Oklahoma Medical Records Retention Laws (2026 Guide)

Last verified: March 2026. This page reflects current Oklahoma Administrative Code Title 310, Chapter 667, and Oklahoma Statutes Title 76.

Overview of Oklahoma Medical Records Retention Laws

Oklahoma requires hospitals and healthcare facilities to retain patient medical records for a minimum period established by the Oklahoma Administrative Code. The primary regulation governing hospital records retention is OAC 310:667-19-14, which falls under the Hospital Standards chapter of Title 310.

This regulation applies to all hospitals licensed by the Oklahoma State Department of Health, including general hospitals, critical access hospitals, and emergency hospitals. Physicians in private practice, nursing facilities, and other healthcare providers may also be subject to additional retention requirements depending on their participation in federal programs.

Understanding these retention timelines is essential for both healthcare providers and patients. Providers need to maintain compliance with state and federal regulations. Patients need to know how long their records will be available when they need them for ongoing care, legal matters, or insurance claims.

Hospital Medical Records Retention

General Hospitals

Under OAC 310:667-19-14, Oklahoma hospitals must retain medical records for a minimum of 5 years beyond the date the patient was last seen. If a patient has died, the hospital must keep the records for at least 3 years beyond the date of the patient's death.

These timelines represent minimum requirements. Hospitals may choose to keep records for longer periods based on their own policies, insurance requirements, or legal counsel recommendations.

Critical Access Hospitals

Critical access hospitals in Oklahoma follow the same retention timelines as general hospitals. Under OAC 310:667-39-11, medical records at critical access hospitals must be retained at least 5 years after the date the patient was last seen or at least 3 years after the date of the patient's death.

Critical access hospitals must also maintain a medical record for every patient evaluated or treated in the facility. These records must be appropriate to the scope and complexity of services performed and must allow prompt completion, filing, and retrieval.

Emergency Hospitals

Emergency hospitals in Oklahoma are governed by OAC 310:667-40-11, which establishes the same minimum retention period. Records must be kept for at least 5 years after the patient's last visit or 3 years after the patient's death.

Physician and Private Practice Retention

Oklahoma does not have a separate statute that sets a specific medical records retention period for physicians in private practice outside of the hospital setting. However, several rules apply in practice.

The Oklahoma State Board of Medical Licensure and Supervision expects physicians to maintain adequate medical records as part of their professional responsibilities. Physicians who fail to maintain proper records may face disciplinary action.

As a practical matter, most Oklahoma physicians follow the same 5-year minimum that applies to hospitals. Many choose to retain records for 7 to 10 years as a safeguard against potential malpractice claims, since Oklahoma's statute of limitations for medical negligence allows lawsuits to be filed within 2 years of discovering the injury.

Physicians participating in Oklahoma Medicaid must retain records for 6 years under OAC 317:30-3-15. This applies to any records necessary to disclose the extent of services furnished to recipients.

Minor Records Retention in Oklahoma

Oklahoma law provides extended protection for the medical records of minors. Under OAC 310:667-19-14, records of newborns or minors must be retained for 3 years past the age of majority.

The age of majority in Oklahoma is 18 years old, as defined in Oklahoma Statutes Title 15, Section 13. This means hospitals and healthcare facilities must keep a minor's medical records until the patient reaches age 21 at a minimum.

In practice, the calculation works as follows:

• A child born today would have records retained until at least age 21
• A 10-year-old patient's records would be retained until at least age 21
• A 16-year-old patient's records would be retained until at least age 21

If a minor patient has not been seen for more than 5 years after turning 18, both the minor retention rule (age 21) and the standard 5-year rule would need to be evaluated. The facility must retain records until the later of the two deadlines.

For newborns, this extended retention is particularly important because birth records, neonatal care documentation, and early childhood medical information may be needed decades later for medical, legal, or insurance purposes.

Federal Requirements That Affect Oklahoma Providers

HIPAA Documentation Retention

A common misconception is that HIPAA sets a federal retention period for patient medical records. It does not. HIPAA does not tell providers how long to keep patient charts or clinical records.

What HIPAA does require is that covered entities retain their compliance documentation for a minimum of 6 years. Under 45 CFR 164.316(b)(2)(i), this includes:

• Privacy and security policies and procedures
• Business Associate Agreements
• Risk assessments and risk management plans
• Breach notification records
• Employee training records
• Security incident logs
• Notices of Privacy Practices and patient acknowledgments

This 6-year rule applies to the documents that prove a provider followed HIPAA rules. It does not apply to the actual patient medical records.

CMS and Medicare Requirements

Providers who participate in Medicare have additional federal retention obligations. Under CMS Conditions of Participation (42 CFR 482.24), hospitals must maintain medical records in accordance with accepted professional practices.

Key CMS retention rules include:

• Standard Medicare providers: Records related to program reimbursement must be kept for at least 5 years after the closure of the cost report
• Medicare Advantage providers: Records must be retained for 10 years from the date of service
• Oklahoma Medicaid providers: Records must be retained for 6 years under OAC 317:30-3-15

Because federal requirements can exceed Oklahoma's 5-year state minimum, providers who accept Medicare or Medicaid should follow the longer federal timeline.

Patient Access to Medical Records in Oklahoma

Oklahoma law gives patients a clear right to access their own medical records. Under Oklahoma Statutes Title 76, Section 19, any person who is or has been a patient of a doctor, hospital, or other medical institution is entitled to obtain access to the information contained in their medical records.

This right extends to:

• All information in the patient's medical record
• X-rays and other photographs or images
• Pathology slides
• Medical bills associated with care

Fees for Records Copies

Oklahoma law sets specific limits on what providers can charge for medical records copies:

• Patient requests: $0.50 per page
• Attorney, insurance company, or subpoena requests: $20.00 base fee plus $0.50 per page, plus postage or delivery fees

Records of Deceased Patients

Access to a deceased patient's records requires either a court order or a written release from an executor, administrator, personal representative, or surviving spouse. If none of those exist, a responsible family member (parent, adult child, adult sibling, or other adult relative who was actively involved in the patient's care) may authorize the release.

Mental Health Records Exception

Oklahoma law carves out an exception for psychological, psychiatric, mental health, and substance abuse treatment records. Access to these records is governed separately under Title 43A, Section 1-109 of the Oklahoma Statutes rather than the general medical records access law.

Response Timeline

Providers must respond to records requests within 30 days. Under HIPAA, covered entities have the same 30-day window to provide access to protected health information, with a possible 30-day extension if the provider notifies the patient in writing.

Record Storage and Preservation Methods

Oklahoma law recognizes that hospitals may need to use technology to preserve records while conserving physical storage space. Under OAC 310:667-19-14, hospitals may:

• Microfilm records
• Transfer records to optical disk
• Use similar recording technology

Once records are converted to these formats, hospitals may destroy the original paper records. The regulation specifies that records reconstituted from technology employed to conserve space are considered the same as the original. Retaining the digitally preserved record satisfies all preservation requirements.

Most modern Oklahoma healthcare facilities now maintain electronic health records (EHR) systems, which satisfy the storage requirements as long as the records remain accessible and retrievable throughout the required retention period.

Proper Destruction of Medical Records

When the retention period has expired, Oklahoma healthcare providers must still follow proper procedures when destroying medical records. While Oklahoma law does not specify exact destruction methods, federal HIPAA requirements under the HHS disposal guidance apply to all covered entities.

Paper Records

The U.S. Department of Health and Human Services recommends these methods for destroying paper records containing protected health information:

• Shredding (cross-cut shredders recommended)
• Burning
• Pulping
• Pulverizing

Records must be rendered unreadable, indecipherable, and unable to be reconstructed.

Electronic Records

For electronic records, HHS recommends:

• Clearing: Overwriting media with non-sensitive data
• Purging: Degaussing or exposing media to a strong magnetic field
• Destroying: Disintegration, pulverization, melting, incinerating, or shredding the physical media

Providers should obtain a Certificate of Destruction from any third-party destruction service to document compliance. Any third party that handles protected health information during the destruction process must sign a Business Associate Agreement.

What Happens When a Practice Closes in Oklahoma

When a hospital closes in Oklahoma, OAC 310:667-19-14 requires the facility to inform the Oklahoma State Department of Health about the disposition of its records. The disposition must protect the integrity of the information contained in the medical records.

Records from closed facilities must still be retained and disposed of in a manner consistent with the statute of limitations. This means the 5-year minimum (or longer for minors and federal program participants) continues to apply even after the facility ceases operations.

For physicians closing a private practice, the Oklahoma Board of Medical Licensure and Supervision provides guidance that includes:

• Notifying patients with adequate advance notice
• Arranging for transfer or storage of records with a qualified custodian
• Ensuring patients can access their records during the transition
• For deceased physicians in solo practice, original records of patients not seen in the past 7 years may be given directly to the patient

Oklahoma does not have a specific statute requiring a set notice period before practice closure, but the Board expects physicians to provide reasonable advance notice to allow patients to arrange for records transfer and continuity of care.

Frequently Asked Questions

Sources and References

• OAC 310:667-19-14 - Retention and Preservation of Records (Cornell Law Institute)
• OAC 310:667-39-11 - Critical Access Hospital Medical Record Services (Cornell Law Institute)
• OAC 310:667-40-11 - Emergency Hospital Medical Record Services (Cornell Law Institute)
• OAC 317:30-3-15 - Medicaid Record Retention (Oklahoma Health Care Authority)
• Oklahoma Statutes Title 76, Section 19 - Access to Medical Records (OSCN)
• Oklahoma Statutes Title 15, Section 13 - Minors Defined (Justia)
• 45 CFR 164.316 - HIPAA Documentation Requirements (eCFR)
• 42 CFR 482.24 - CMS Conditions of Participation: Medical Record Services (eCFR)
• HHS Disposal of Protected Health Information FAQ (HHS.gov)
• Oklahoma State Department of Health - Hospital Standards OAC 310:667 (Oklahoma.gov)