patient or to another physician, and they apply to both paper and electronic copies. Practices may require payment in advance, except for records related to a disability benefits application.

Response Timeline

A physician has 45 days from the closure of the record or the assembly of a complete record to fulfill a records request. If a faster response is medically necessary, the provider must accommodate that need.

Under HIPAA, the federal standard requires providers to respond to records requests within 30 days, with a possible 30-day extension. The stricter standard applies. In most cases, the 30-day HIPAA deadline will control because it is shorter than Delaware's 45-day window.

Transfer Between Physicians

When a patient changes from one physician to another, the new and former physicians may agree to transfer a summary of the record instead of the complete file, at no charge to the patient. However, the patient must consent to this arrangement.

Proper Destruction of Medical Records

Once records have exceeded the required retention period, Delaware law permits their destruction. Del. Code tit. 24, Section 1761 states that records may be "permanently disposed of in a manner that ensures confidentiality of the records."

HIPAA Destruction Standards

HIPAA requires that destroyed records be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed." Approved methods include:

Paper records:

• Cross-cut shredding
• Burning
• Pulping
• Pulverizing

Electronic records:

• Clearing (overwriting with non-sensitive data)
• Purging or degaussing (using a strong magnetic field)
• Physical destruction of storage media (crushing, melting, incinerating)

Records may never be placed in dumpsters, recycling bins, or other containers accessible to unauthorized persons. Providers who hire a third-party vendor for destruction must have a HIPAA business associate agreement in place.

Liability Protection

A physician or the personal representative of a deceased physician's estate who disposes of patient records in accordance with Section 1761 is not liable for any direct or indirect loss suffered as a result of the disposal. This statutory protection applies only when the destruction follows the required retention period and is done in a manner that protects confidentiality.

Practice Closure Requirements in Delaware

When a physician discontinues a medical practice in Delaware, leaves the state, or terminates a patient relationship, Del. Code tit. 24, Section 1761 imposes specific notification and records management obligations.

Patient Notification

The physician must notify affected patients at least 30 days before discontinuing services. The notification must include:

• How the patient can obtain their medical records
• The name, phone number, and address of other healthcare providers in the area who may be available to accept new patients

Board Notification

The physician must also notify the Delaware Board of Medical Licensure and Discipline about how former patients may obtain their medical records after the practice closes.

Record Custodianship

If a physician becomes physically or mentally incapacitated, abandons their practice, or involuntarily discontinues their practice, the Board may appoint a custodian of patient records under Del. Code tit. 24, Section 1761A. The custodian must:

• Notify patients by publishing notice in a newspaper of daily circulation in the area
• Publish the notice at least once per month for 3 months
• Explain how patients can obtain their records

The Board maintains a registry of physicians and healthcare entities willing to serve as records custodians.

Physician Death

When a physician dies, their estate or personal representative is responsible for maintaining patient records for the remainder of the 7-year retention period. The Board may also appoint a custodian if the estate cannot adequately manage the records.

Statute of Limitations Considerations

Delaware's medical malpractice statute of limitations is 2 years from the date of injury. If the injury was not immediately discoverable, the deadline extends to 3 years from the date when the injury was or should have been discovered through reasonable diligence.

A plaintiff may also toll (pause) the statute of limitations for an additional 90 days by sending a Notice of Intent to investigate to each potential defendant. Courts may grant a single 60-day extension for filing an affidavit of merit if the plaintiff cannot obtain medical records despite reasonable efforts.

Because malpractice claims can arise several years after treatment, healthcare attorneys in Delaware generally recommend retaining records for at least 7 years. The state's statutory 7-year retention period for physicians provides adequate coverage in most cases, though providers treating high-risk patient populations may choose to retain records longer as a precaution.

Electronic Health Records

Delaware does not impose separate retention requirements for electronic versus paper medical records. The 7-year physician retention period applies regardless of the storage format. Both paper charts and electronic health records (EHR) must be maintained for the same duration.

Managed care organizations in Delaware must preserve records as "original records, on microfilm, or electronically stored" under 18 Del. Admin. Code Section 1403-12.0. There is no requirement to maintain paper copies if records exist in a compliant electronic format.

When converting from paper to electronic records, providers should verify that the digital version is a complete and accurate reproduction of the original before destroying paper copies. HIPAA security requirements, including access controls, audit trails, and encryption, apply to all electronic PHI throughout the retention period.