Massachusetts Medical Records Retention Laws (2026 Guide)

Massachusetts has some of the most protective medical records retention laws in the United States. Hospitals in the Commonwealth must preserve patient records for a full 20 years after discharge or final treatment. This is the longest hospital retention requirement of any state.

Physician offices follow a separate standard, retaining records for a minimum of 7 years. Together, these state rules work alongside federal requirements under HIPAA and CMS to create a layered system of protections for patient health information.

This guide covers the specific retention periods, destruction procedures, patient access rights, and practice closure obligations that apply in Massachusetts.

Hospital Records: 20-Year Retention Requirement

Under Massachusetts General Laws Chapter 111, Section 70, every hospital or clinic licensed by the Massachusetts Department of Public Health (DPH) must maintain medical records for each patient treated. These records must include the medical history and nurses' notes for every case under the facility's care.

Hospital medical records may not be destroyed until 20 years after the discharge or final treatment of the patient. This applies to all records, including inpatient and outpatient treatment documentation.

The 20-year period is measured from the date the patient was last discharged from the facility or received their final treatment. If a patient returns for additional treatment, the clock resets.

What Hospital Records Must Include

Under 105 CMR 130.370, hospitals must retain complete records of diagnosis and treatment. Records may be maintained in handwritten, printed, typed, or electronic digital format.

Certain materials do not need to be retained as part of the full medical record, including radiological films, scans, and other image records. However, signed narrative reports, interpretations, and sample tracings summarizing those tests must be kept for at least 5 years.

Mental Health Facility Records

Mental health care facilities in Massachusetts that provide mental health care and treatment must also maintain patient records for at least 20 years after the closing of the record due to discharge, death, or the last date of service. This is governed by M.G.L. Chapter 123, Section 36.

Physician Records: 7-Year Retention Requirement

Physicians practicing in Massachusetts must follow the retention rules established by the Board of Registration in Medicine under 243 CMR 2.07 and M.G.L. Chapter 112, Section 12CC.

Adult patient records must be maintained for a minimum of 7 years from the date of the last patient encounter. This applies to all licensed physicians, including those in private practice, group practices, and outpatient settings.

A retiring physician or their successor must also maintain patient records for 7 years from the date of the final patient visit. The obligation follows the records, not the physician's active license status.

Comparison: Hospitals vs. Physicians

Provider Type	Retention Period	Governing Law
Hospitals and licensed clinics	20 years after discharge or final treatment	M.G.L. ch. 111, Sec. 70
Physicians (private practice)	7 years from last patient encounter	243 CMR 2.07
Mental health facilities	20 years after discharge, death, or last service	M.G.L. ch. 123, Sec. 36
Licensed clinics	20 years (same as hospitals)	M.G.L. ch. 111, Sec. 70

Records for Minors

Massachusetts has specific protections for the medical records of minor patients.

For physicians, if a patient is a minor on the date of the last visit, the physician must retain that patient's records for the longer of:

• 7 years from the date of the last patient encounter, or
• Until the patient reaches the age of 18

For example, if a physician last treats a 10-year-old patient, the records must be kept until the patient turns 18 (8 years), because that is longer than the standard 7-year period. If a physician last treats a 16-year-old, the records must be kept for 7 years (until age 23), because 7 years exceeds the time until the patient reaches 18.

Hospital records for minors follow the same 20-year rule that applies to all patients. Because the 20-year hospital retention period is already longer than either the 7-year physician period or the age-of-majority extension, hospital records of minors will always be retained for the full 20 years.

Federal Requirements That Also Apply

Massachusetts providers must comply with both state and federal record retention rules. When the federal and state requirements differ, the stricter rule always applies.

HIPAA Documentation Retention

HIPAA does not require providers to keep patient medical records for any specific period. This is a common misconception.

What HIPAA does require is that covered entities retain HIPAA-related administrative documentation for 6 years from the date of creation or the date when it last was in effect, whichever is later. This includes privacy policies, procedures, training records, business associate agreements, and complaint records, as specified in 45 CFR 164.530(j).

The 6-year HIPAA requirement applies to compliance paperwork only. Patient record retention is governed by state law.

CMS Conditions of Participation

Hospitals participating in Medicare or Medicaid must retain medical records for at least 5 years after discharge under 42 CFR 482.24. General Medicare providers must keep records for at least 7 years from the date of service.

Since Massachusetts already requires hospitals to retain records for 20 years and physicians for 7 years, the state requirements exceed the federal CMS minimums in every case. Massachusetts providers who follow the state rules will automatically satisfy CMS requirements.

Patient Access to Medical Records

Massachusetts law provides strong patient access rights to medical records. Under M.G.L. Chapter 111, Section 70E and M.G.L. Chapter 112, Section 12CC, patients have the right to inspect their medical records and receive copies.

Who Can Request Records

The following individuals may request access to medical records in Massachusetts:

• The patient
• A parent or legal guardian of a minor patient
• An authorized representative of the patient
• An executor or administrator of a deceased patient's estate
• An attorney authorized in writing by the patient

Response Timeline

Under HIPAA, providers must respond to a records request within 30 calendar days. If records are not maintained or accessible on-site, the provider has 60 days. A provider may extend the deadline once by an additional 30 days with written notice explaining the delay and providing a date by which the records will be produced.

For records requested to support a claim or appeal under the Social Security Act or any federal or state financial needs-based benefit program, Massachusetts law requires providers to furnish the records within 30 days of the request.

For physicians not covered by HIPAA, the Massachusetts Board of Registration in Medicine has interpreted "timely manner" as two to three weeks.

Psychotherapy Records

Psychotherapists in Massachusetts may provide either the complete record or a summary at their discretion. If a psychotherapist determines that full disclosure could adversely affect the patient's wellbeing, they may restrict access. However, the patient can request that the full record be shared with their attorney or another designated psychotherapist.

Copy Fees in Massachusetts

Massachusetts has a detailed fee structure for medical record copies, with different rules depending on whether the provider is covered by HIPAA.

HIPAA-Covered Providers

Providers covered by HIPAA may charge only a reasonable, cost-based fee. This fee may include:

• The cost of labor for copying (creating and delivering the copy)
• Supplies for creating the copy
• Postage, if the records are mailed

The fee may not include the cost of searching for, retrieving, or compiling the records.

For electronic copies of records maintained electronically, providers may charge a flat fee of $6.50 or less, inclusive of all labor, supplies, and postage.

Non-HIPAA Providers

Physicians not covered by HIPAA may charge fees set by M.G.L. Chapter 111, Section 70:

• Base fee: Up to $15.00 per request
• Per-page charge: Up to $0.50 per page for the first 100 pages
• Over 100 pages: Up to $0.25 per page

These amounts may be adjusted to reflect the Consumer Price Index for medical care services. The base amount and per-page charge are increased by the proportional CPI in effect as of October of the calendar year in which the request is made, rounded to the nearest dollar.

Fee Exemptions

No fee may be charged when records are requested to support a claim or appeal under any provision of the Social Security Act or any federal or state financial needs-based benefit program. The person requesting records must present reasonable documentation at the time of the request showing that the purpose qualifies for the exemption.

Providers may not withhold medical records from a patient because of unpaid medical bills. However, providers may require payment of copying costs before releasing the copies.

Destruction of Medical Records

Massachusetts has strict requirements governing how and when medical records may be destroyed.

Notification to the Department of Public Health

Before a hospital or clinic may destroy medical records that have exceeded the 20-year retention period, the facility must provide written notification to the Massachusetts Department of Public Health at least 30 days before the proposed destruction date.

This notification must generally indicate:

• The type of records to be destroyed
• The dates of service that exceed the applicable retention period
• The proposed date of destruction

The notification must follow the manner specified by the Department, as outlined in Circular Letter DHCQ 09-07-515.

Hospitals are not required to notify individual patients before destroying records, though they may choose to do so voluntarily.

Confidentiality During Destruction

The manner of destruction must ensure the confidentiality of patient information under 105 CMR 130.370. Under HIPAA, records must be rendered essentially unreadable, indecipherable, and unable to be reconstructed.

Accepted methods include:

• Paper records: Shredding, burning, or pulverizing
• Electronic records: Clearing (overwriting), purging or degaussing, or physical destruction of storage media

Records may never be placed in dumpsters, recycling bins, or other publicly accessible containers.

Patient Privacy Notices

Hospitals must include information about their records termination policy in the privacy notice provided to patients. This notice must inform patients of their right to inspect and receive a copy of their medical records.

Practice Closure and Transfer of Ownership

Massachusetts has specific rules addressing what happens to medical records when a practice closes or changes hands.

When a Hospital Changes Ownership

Under M.G.L. Chapter 111, Section 70, when ownership of a hospital, institution, or clinic transfers to a new owner, all medical records must be maintained by the new owner as if there were no change in ownership. The full 20-year retention obligation carries over to the new entity.

When a Hospital Permanently Closes

If a hospital or clinic permanently closes, it must arrange for the preservation of all medical records for the time period required by law. The facility cannot simply destroy records upon closure.

When a Physician Retires or Closes a Practice

A retiring physician or their successor must maintain patient records for the full 7-year retention period from the date of the last patient encounter. The Board of Registration in Medicine expects physicians to:

• Notify patients about the practice closure
• Offer patients the opportunity to transfer their records to another provider
• Offer patients the opportunity to receive a personal copy of their records
• Arrange for a custodian to maintain any records that have not yet reached the end of the retention period

Patients are entitled to a copy of their complete records, including records that were transferred from previous physicians.

Records of Deceased Patients

Medical records for deceased patients must still be retained for the full applicable retention period. Hospital records must be kept for 20 years after the last treatment or discharge, and physician records must be kept for 7 years after the last encounter, regardless of the patient's death.

How Massachusetts Compares to Other States

Massachusetts stands out nationally for the length of its hospital retention requirement.

State	Hospital Retention	Physician Retention
Massachusetts	20 years	7 years
North Carolina	11 years	Not specified
Oregon	10 years	10 years
Illinois	10 years	10 years
New Jersey	10 years	7 years
California	7 years	7 years
Florida	5 years	5 years
Wyoming	3 years	Not specified

No other state requires hospitals to retain records for as long as Massachusetts does. The closest is North Carolina at 11 years, nearly half the Massachusetts requirement.

Key Statutes and Regulations

The following laws and regulations govern medical records retention in Massachusetts:

• M.G.L. Chapter 111, Section 70: Hospital and clinic records retention (20 years), destruction procedures, transfer of ownership
• M.G.L. Chapter 111, Section 70E: Patient rights, including the right to inspect and copy medical records
• M.G.L. Chapter 112, Section 12CC: Patient access rights, copy fee structure, benefit claim exemptions
• M.G.L. Chapter 123, Section 36: Mental health facility records retention
• 243 CMR 2.07: Board of Registration in Medicine physician records requirements (7 years)
• 105 CMR 130.370: Hospital licensure medical records retention and destruction procedures
• Circular Letter DHCQ 09-07-515: DPH notification procedures for record destruction