North Carolina Medical Records Retention Laws (2026 Guide)

North Carolina has some of the most detailed medical records retention requirements in the country. The state regulates how long hospitals, nursing facilities, ambulatory surgical centers, and clinics must keep patient records. These rules are found primarily in the North Carolina Administrative Code (NCAC), enforced by the NC Division of Health Service Regulation.

If you are a healthcare provider, compliance officer, or patient trying to understand your rights, this guide breaks down every retention requirement that applies in North Carolina.

Hospital Medical Records Retention in North Carolina

The primary regulation governing hospital records in North Carolina is 10A NCAC 13B .3903, titled "Preservation of Medical Records." This rule falls under Subchapter B of the NC Medical Care Commission regulations, which covers hospital licensing.

Adult Patient Records

Hospitals must maintain medical records for a minimum of 11 years following the discharge of an adult patient. This applies whether records are stored in their original paper form, on computer media, or in digital archives.

The 11-year requirement is notably longer than many other states. For comparison, the federal Medicare Conditions of Participation under 42 CFR 482.24 require hospitals to retain records in accordance with their state law but do not impose a specific federal minimum for general patient records.

Minor Patient Records

North Carolina requires hospitals to retain records of minor patients until the patient's 30th birthday. This is the longest minor patient retention requirement in the United States.

The reason for this extended period ties directly to North Carolina's statute of limitations framework. Under N.C. Gen. Stat. 1-17, medical malpractice actions involving minors are tolled. A minor has until age 19 to file certain claims. The retention period through age 30 provides a substantial buffer beyond the statute of limitations to account for discovery rules, delayed injury recognition, and litigation timelines.

For a patient treated at a hospital as a newborn, this means records could be retained for up to 30 years.

What Records Are Covered

The regulation applies to the complete medical record as maintained by the hospital's medical records service. This includes:

• Admission and discharge documentation
• Physician and nursing notes
• Laboratory and diagnostic test results
• Surgical and procedure reports
• Medication administration records
• Consent forms
• Patient identification information

The manager of the medical records service is responsible for ensuring compliance with these retention periods.

Physician and Private Practice Records

North Carolina does not have a specific statute that sets a mandatory retention period for physician office or private practice records. This is a notable gap compared to the detailed hospital and facility regulations.

However, the North Carolina Medical Board has issued a position statement on medical records that provides guidance. The Board states that "patient interests related to present and future healthcare needs should be a licensee's primary consideration" when deciding how long to retain records.

The Board recommends that physicians:

• Notify patients about how long records will be retained
• Give patients an opportunity to claim records or have them transferred before destruction
• Destroy records in a HIPAA-compliant manner
• Respond promptly to patient requests for access or copies

Most healthcare attorneys in North Carolina advise private practices to follow the hospital standard of 11 years for adults and until age 30 for minors. This conservative approach reduces legal exposure, particularly given the state's malpractice statute of limitations.

Nursing Facility Records

Nursing homes and skilled nursing facilities in North Carolina follow a separate regulation: 10A NCAC 13D .2402, "Preservation of Medical Records."

Retention Periods for Nursing Facilities

Patient Type	Retention Period	Authority
Adult patients	5 years after discharge	10A NCAC 13D .2402
Minor patients	Until age 19, plus additional time under G.S. 1-17(b)	10A NCAC 13D .2402

The 5-year period for nursing facility adult records is significantly shorter than the 11-year hospital requirement. This reflects the different risk profiles and typical patient populations of these facilities.

For minors in nursing facilities, the records must be kept until the patient's 19th birthday, with additional time as specified under the statute of limitations for malpractice claims involving minors.

Facility Closure Rules for Nursing Homes

When a nursing facility discontinues operation, the licensee must inform the NC Division of Health Service Regulation where records are stored. Records must be placed with a business offering medical record storage and retrieval services for at least 5 years after the closure date.

Ambulatory Surgical Centers and Clinics

Ambulatory surgical facilities in North Carolina are regulated under 10A NCAC 13C, specifically Section .1002 for individual patient records.

Licensed clinics that are not hospitals follow rules under 10A NCAC 13S .0321, which requires:

• Medical records preserved for not less than 10 years from the date of most recent discharge
• Records for minor patients retained until 3 years after the patient turns 18 (age 21)
• A written plan for records destruction that ensures confidentiality
• Arrangements for record preservation if the clinic ceases operation

These clinic requirements fall between the hospital standard (11 years) and the nursing facility standard (5 years).

Federal Requirements That Apply in North Carolina

North Carolina providers must comply with both state and federal records retention rules. Where federal law requires a longer retention period than state law, the longer period applies.

HIPAA Requirements

The HIPAA Privacy Rule does not establish a specific retention period for medical records themselves. The U.S. Department of Health and Human Services has stated clearly that "the Privacy Rule does not include medical record retention requirements" and that "state laws generally govern how long medical records are to be retained."

However, HIPAA does impose a 6-year retention requirement for compliance documentation under 45 CFR 164.530(j). Covered entities must retain their privacy policies, procedures, notices of privacy practices, disposition of complaints, and other compliance actions for 6 years from the date of creation or the date when the document was last in effect, whichever is later.

This means that while HIPAA does not tell you how long to keep a patient's chart, it does require you to keep proof of your compliance activities for at least 6 years.

CMS and Medicare Requirements

Providers participating in Medicare must meet the Conditions of Participation under 42 CFR Part 482. For medical records, 42 CFR 482.24 requires hospitals to maintain records but defers to state law for the specific retention period.

Additional federal retention periods include:

Program	Retention Period	Authority
Medicare Part A/B providers	7 years from date of service	42 CFR 424.516(f)
Medicare Advantage (Part C)	10 years	42 CFR 422.504(d)
Medicare Part D (prescription)	10 years	42 CFR 423.505
HIPAA compliance documents	6 years	45 CFR 164.530(j)

For a North Carolina hospital that participates in Medicare, the state's 11-year requirement already exceeds the 7-year Medicare minimum. However, hospitals with Medicare Advantage contracts should be aware of the 10-year requirement under Part C.

Patient Access to Medical Records in North Carolina

Patients in North Carolina have a right to access their medical records under both state and federal law.

State Law on Patient Access

Under N.C. Gen. Stat. 90-411, healthcare providers may charge fees for copying medical records in connection with personal injury liability claims and Social Security disability claims:

• First 25 pages: Up to $0.75 per page
• Pages 26 through 100: Up to $0.50 per page
• Pages over 100: Up to $0.25 per page
• Minimum fee: Up to $10.00 (inclusive of copying costs)

These statutory fee caps apply specifically to records requested for legal and disability claims. For general patient requests, HIPAA's fee limitations also apply.

HIPAA Right of Access

Under the HIPAA Privacy Rule at 45 CFR 164.524, patients have a right to access their protected health information maintained in a designated record set. Providers must respond to access requests within 30 days (with one 30-day extension allowed). Under HIPAA, covered entities may only charge a reasonable, cost-based fee for copies.

Hospitals participating in Medicare must also comply with the CMS Conditions of Participation, which state that patients have a right to access their current medical records in the form and format requested, within a reasonable time frame.

Records Ownership in North Carolina

Under 10A NCAC 13B .3903, medical records are the property of the hospital. They remain the property of the hospital except through a court order. This means that while patients have a right to access and obtain copies, the original records belong to the facility.

This ownership principle applies to hospital records specifically. For physician practices, the general legal principle in North Carolina is similar: the provider owns the physical record, but the patient has a right to the information contained within it.

Hospital Closure and Records Preservation

North Carolina has specific requirements for what happens to medical records when a hospital closes. Under 10A NCAC 13B .3903:

Required Steps When a Hospital Closes

1. Notify the Division: The hospital's management must inform the NC Division of Health Service Regulation where records will be stored.

2. Arrange retrieval services: Records must be placed with a business offering medical record storage and retrieval services for at least 11 years after the closure date.

3. Maintain minor records: Records of minor patients must still be retained until the patient's 30th birthday, even after closure.

4. Public notice before destruction: The hospital must provide public notice before destroying any records, giving former patients or their representatives an opportunity to claim their records.

5. Maintain confidentiality: All records must be stored securely with appropriate safeguards throughout the storage period.

These closure requirements protect patients who may need their records for ongoing care, insurance purposes, or legal matters long after a facility has shut down.

What Happens in Practice

When hospitals close in North Carolina, they typically contract with a medical records storage and retrieval company. These companies maintain the records, respond to authorized requests for copies, and ensure HIPAA-compliant security. The NC Division of Health Service Regulation maintains information about where closed facility records are stored.

If you need records from a closed North Carolina hospital, contact the Division of Health Service Regulation at the NC Department of Health and Human Services for assistance locating your records.

Proper Destruction of Medical Records

When medical records have met their retention period in North Carolina, they may be destroyed. However, destruction must follow specific protocols to protect patient privacy.

HIPAA Destruction Standards

The HHS Office for Civil Rights requires that covered entities implement reasonable safeguards when disposing of protected health information. Acceptable methods for paper records include:

• Shredding
• Burning
• Pulping
• Pulverizing

For electronic records, acceptable methods include:

• Clearing (overwriting data on media)
• Purging (degaussing or using cryptographic erase)
• Physical destruction of the storage media

Records may never be placed in dumpsters, recycling bins, or other receptacles accessible to unauthorized persons.

North Carolina Requirements

The NC Medical Care Commission regulations require that before original paper records are destroyed, the medical records department must review any digital copies for completeness. Facilities should maintain a log of destroyed records and report destruction activities to their governing board on an annual basis.

Digital Archiving and Electronic Records

North Carolina regulations permit digital archiving of medical records. Under 10A NCAC 13B .3903, the manager of medical records may authorize digital archiving on-site or off-site, provided that:

• The facility ensures confidentiality and safekeeping of records
• Original records are not destroyed until the medical records department reviews digital copies for completeness
• Digital records are maintained for the same retention periods as original records
• Access controls comply with both state law and HIPAA

Only personnel authorized under state law and HIPAA regulations may access records, whether in paper or electronic form. Patient authorizations for record release must be maintained in the original record as authority for the disclosure.

Statute of Limitations Connection

Understanding why North Carolina sets these retention periods requires looking at the state's statute of limitations for medical malpractice.

Under N.C. Gen. Stat. 1-15(c) and N.C. Gen. Stat. 90-21.11:

• Medical malpractice actions must be commenced within 3 years from the last act giving rise to the cause of action
• No action may be brought more than 4 years from the last act, regardless of discovery
• For foreign objects left in the body, the limit extends to 1 year after discovery but no more than 10 years from the last act

For minors, under N.C. Gen. Stat. 1-17, the statute of limitations is tolled. If the normal limitation period expires before the minor turns 19, the action may still be brought until the minor reaches age 19.

The 11-year hospital retention period and the age-30 minor retention period both provide comfortable margins beyond these limitation periods. Records remain available not just for the duration of potential legal exposure but for years afterward.

Summary of North Carolina Medical Records Retention Periods

Facility Type	Adult Records	Minor Records	Authority
Hospitals	11 years after discharge	Until age 30	10A NCAC 13B .3903
Nursing facilities	5 years after discharge	Until age 19 (plus G.S. 1-17 extension)	10A NCAC 13D .2402
Licensed clinics	10 years after discharge	Until age 21	10A NCAC 13S .0321
Private physicians	No specific statute (11 years recommended)	No specific statute (age 30 recommended)	NC Medical Board guidance
Medicare Part A/B	7 years from date of service	Same	42 CFR 424.516(f)
Medicare Advantage	10 years	Same	42 CFR 422.504(d)