North Dakota Medical Records Retention Laws (2026 Guide)

North Dakota has specific rules governing how long hospitals, physicians, and other healthcare providers must keep patient [medical records. The primary state regulation is North Dakota Administrative Code (NDAC) Section 33-07-01.1-20, which establishes minimum retention](/medical-records-retention-laws-by-state) periods for hospital records. Federal regulations from HIPAA and CMS add additional layers that all North Dakota providers must follow.

This guide breaks down every requirement so patients, healthcare providers, and administrators can understand their obligations and rights under North Dakota law.

Hospital Medical Records Retention Requirements

North Dakota's hospital records retention rules are found in NDAC 33-07-01.1-20, which governs medical records services for licensed hospitals including general acute, primary care, and specialized facilities.

The 10-Year Retention Rule

Hospitals must preserve patient medical records for at least 10 years from the date the patient was last treated at the facility. Records may be kept in their original form or preserved through any accepted method, including microfilm, digital scanning, or electronic health record (EHR) systems.

This 10-year clock resets each time a patient receives treatment. If a patient was last seen in 2020, the hospital must retain that patient's complete medical record until at least 2030.

Records for Minor Patients

North Dakota provides extended protections for the medical records of minors. Under NDAC 33-07-01.1-20, if a patient was under 18 years of age at the time of their last treatment, the hospital must retain the record until the later of these two dates:

• The patient's 21st birthday
• 10 years from the date of the patient's last treatment

For example, if a child was last treated at age 5, the hospital must keep that record until the child turns 21 (16 years later). If a 16-year-old was last treated in 2024, the 10-year period (2034) extends beyond the 21st birthday (2029), so the record must be kept until 2034.

This extended retention period ensures that young adults can access their childhood medical history when they reach the age of majority.

Litigation Hold Requirements

Hospitals may not destroy any medical record that relates to a matter involved in active litigation, regardless of how much time has passed. If a hospital is aware that a lawsuit, claim, or legal proceeding involves a particular patient's records, those records must be preserved until the litigation is fully resolved.

This applies even if the standard 10-year retention period has expired. The litigation hold takes priority over all other timelines.

Records With Ongoing Research or Legal Value

The hospital's governing body has a responsibility to identify records that hold research, legal, or medical value beyond the standard retention period. These records must be preserved until the governing body determines they no longer serve that purpose.

This provision recognizes that some records contribute to long-term medical research, public health studies, or ongoing legal matters that extend well beyond 10 years.

Physician and Private Practice Requirements

North Dakota does not have a separate state statute that sets a specific retention period for physician offices, clinics, or private medical practices. The NDAC 33-07-01.1-20 rule applies specifically to licensed hospitals.

However, private practice physicians in North Dakota are not free to discard records whenever they choose. Several factors establish practical minimum retention periods for physician practices.

Best Practice Standards

The American Medical Association (AMA) recommends that physicians retain medical records for at least 10 years from the date of last treatment. Many North Dakota physicians follow this guidance even though it is not codified in state law for private practices.

The North Dakota Board of Medicine does not publish a specific retention period requirement for physician practices. However, the Board expects physicians to maintain adequate records to support continuity of care and to meet professional standards.

Malpractice Statute of Limitations

North Dakota's medical malpractice statute of limitations is an important consideration. Under NDCC 28-01-18, the general statute of limitations for medical malpractice actions is two years from the date the patient knew or should have known of the injury. For minors, this period may be tolled until the child reaches the age of majority.

Because malpractice claims can arise years after treatment, many legal experts recommend that physicians in North Dakota retain records for at least 10 years, and longer for pediatric patients.

Federal Requirements That Apply in North Dakota

North Dakota healthcare providers must also comply with federal medical records requirements. These regulations create a baseline that applies in addition to state rules.

HIPAA and Medical Records Retention

Contrary to common belief, the HIPAA Privacy Rule does not establish a specific retention period for medical records. According to the U.S. Department of Health and Human Services (HHS), HIPAA defers to state laws on how long medical records must be kept.

What HIPAA does require is that covered entities maintain their privacy policies, privacy practices notices, and related compliance documentation for six years from the date of creation or the date they were last in effect, whichever is later.

HIPAA also requires that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for the entire period that the records are maintained. This means that whether a hospital keeps records for 10 years or 30 years, HIPAA protections apply for the full duration.

CMS Conditions of Participation

The Centers for Medicare and Medicaid Services (CMS) sets its own retention requirements for hospitals and providers that participate in Medicare and Medicaid programs.

Under 42 CFR 482.24, hospitals participating in Medicare must retain medical records in their original or legally reproduced form for a period of at least five years. This is shorter than North Dakota's 10-year state requirement, so the state rule controls in practice.

For Medicare Managed Care organizations, the retention period increases to 10 years under 42 CFR 422.504. Medicare Accountable Care Organizations (ACOs) must also retain records for 10 years under 42 CFR 425.314.

In North Dakota, hospitals that accept Medicare patients must meet both the CMS five-year minimum and the state's 10-year requirement. Because the state period is longer, North Dakota hospitals effectively operate under a 10-year minimum.

Patient Access to Medical Records

North Dakota law provides patients with the right to access and obtain copies of their medical records.

Right to Copies Under State Law

Under NDCC 23-12-14, patients and their authorized representatives may request copies of their medical records. Healthcare providers must furnish these copies, subject to the following fee schedule:

Paper or Fax Copies:

• First 25 pages: Up to $20.00 total
• Each additional page beyond 25: Up to $0.75 per page

Electronic, Digital, or Computerized Format:

• First 25 pages: Up to $30.00 total
• Each additional page beyond 25: Up to $0.25 per page

These fees include any administration fee, retrieval fee, and postage expense. Providers cannot charge additional fees beyond these amounts.

HIPAA Right of Access

Under the HIPAA Privacy Rule, patients have a federal right to inspect, review, and receive a copy of their medical records and billing records held by covered entities. Providers must respond to access requests within 30 days (with a possible 30-day extension if necessary).

HIPAA requires that copies be provided in the format requested by the patient when it is readily producible. If the patient requests an electronic copy and the provider maintains electronic records, the provider must supply an electronic copy.

The fee for copies under HIPAA must be limited to the cost of labor for copying, supplies, and postage. HHS has also established a flat fee option of $6.50 per request as a safe harbor that providers may use instead of calculating actual costs.

Consent for Release

Under NDAC 33-07-01.1-20, written consent of the patient must be presented as authority for the release of medical information from hospital records. Medical records may not leave hospital premises except by court order or subpoena.

Exceptions exist for authorized healthcare personnel who need access for treatment, payment, or healthcare operations purposes as defined under HIPAA.

Medical Records Destruction Requirements

When the retention period has passed, North Dakota providers must still follow proper procedures before destroying medical records.

Hospital Closure and Records

NDAC 33-07-01.1-20 contains specific requirements for hospitals that close or discontinue operations:

1. Notify the State: The hospital must inform the North Dakota Department of Health and Human Services where its records will be stored
2. Store for 10 Years: Records must be placed in a facility that offers retrieval services for at least 10 years after the closure date
3. Public Notice Before Destruction: Before destroying records, the former hospital must provide public notice in at least two forms, including a legal notice and a display advertisement in a newspaper of general circulation in the area the hospital formerly served
4. Allow Patients to Claim Records: Former patients or their authorized representatives must be given the opportunity to claim their own records before destruction occurs

HIPAA-Compliant Destruction Methods

When the time comes to destroy medical records, all North Dakota providers must follow HIPAA disposal requirements to protect patient privacy. Acceptable destruction methods include:

Paper Records:

• Cross-cut shredding
• Burning or incineration
• Pulping or pulverizing

Electronic Records:

• Clearing (overwriting data on the media)
• Purging (degaussing or using a strong magnetic field)
• Physical destruction of media through pulverization, melting, or incineration

The key standard is that protected health information must be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed." Providers may not simply delete electronic files or place paper records in standard trash receptacles or recycling bins accessible to the public.

If using a third-party shredding or destruction service, the provider should obtain a Business Associate Agreement (BAA) and request a certificate of destruction as documentation.

Special Considerations

North Dakota Health Information Network (NDHIN)

North Dakota operates the North Dakota Health Information Network (NDHIN), a statewide health information exchange. The NDHIN allows authorized healthcare providers to electronically access patient health information across facilities.

The NDHIN operates under both HIPAA and state privacy requirements outlined in NDCC 23-12-19. Appropriate safeguards must be used to prevent unauthorized use or disclosure of protected health information transmitted through the network.

Substance Use Disorder Records

Medical records related to substance use disorder treatment receive additional federal protections under 42 CFR Part 2. These records cannot be used or disclosed without the patient's written authorization except in limited circumstances defined by federal law.

A final rule issued in 2024 updated 42 CFR Part 2 to better align it with HIPAA, with full compliance required by February 16, 2026. North Dakota providers who handle substance use disorder records must follow both the updated Part 2 regulations and standard HIPAA requirements.

Record Authentication Standards

NDAC 33-07-01.1-20 requires that all entries in a hospital medical record be authenticated by the individual who made them. Telephone and verbal orders must be reduced to writing, dated, timed, and signed within 48 hours unless the hospital has established read-back verification procedures.

Electronic signatures are permitted when a hospital adopts a policy that includes unique identifiers, confidentiality safeguards, and periodic monitoring of the electronic signature system.

Record Completion Timelines

For hospitals, the regulation requires that:

• A patient's history and physical examination must be completed within 24 hours following admission
• All medical reports must be completed within a period consistent with current medical practice and no longer than 30 days following discharge

Summary of North Dakota Retention Periods

Provider Type	Retention Period	Authority
Hospitals (general)	10 years from last treatment	NDAC 33-07-01.1-20
Hospitals (minor patients)	Age 21 or 10 years, whichever is later	NDAC 33-07-01.1-20
Hospitals (Medicare)	10 years (state) or 5 years (CMS), state is longer	NDAC 33-07-01.1-20 / 42 CFR 482.24
Closed hospitals	10 years after closure date	NDAC 33-07-01.1-20
Physician practices	No specific state law; 10 years recommended	AMA guidelines
Medicare Managed Care	10 years	42 CFR 422.504
HIPAA compliance docs	6 years	45 CFR 164.530(j)

Frequently Asked Questions

Sources and References