Idaho Medical Records Retention Laws (2026 Guide)

Medical records retention in Idaho is governed primarily by Idaho Code 39-1394, which sets the rules for how long hospitals must keep patient records, how they may store them, and when and how they can be destroyed. Federal regulations from the Centers for Medicare and Medicaid Services (CMS) and HIPAA add additional layers of requirements.

This guide covers every aspect of medical records retention law in Idaho, from hospital and physician obligations to patient access rights, minor records, destruction rules, and what happens when a medical practice closes.

Hospital Records Retention Requirements

Idaho's primary medical records retention law is Idaho Code Section 39-1394, which falls under Title 39, Chapter 13 (Hospitals) of the Idaho Statutes.

General Retention Period

Hospitals in Idaho must retain medical records in their original or legally reproduced form. The Idaho Administrative Code (IDAPA 16.03.14.360) requires that hospital medical records conform with Section 39-1394 of the Idaho Code.

While Idaho Code 39-1394 specifically addresses the retention and destruction of clinical laboratory records and X-ray films, federal law under 42 CFR 482.24 requires all hospitals participating in Medicare to retain medical records for a minimum of 5 years.

Clinical Laboratory Records

Under Idaho Code 39-1394, clinical laboratory test records and reports may be destroyed 5 years after the date of the test recorded or reported in those records. This 5-year period begins from the date the test was performed, not from the date of patient discharge.

X-Ray Films

X-ray films follow a similar 5-year retention rule, but with an important exception for minors. Under the same statute, X-ray films may be destroyed 5 years after the date of exposure, or 5 years after the patient reaches the age of majority (18 in Idaho), whichever is later.

This means for a 10-year-old patient, X-ray films could not be destroyed until they turn 23 years old, which is 5 years after they reach the age of 18.

The statute includes an important condition: X-ray films may only be destroyed when the hospital record contains written findings of a physician who has read those X-ray films. If no written physician interpretation exists in the record, the original films must be preserved.

Acceptable Storage Formats

Idaho Code 39-1394 specifically authorizes hospitals to preserve patient care records in:

• Microfilm
• Other photographically reproduced forms
• Electronic medium

Records preserved in any of these formats are treated as originals for all legal purposes, including court proceedings under Idaho Code 9-420.

Physician and Private Practice Records

Idaho does not have a specific statute that governs how long private physicians or physician groups must retain medical records. Idaho Code 39-1394 applies only to hospitals as defined in Chapter 13, Title 39 of the Idaho Code.

Recommended Retention Periods for Physicians

Because Idaho law does not set a specific period for physician practices, providers should consider several overlapping requirements when establishing their own retention policies:

Idaho Medicaid requirements. Providers participating in Idaho Medicaid must maintain records to support claims for at least 5 years.

Federal Medicare requirements. CMS recommends that providers retain medical records for at least 7 years from the date of service, as claims can be audited within that window.

Malpractice statute of limitations. Under Idaho Code 5-219, the general statute of limitations for professional malpractice in Idaho is 2 years from the date of the occurrence. However, in cases involving foreign objects left in a patient or fraudulent concealment of malpractice, the timeline can be extended. Many legal experts recommend retaining records for at least 7 to 10 years to account for potential discovery rule extensions.

Best Practice Recommendation

The American Medical Association and most state medical associations recommend that physicians retain patient medical records for at least 10 years from the date of the last encounter. In the absence of a specific Idaho statute for physician practices, following the 10-year guideline provides a reasonable margin of safety for both legal protection and continuity of care.

Records for Minor Patients

Idaho law provides extended protections for records involving minor patients. These extended retention requirements apply across multiple record types.

Hospital Records for Minors

Under Idaho Code 39-1394, X-ray films for minor patients must be retained for 5 years after the patient reaches 18 years of age (the age of majority in Idaho). This means hospitals must keep X-ray films for minors until the patient turns 23.

Malpractice Considerations for Minor Records

The statute of limitations for medical malpractice does not begin to run against a minor until they reach the age of majority. Under Idaho Code 5-230, minors generally have a tolling period that extends the time they can file suit.

For this reason, most healthcare attorneys in Idaho recommend retaining all medical records for minor patients until at least 5 years after the patient reaches 18, or longer if the provider's malpractice insurer recommends it.

Federal Requirements That Apply in Idaho

Idaho healthcare providers are subject to both state and federal medical records retention requirements. When federal law requires a longer retention period than Idaho law, the longer period controls.

HIPAA Documentation Requirements

The HIPAA Privacy Rule does not require providers to keep patient medical records for any specific period. HIPAA defers to state law on medical records retention.

However, HIPAA does require covered entities to retain HIPAA-related administrative documentation for 6 years from the date of creation or last effective date. This includes:

• Privacy policies and procedures
• Privacy practices notices
• Complaint disposition records
• Training records
• Business associate agreements
• Risk assessments and audit logs

This 6-year HIPAA documentation requirement is separate from and in addition to any state medical records retention requirement.

CMS Conditions of Participation

Under 42 CFR 482.24, hospitals that participate in Medicare must retain medical records in their original or legally reproduced form for at least 5 years. This federal minimum applies to all hospitals in Idaho that accept Medicare patients.

The CMS requirement covers all medical records, not just specific record types like lab reports or X-rays. Records must be accurately written, promptly completed, properly filed, and accessible for the full retention period.

Medicare Provider Records

CMS requires that Medicare providers (including physicians, outpatient facilities, and home health agencies) retain records for a minimum of 7 years from the date of service. This applies to any provider that bills Medicare, regardless of whether Idaho state law requires a shorter period.

Patient Access to Medical Records

Idaho patients have the right to access their medical records under both state and federal law.

Idaho State Access Rights

Under IDAPA 16.03.14.220, patients at Idaho hospitals have the right to access information contained in their clinical records within 3 business days. This state regulation, effective since July 2019, is more protective than the federal HIPAA standard.

Key provisions of Idaho's hospital patient access rules include:

• Patients may request records in paper or electronic format
• When electronic format is requested, the hospital must provide records on a currently popular media storage device in a coherent format
• Hospitals may not charge patients a rate for copies that exceeds the rate charged by the local library
• No medical information may be released without the patient's written consent or official court order, except to legally authorized entities such as third-party payers, peer review organizations, and licensing agencies

HIPAA Right of Access

Under the HIPAA Privacy Rule, all covered entities (not just hospitals) must provide patients with access to their medical records within 30 days of a request. A single 30-day extension is permitted if the provider sends written notice to the patient explaining the delay.

The U.S. Department of Health and Human Services (HHS) has actively enforced this right through its HIPAA Right of Access Initiative, resulting in significant financial penalties against providers that failed to provide timely access to patient records.

Fees for Medical Record Copies

Under HIPAA, providers may charge a reasonable, cost-based fee for copies. HHS has established that providers may charge no more than $6.50 per patient for electronic copies of records maintained electronically. For paper copies or records not maintained electronically, providers may charge reasonable costs including labor, supplies, and postage.

Idaho's administrative rules provide additional fee protections for hospital patients, capping copy charges at the local library rate.

Records Destruction Requirements

When retention periods have been met, Idaho law permits destruction of medical records but imposes specific conditions on how that destruction must be carried out.

Idaho Destruction Rules

Under Idaho Code 39-1394, hospitals may destroy records that have met their retention period by:

• Burning
• Shredding
• Other effective methods consistent with the confidential nature of the records

The statute imposes two critical restrictions:

1. Ordinary course of business. Destruction must occur in the ordinary course of business. A hospital cannot selectively destroy individual patient records outside of its regular destruction schedule.

2. No individual destruction. No record may be destroyed on an individual basis. Records must be destroyed as part of a routine, systematic process that applies consistently across records of the same type and age.

HIPAA Destruction Standards

The HIPAA Privacy Rule requires that covered entities apply appropriate safeguards when disposing of protected health information (PHI). According to HHS guidance:

For paper records: Shredding, burning, pulping, or pulverizing are acceptable methods.

For electronic records: Clearing (overwriting with non-sensitive data), purging (degaussing), or physical destruction (disintegration, pulverization, melting, incineration, or shredding of media) are acceptable.

PHI must never be placed in dumpsters or other containers accessible to the public unless it has been rendered unreadable, indecipherable, and impossible to reconstruct.

When a Medical Practice Closes in Idaho

Idaho does not have a specific statute governing what happens to medical records when a physician practice closes. However, providers have both legal and ethical obligations to ensure continuity of access for patients.

Provider Obligations

When a physician practice closes in Idaho, the provider should:

• Notify patients in advance, providing at least 30 days' notice when possible
• Arrange for transfer of records to a successor physician or medical records custodian
• Ensure the custodian agrees to maintain records for the required retention period
• Make records available to patients upon request with a proper HIPAA authorization
• Maintain records in a secure location until they can be properly transferred or destroyed after the retention period expires

Records Custodian Requirements

If the practice is not being sold to another provider, the closing physician should designate a medical records custodian. The custodian must:

• Maintain the records for the full retention period required by law
• Keep records secure and confidential in compliance with HIPAA
• Respond to patient requests for access and copies
• Follow proper destruction procedures when the retention period expires

The Idaho Board of Medicine may provide guidance to physicians closing their practices, but there is no specific regulatory framework requiring a particular process.

Idaho Medical Records Retention Summary Table

Record Type	Minimum Retention Period	Governing Law
Hospital clinical lab records	5 years from date of test	Idaho Code 39-1394
Hospital X-ray films (adults)	5 years from date of exposure	Idaho Code 39-1394
Hospital X-ray films (minors)	5 years after patient turns 18	Idaho Code 39-1394
Hospital records (Medicare)	5 years minimum	42 CFR 482.24
Physician/outpatient records	No Idaho-specific statute; 7+ years recommended	Federal guidelines and AMA recommendation
Medicare provider records	7 years from date of service	CMS requirements
HIPAA administrative docs	6 years from creation or last effective date	45 CFR 164.530(j)
Idaho Medicaid provider records	5 years	Idaho Medicaid Provider Agreement

Frequently Asked Questions

How long do Idaho hospitals have to keep medical records?

Idaho hospitals must retain clinical laboratory records and X-ray films for at least 5 years under Idaho Code 39-1394. Hospitals that participate in Medicare must also comply with 42 CFR 482.24, which requires retention of all medical records for at least 5 years in their original or legally reproduced form. In practice, many Idaho hospitals retain records for 7 to 10 years to account for potential litigation and audits.

Does Idaho require doctors to keep medical records for a specific number of years?

No. Idaho does not have a specific statute requiring private physicians or physician groups to retain medical records for any set period. Idaho Code 39-1394 applies only to hospitals. Physicians should follow federal Medicare guidelines (7 years), their malpractice insurer's recommendations, and the AMA's general recommendation of 10 years from the last patient encounter.

How long must hospitals keep medical records for children in Idaho?

For X-ray films, Idaho Code 39-1394 requires hospitals to retain the films for 5 years after the date of exposure or 5 years after the patient reaches 18 years of age, whichever is later. For other types of medical records involving minors, the statute of limitations for medical malpractice may be tolled until the minor reaches adulthood, so healthcare attorneys generally recommend retaining all records for minors until at least age 23.

Can I get copies of my medical records from an Idaho hospital?

Yes. Under IDAPA 16.03.14.220, Idaho hospital patients have the right to access their clinical records within 3 business days of a request. You may request records in paper or electronic format. The hospital may not charge you more than the local library rate for copies. Under federal HIPAA law, all healthcare providers must provide access within 30 days and can charge no more than $6.50 for electronic copies of electronically maintained records.

What happens to my medical records if my doctor's office closes in Idaho?

Idaho does not have a specific law governing the disposition of medical records when a physician practice closes. However, the closing provider is expected to arrange for a successor physician or a medical records custodian to maintain the records for the required retention period. Patients should be notified before the closure so they can request copies or authorize transfer of their records. The Idaho Board of Medicine may provide guidance in specific situations.

Sources and References