Vermont Medical Records Retention Laws (2026 Guide)

Vermont medical records retention laws establish how long hospitals and healthcare providers must preserve patient health information. The primary state regulation, VT Code R. 946, requires hospitals to maintain medical records for every patient and retain those records for a minimum of 10 years.

This guide covers all Vermont-specific retention requirements for hospitals and physicians, rules for minor and deceased patient records, federal requirements under HIPAA and CMS, patient access rights, proper destruction procedures, and what happens when a medical practice closes.

Vermont Hospital Medical Records Retention Requirements

Vermont law sets clear retention requirements for hospitals licensed in the state. Two primary authorities govern hospital record keeping: the Vermont hospital licensing statute and the associated administrative regulation.

The 10-Year Hospital Retention Rule

18 V.S.A. 1905 establishes minimum standards for hospital licensing in Vermont. Among those standards is a requirement that professional case records be compiled for all patients, signed by the attending physician, and kept on file for a minimum of 10 years.

The companion regulation, 12-5-14 VT Code R. 946, reinforces this requirement. Under this regulation, a hospital must maintain medical records for every patient and retain the records for 10 years following discharge. Medical records must be permanent, legible, and signed by the attending physician.

The 10-year clock begins on the date of patient discharge, not the date of the last entry in the record. This distinction matters for patients with extended hospital stays.

What Hospital Records Must Include

Under Vermont licensing standards, hospital medical records must contain sufficient information to justify the diagnosis and treatment provided. At a minimum, records should include:

• Patient identification and demographic information
• Admission and discharge dates
• History and physical examination findings
• Physician orders and progress notes
• Operative reports and pathology findings
• Nursing notes and medication administration records
• Diagnostic test results
• Discharge summary with follow-up instructions

Hospitals must also maintain accounting records of all operating procedures on a monthly basis. Complete operating and financial statements must be compiled at least once annually and kept on file for 20 years under 18 V.S.A. 1905.

Physician and Private Practice Retention Requirements

Vermont does not have a specific statute that governs how long private physician offices must retain patient medical records. This gap distinguishes Vermont from many other states that set explicit retention periods for all provider types.

The 10-Year Best Practice Recommendation

Although no Vermont statute directly mandates a retention period for private practices, the Vermont Medical Society and professional liability insurers recommend that all healthcare providers retain medical records for at least 10 years after the patient was last treated.

This recommendation is based on Vermont's statute of limitations for medical malpractice claims. Under 12 V.S.A. 521, a medical malpractice action must be brought within three years of the date of the incident or two years from the date the injury is or reasonably should have been discovered, whichever occurs later, but not later than seven years from the date of the incident.

Because the seven-year outer limit for malpractice claims can be extended in cases involving fraudulent concealment or foreign objects left in the body, maintaining records for 10 years provides an additional safety margin for providers.

Why the 10-Year Standard Matters

Even without a mandatory statute, physicians who destroy records before the 10-year mark face several risks:

• Inability to defend against a malpractice claim filed within the statute of limitations
• Loss of documentation needed for insurance audits or billing disputes
• Potential liability if a patient suffers harm due to a provider not having access to prior treatment history
• Regulatory complications with Medicare or Medicaid billing reviews

The practical effect is that most Vermont physicians follow the same 10-year standard as hospitals, even though the legal basis differs.

Records of Minors and Deceased Patients

Vermont applies special retention considerations for the medical records of children and patients who have died.

Minor Patient Records

The Vermont Medical Society recommends that records of minor patients be retained until at least three years after the child reaches the age of 18, which means keeping records until the patient turns 21. This extended retention period accounts for the fact that the statute of limitations for minors does not begin to run until the minor reaches the age of majority.

For hospitals, the 10-year post-discharge rule still applies. If a child is treated at age 5 and discharged, the hospital must keep the record for 10 years (until the child is 15). However, best practice dictates retaining the record until the child turns 21, which is the longer of the two periods.

Providers should always apply the longer retention period when state rules and best practice recommendations conflict.

Deceased Patient Records

For patients who have died, Vermont healthcare providers are advised to retain medical records for no less than three years after the date of death. This period aligns with the general statute of limitations for claims that may arise from the estate of a deceased individual.

Hospitals should still apply the 10-year rule if the patient died during a hospitalization or shortly after discharge, as the 10-year post-discharge requirement may extend beyond the three-year post-death recommendation.

Federal Requirements: HIPAA and CMS

Vermont providers must comply with both state and federal medical records requirements. When state and federal rules conflict, the stricter standard applies.

HIPAA Documentation Requirements

One of the most common misconceptions is that HIPAA requires providers to keep patient medical records for a specific number of years. It does not.

HIPAA requires covered entities to retain HIPAA-related administrative documentation for six years from the date of creation or the date when the document was last in effect, whichever is later, under 45 CFR 164.530(j). This six-year requirement covers:

• Privacy and security policies and procedures
• Business associate agreements
• Patient authorization forms
• Training records
• Complaint and resolution documentation
• Risk assessments and audit logs

The six-year rule applies to compliance paperwork only, not to patient treatment records. How long actual patient medical records must be kept is determined by state law.

HIPAA Privacy and Security Protections

While HIPAA does not dictate retention periods for medical records, it does require that all protected health information be safeguarded for as long as it exists. Under 18 V.S.A. 1881, Vermont law further reinforces HIPAA protections by prohibiting covered entities and business associates from disclosing protected health information unless the disclosure is permitted under HIPAA.

This means that even after a record has passed the minimum retention period, if it has not been destroyed, it must continue to be protected under HIPAA privacy and security standards.

CMS and Medicare Requirements

CMS Conditions of Participation establish separate federal minimums for providers participating in Medicare or Medicaid:

Provider Type	Minimum Retention	Federal Authority
Hospitals (Medicare)	5 years after discharge	42 CFR 482.24
General Medicare providers	7 years from date of service	CMS guidelines
Medicare Part D sponsors	10 years from date of service	CMS guidelines
Hospice programs	6 years after discharge or death	42 CFR 418.104

For Vermont hospitals that participate in Medicare, the state's 10-year requirement exceeds the federal five-year minimum. Vermont's stricter standard controls, meaning these hospitals must retain records for 10 years.

For Vermont physician offices that accept Medicare, the federal seven-year requirement provides a mandatory minimum even though Vermont has no specific state statute for private practices.

Patient Access to Medical Records in Vermont

Vermont law and federal law both guarantee patients the right to access their medical records.

State Law: 18 V.S.A. 9419

Under 18 V.S.A. 9419, Vermont patients have the right to obtain copies of their health care records. The statute sets specific limits on what providers can charge:

• A flat fee of no more than $5.00, or no more than $0.50 per page, whichever is greater
• An itemized bill must be provided to the patient or authorized recipient
• No charge for copies requested to support a claim or appeal under any provision of the Social Security Act or any other federal or state needs-based benefit program
• Reasonable fees may be charged for copies of X-rays, films, models, disks, tapes, or other non-standard formats

These fee limits apply to all custodians of health care records in Vermont, including hospitals, physician offices, and other healthcare facilities.

Federal Law: HIPAA Right of Access

Under the HIPAA Privacy Rule, patients have the right to inspect and obtain copies of their protected health information. Key provisions include:

• Providers must respond to a records request within 30 calendar days
• An additional 30-day extension is permitted with written notice explaining the delay
• For electronic copies of electronically maintained records, providers may charge a flat fee of $6.50 or less
• Providers cannot deny access because of unpaid bills, old records, or inconvenience
• Limited exceptions exist for psychotherapy notes, information compiled for legal proceedings, and certain lab results

The 21st Century Cures Act further strengthened patient access by prohibiting information blocking, defined as practices likely to interfere with access to, exchange of, or use of electronic health information. Penalties for information blocking can reach up to $1 million per violation for health IT developers.

Which Fee Applies?

When a Vermont patient requests paper copies of their records, the state fee limit under 18 V.S.A. 9419 ($5.00 flat or $0.50 per page) applies. When a patient requests electronic copies of electronically maintained records, the HIPAA flat fee of $6.50 or less may apply. Providers should apply the fee structure that is most favorable to the patient.

Proper Destruction of Medical Records

Once medical records have been retained for the required period, Vermont healthcare providers may destroy them. However, destruction must follow specific procedures to protect patient privacy.

HIPAA Destruction Standards

HIPAA requires that destroyed records be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed." Approved methods include:

Paper records: Shredding, burning, pulping, or pulverizing. Cross-cut shredding is preferred over strip-cut shredding because strip-cut documents can potentially be reassembled.

Electronic records: Clearing (overwriting with non-sensitive data), purging or degaussing (using a strong magnetic field to erase data), or physical destruction of the storage media such as hard drives, disks, or tapes.

Records may never be placed in dumpsters, recycling bins, or other publicly accessible containers. Providers who use a third-party destruction service must have a HIPAA business associate agreement in place with that vendor.

Vermont-Specific Considerations

Vermont does not have a specific state statute requiring patient notification before destroying medical records that have exceeded the retention period. However, as a best practice, providers should:

• Document the date and method of destruction
• Maintain a log of destroyed records (patient name, record dates, destruction date, destruction method)
• Keep the destruction log indefinitely for compliance verification
• Verify that all copies of the record, including backup tapes and off-site storage, are destroyed

Penalties for Improper Destruction

HIPAA civil penalties for improper disposal of protected health information range from $141 to $2,134,831 per violation, depending on the level of negligence. Criminal penalties for knowing violations can reach $250,000 and 10 years of imprisonment.

What Happens When a Vermont Practice Closes

When a Vermont physician retires, relocates, or closes a practice, the provider must still ensure patient records are preserved for the remaining retention period.

Recommended Steps for Practice Closure

The Vermont Medical Society and the American Medical Association recommend the following steps when closing a medical practice:

1. Notify patients in writing. Send a letter to all active patients informing them of the closure date and explaining how they can obtain their records or have them transferred to another provider. Ideally, this letter should be sent by certified mail with return receipt requested.

2. Provide adequate notice. Give patients at least 30 to 60 days of notice before the practice closes. The notification should include the reason for closure, the date of closure, and the process for requesting records.

3. Offer records transfer. Include a consent form authorizing the transfer of records to a new provider of the patient's choice.

4. Arrange for a records custodian. If records must be retained beyond the closure date, arrange for a custodian (another provider, a medical records storage company, or the local hospital) to maintain the records for the remaining retention period.

5. Notify the Board of Medical Practice. The Vermont Board of Medical Practice should be informed of the closure and the arrangements made for record storage.

6. Continue HIPAA protections. All records, whether retained by a custodian or transferred to patients, must continue to be protected under HIPAA privacy and security standards.

Records of Patients Who Cannot Be Reached

For patients who do not respond to the closure notification, the provider must still arrange for proper storage of their records for the full retention period. These records cannot be destroyed simply because the patient did not respond.

Vermont Medical Records Retention Summary Table

The following table summarizes the key retention requirements for Vermont healthcare providers:

Record Type	Retention Period	Legal Authority
Hospital patient records	10 years after discharge	18 V.S.A. 1905; VT Code R. 946
Hospital financial records	20 years	18 V.S.A. 1905
Physician office records	10 years (recommended)	Based on statute of limitations
Minor patient records	Until age 21 (recommended)	VT Medical Society guidance
Deceased patient records	3 years after death (recommended)	VT Medical Society guidance
Medicare hospital records	5 years after discharge (federal floor)	42 CFR 482.24
Medicare provider records	7 years from date of service	CMS guidelines
HIPAA compliance documentation	6 years	45 CFR 164.530(j)