Rhode Island Medical Records Retention Laws (2026 Guide)

Understanding how long healthcare providers must keep your medical records in Rhode Island is important for patients, physicians, and hospital administrators alike. Rhode Island law establishes different retention periods depending on the type of provider, with physicians required to keep records longer than hospitals. Federal rules under HIPAA and CMS add additional layers that every provider must follow.

This guide covers Rhode Island's specific retention requirements for hospitals and physicians, rules for minor patients, federal requirements, patient access rights, record destruction standards, practice closure obligations, and answers to common questions.

Rhode Island Medical Records Retention Periods

Rhode Island sets different minimum retention periods for hospitals and physician offices. These requirements come from state regulations administered by the Rhode Island Department of Health and the Board of Medical Licensure and Discipline.

Physician Office Records: 7 Years

Rhode Island regulation 216-RICR-40-05-1 requires licensed physicians to maintain patient medical records for a minimum of seven years unless otherwise mandated by law or regulation. This 7-year period runs from the date of the last patient encounter, not from the date the record was created.

The regulation applies to all physicians licensed by the Rhode Island Board of Medical Licensure and Discipline. Records must be legible and include the identity of the treating physician by name and title, information sufficient to justify the treatment course, active problem and medication lists, patient histories and examination results, test results, drug records, and consultation and hospitalization reports.

Failure to maintain completed records in accordance with this regulation constitutes unprofessional conduct and may result in disciplinary action by the Board.

Hospital Records: 5 Years

Rhode Island hospitals licensed by the Department of Health under R.I. Gen. Laws Title 23, Chapter 17 must retain medical records for a minimum of five years after patient discharge. This period matches the federal CMS Conditions of Participation minimum for Medicare-participating hospitals.

Hospital licensing regulations under 216-RICR-40-10-4 incorporate Joint Commission standards for medical records management and require hospitals to maintain systems for recording and transmitting patient-specific information to other healthcare providers for continuity of care purposes.

Records may be kept in their original form or as accurate reproductions, including microfilm, microfiche, or electronic formats, as long as the reproduction is a true and accurate copy of the original.

Comparison: Hospital vs. Physician Retention

Provider Type	Minimum Retention Period	Authority
Physicians	7 years from last encounter	216-RICR-40-05-1, Section 1.5.12(C)
Hospitals	5 years after discharge	216-RICR-40-10-4; 42 CFR 482.24
Dentists	5 years from last visit	216-RICR-40-05-2.14

The difference between hospital and physician retention periods means that a patient who sees both a hospital and a private physician for the same condition may find that the hospital destroys its records two years before the physician's office does. Patients should be aware of this when planning to request older records.

Records of Minor Patients

Rhode Island requires healthcare providers to retain records of minor patients for at least five years after the minor reaches the age of 18. This effectively means that a record created for a newborn must be kept until the patient turns 23.

This extended retention period applies to both hospitals and physician offices. The purpose is to ensure that individuals have access to their childhood medical history when they reach adulthood and can make their own healthcare decisions.

For a child born today, this means records must be retained for a minimum of 23 years. For a teenager who turns 18 next year, the records must be kept until they are at least 23 years old.

Minor Records Retention Examples

Patient Age at Last Visit	Records Must Be Kept Until	Total Minimum Retention
Newborn (age 0)	Age 23	23 years
Age 5	Age 23	18 years
Age 10	Age 23	13 years
Age 15	Age 23	8 years
Age 17	Age 23	6 years

Because the minor retention period (until age 23) can exceed the standard adult retention period (5 or 7 years), providers must track the patient's date of birth and calculate the appropriate retention deadline for each minor patient record.

Federal Requirements That Apply in Rhode Island

Rhode Island providers must comply with both state and federal medical records requirements. When state and federal rules conflict, the stricter requirement controls.

HIPAA: No Medical Records Retention Period

The HIPAA Privacy Rule does not require covered entities to retain patient medical records for any specific period of time. This is one of the most common misconceptions in healthcare compliance.

What HIPAA does require is that covered entities retain HIPAA-related administrative documentation for six years from the date of creation or last effective date. This includes privacy policies, procedures, privacy practices notices, complaint disposition records, and business associate agreements, as specified in 45 CFR 164.530(j).

HIPAA also requires that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for whatever period the information is maintained, including through the disposal process.

CMS Conditions of Participation: 5-Year Minimum for Hospitals

Hospitals participating in Medicare must retain medical records in their original or legally reproduced form for at least five years, as required by 42 CFR 482.24(b)(1). This federal minimum matches Rhode Island's state requirement for hospitals.

For general Medicare providers (not just hospitals), CMS guidelines recommend retaining records for at least seven years from the date of service. This aligns with Rhode Island's physician retention requirement.

Which Rule Controls?

The stricter requirement always applies. Here is how that works in practice for Rhode Island providers:

Situation	State Requirement	Federal Requirement	Provider Must Follow
Hospital (Medicare)	5 years	5 years (42 CFR 482.24)	5 years (equal)
Physician (Medicare)	7 years	7 years (CMS guideline)	7 years (equal)
HIPAA admin docs	No state rule	6 years (45 CFR 164.530)	6 years (federal)
Minor at hospital	Until age 23	5 years	Until age 23 (state is stricter)

In Rhode Island, the state and federal requirements are closely aligned for most provider types. The most significant difference arises with minor patient records, where the state requirement to retain records until age 23 exceeds the federal minimum.

Patient Access to Medical Records in Rhode Island

Rhode Island law and federal HIPAA regulations give patients the right to access and obtain copies of their medical records.

Response Time

Providers must furnish requested medical records within 30 days of receiving a written request. This applies to all providers, including out-of-state entities that handle medical records for in-state providers, under R.I. Gen. Laws 23-17-19.1.

Fees for Copies

Rhode Island law under R.I. Gen. Laws 23-1-48 establishes specific fee limits for medical record copies:

Type of Request	Maximum Fee
Paper copies (first 100 pages)	$0.50 per page
Paper copies (pages 101+)	$0.25 per page
Clerical/handling fee	$25.00 maximum
Electronic format	$25.00 handling + $0.50/$0.25 per page (max $100 for pages)
X-rays and non-photocopiable items	Actual cost + $25.00 handling
Rush delivery (within 48 hours)	$10.00 special handling fee

Key Patient Protections

Rhode Island law provides several important protections for patients requesting their records:

No outstanding bill requirement. Physicians cannot require a patient to pay any outstanding bills before retrieving and copying medical records.

No charge for certain records. There is no fee for copies of immunization records required for school entry, records needed for public benefits claims, or records needed to support an appeal under the Social Security Act.

Electronic access. Patients may request records in electronic format. The total charge for pages in electronic format cannot exceed $100.

Proper Destruction of Medical Records

Once the applicable retention period has expired, Rhode Island providers may destroy medical records. However, destruction must comply with both state and federal requirements.

HIPAA Destruction Standards

The HIPAA Privacy Rule requires that protected health information be rendered essentially unreadable, indecipherable, and otherwise unable to be reconstructed when destroyed.

Paper records must be destroyed by shredding, burning, pulping, or pulverizing. Cross-cut shredding is recommended. The Rhode Island State Archives recommends using vendors with NAID AAA Certification for secure document destruction.

Electronic records must be destroyed by clearing (overwriting with non-sensitive data), purging or degaussing (exposing to a strong magnetic field), or physically destroying the storage media through disintegration, pulverization, melting, incinerating, or shredding.

Business Associate Requirements

Providers may hire a business associate to handle record destruction. However, a business associate agreement must be in place that requires the business associate to appropriately safeguard the protected health information through the disposal process.

Records must never be placed in dumpsters, recycling bins, or other publicly accessible containers, even if they are in sealed bags or boxes.

Maintaining a Destruction Log

While Rhode Island does not explicitly require a destruction log by statute, maintaining one is a best practice recommended by the Department of Health. A destruction log should include the date of destruction, description of records destroyed, method of destruction, and the name of the person or company that performed the destruction.

Practice Closure and Record Preservation

When a physician retires, relocates, or otherwise closes a medical practice in Rhode Island, specific statutory requirements govern how patient records must be handled.

Voluntary Practice Closure

Under Rhode Island regulation 216-RICR-40-05-1, Section 1.5.10, a physician who voluntarily closes a practice must:

1. Provide at least 90 days' notice before closure.
2. Publish public notice in a newspaper with statewide circulation, including the closure date and information about where and how patients may obtain their records both before and after closure.
3. Notify the Rhode Island Medical Society and the Rhode Island Board of Medical Licensure and Discipline of the location of the records.
4. Send individual notice to patients seen within the previous two years.
5. Ensure records are stored securely and remain accessible to patients after closure.

Death of a Practicing Physician

Under R.I. Gen. Laws 5-37-30, the heirs or estate of a deceased physician who had been practicing at the time of death must:

1. Give public notice within 90 days of the physician's death regarding the disposition of patient medical records, published in a newspaper with statewide circulation.
2. Notify the Rhode Island Medical Society and the Board of Medical Licensure and Discipline of the location of the records.
3. Dispose of patient records in a location and manner that ensures the records are maintained and accessible to patients.

Confidentiality After Transfer

Any person, corporation, or other legal entity that receives medical records from a retired or deceased physician must comply with the Confidentiality of Health Care Communications and Information Act (R.I. Gen. Laws Chapter 5-37.3). This means the receiving party has the same confidentiality obligations as the original physician, even if the receiving party is not a licensed healthcare provider.

Records of a deceased or retired physician may only be released upon the written request of a patient, the patient's authorized representative, or the patient's heirs or estate, and only to a designated physician, except as otherwise provided under Section 5-37.3-4.

Rhode Island Health Information Exchange

In April 2025, Rhode Island transitioned its statewide Health Information Exchange (HIE), known as CurrentCare, from an opt-in to an opt-out consent model. This means patient health information is now automatically shared through the exchange unless the patient specifically opts out.

CurrentCare allows authorized healthcare providers across the state to access patient records electronically, which can reduce delays in care and decrease the need for patients to request paper copies of their records from individual providers.

Rhode Island is also implementing an electronic medical records system throughout the state hospital system, including Eleanor Slater Hospital. Electronic case reporting using HL7 standards is required for eligible hospitals and clinicians participating in the CMS Promoting Interoperability Program.

Sources and References

• 216-RICR-40-05-1: Licensure and Discipline of Physicians - Rhode Island Department of State
• 216-RICR-40-10-4: Licensing of Hospitals - Rhode Island Department of State
• R.I. Gen. Laws 5-37-30: Closure of Medical Practice - Rhode Island General Assembly
• R.I. Gen. Laws 23-1-48: Reimbursement for Medical Record Copies - Rhode Island General Assembly
• R.I. Gen. Laws 23-17-19.1: Rights of Patients - Rhode Island General Assembly
• 42 CFR 482.24: Condition of Participation: Medical Record Services - Legal Information Institute
• HIPAA Medical Records Retention FAQ - U.S. Department of Health and Human Services
• Disposal of Protected Health Information - U.S. Department of Health and Human Services
• Rhode Island Records Destruction Guidance - Rhode Island Secretary of State