Arkansas
Arkansas Medical Records Retention Laws (2026 Guide)
Independently fact-checked against primary sources (last audited August 18, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 9, 2026. · 9 primary sources cited on this page. How we verify our legal content
Arkansas hospitals must retain patient medical records for at least 10 years after the patient's last discharge under Ark. Code R. 007.05.17. Records for minor patients must be kept until at least two years after the patient turns 18. Physician offices follow a recommended 10-year standard from the date of last treatment.
Last verified: March 2026. This page reflects current Arkansas State Board of Health Rules for Hospitals and Related Institutions (Ark. Code R. 007.05.17), Ark. Code Ann. 16-46-106, and applicable federal regulations.
Table of Contents
- Overview of Arkansas Medical Records Retention Laws
- Hospital Medical Records Retention Requirements
- Retention Rules for Minor Patients
- Physician and Private Practice Retention Standards
- Nursing Homes and Long-Term Care Facilities
- Federal HIPAA Retention Requirements
- CMS and Medicare Conditions of Participation
- Patient Access to Medical Records
- Copy Fees and Timelines
- Proper Destruction of Medical Records
- Practice Closure and Records Custodianship
- Statute of Limitations Considerations
- Frequently Asked Questions
- Sources and References
Overview of Arkansas Medical Records Retention Laws
Arkansas medical records retention laws establish how long healthcare providers and facilities must keep patient health information on file. These rules serve a dual purpose. They protect patients' right to access their own medical history, and they protect providers by preserving documentation that may be needed for legal, billing, or continuity-of-care purposes.
The primary state regulation governing hospital records is found in the Arkansas State Board of Health Rules for Hospitals and Related Institutions, codified at Ark. Code R. 007.05.17. This regulation sets clear minimum retention periods for hospitals and related institutions licensed in the state.
For physician offices and private practices, Arkansas does not have a specific statute mandating a retention period. Instead, professional organizations and the Arkansas State Medical Board provide recommended guidelines that align closely with hospital standards.
Both state and federal laws apply to medical records retention in Arkansas. Healthcare providers must comply with whichever law requires the longest retention period, meaning federal requirements under HIPAA and the Centers for Medicare and Medicaid Services (CMS) can extend obligations beyond the state minimum.
Hospital Medical Records Retention Requirements
Under the Arkansas State Board of Health Rules for Hospitals and Related Institutions (Ark. Code R. 007.05.17), hospitals must retain all patient medical records for a minimum of 10 years following the patient's last discharge from the facility.
This 10-year requirement applies to all medical records maintained by licensed hospitals and related institutions in Arkansas. The regulation covers the complete medical record, including admission and discharge documentation, physician orders, progress notes, operative reports, diagnostic test results, nursing notes, and all other clinical documentation.
Acceptable Storage Formats
Arkansas law permits hospitals to retain medical records in their original paper form, on microfilm, or through other acceptable methods such as electronic health record (EHR) systems. Regardless of the storage format, the records must remain legible, accessible, and reproducible for the full 10-year retention period.
Master Patient Index
Even after the 10-year retention period has passed and records are eligible for destruction, Arkansas hospitals must permanently maintain information contained in the master patient index. This index typically includes the patient's name, dates of service, medical record number, and basic demographic information. The permanent retention of the master patient index allows facilities to confirm that a patient received care even after detailed clinical records have been destroyed.
Documentation Standards
The Arkansas hospital rules also establish standards for record completion and authentication. All entries in the medical record must be legible, dated, and authenticated by the responsible provider. Typewritten reports must include both the date of dictation and the date of transcription. Block charting and co-signatures are not acceptable practices under Arkansas hospital regulations.
Dictated records must be transcribed within 48 hours of dictation. These completion standards help ensure that medical records are accurate and reliable for the duration of the retention period.
Retention Rules for Minor Patients
Arkansas provides extended retention requirements for the medical records of minor patients. Under the same hospital regulations (Ark. Code R. 007.05.17), complete medical records of minors must be retained for a period of 2 years after the patient reaches the age of majority.
Since the age of majority in Arkansas is 18, this means hospitals must keep a minor's records until the patient turns 20 years old, or for 10 years after the last discharge, whichever period is longer.
How the Two Rules Interact
Consider a child who is discharged from a hospital at age 5 in 2026. Under the standard 10-year rule, the records would be eligible for destruction in 2036. However, under the minor patient rule, the records must be kept until 2 years after the child turns 18, which would be 2043 (when the patient is 20 years old). In this case, the minor patient rule extends the retention requirement by 7 years beyond the standard period.
For a teenager discharged at age 16, the standard 10-year rule would require retention until the patient is 26. The minor patient rule only extends to age 20. In that scenario, the 10-year rule controls, and the records must be kept until the patient turns 26.
Connection to Statute of Limitations
The extended retention period for minors' records aligns with Arkansas medical malpractice statutes. Under Ark. Code Ann. 16-114-203, minors who are 9 years old or younger at the time of an alleged medical injury have until the later of their 11th birthday or 2 years from the act to file a claim. For injuries not discovered before the minor's 11th birthday, the deadline extends to 2 years after the injury is discovered or until the patient's 19th birthday, whichever comes first. Retaining records beyond the standard period helps ensure documentation is available for any potential claims.
Physician and Private Practice Retention Standards
Arkansas does not have a specific statute that mandates a retention period for medical records maintained by physician offices, clinics, or private practices. This is a notable gap compared to many other states that set explicit requirements for all provider types.
In the absence of a statutory mandate, the Arkansas Medical Society recommends that physicians retain patient records for at least 10 years from the date of last treatment. This recommendation mirrors the hospital retention period and provides a consistent standard across practice settings.
Factors That May Extend Retention
Several practical and legal considerations may require physicians to keep records longer than 10 years:
- Minor patients: Records for minors should be retained until at least 2 years after the patient reaches age 18, consistent with hospital standards
- Medical malpractice statute of limitations: Arkansas allows 2 years from the date a cause of action accrues to file a malpractice claim, but discovery rules and minor tolling provisions can extend this period significantly
- Ongoing treatment: Records for patients with chronic conditions or ongoing treatment should be retained as long as the patient continues to receive care and for the full retention period after the last visit
- Federal program participation: Providers who accept Medicare or Medicaid must comply with CMS retention requirements, which may differ from state guidelines
Best Practice Recommendation
Healthcare attorneys and professional organizations generally recommend that Arkansas physicians adopt a written records retention policy that specifies at least a 10-year retention period from the last date of service, with extended retention for minors and patients involved in known or anticipated litigation.
Nursing Homes and Long-Term Care Facilities
Arkansas nursing homes and long-term care facilities are licensed by the Office of Long Term Care (OLTC) within the Arkansas Department of Human Services, not by the State Board of Health. The Board of Health rules described above are the Rules for Hospitals and Related Institutions, and their definitions reach general hospitals, psychiatric hospitals, rehabilitation and recuperation facilities, infirmaries, and similar institutions rather than DHS-licensed nursing homes. The 10-year hospital retention period therefore is not automatically the standard for a nursing facility, and operators should confirm the applicable period directly with OLTC.
The federal floor for any nursing facility that participates in Medicare or Medicaid is set by 42 CFR 483.70(h)(4). It provides that medical records must be retained for the period of time required by state law, or for 5 years from the date of discharge when there is no requirement in state law, or, for a minor, for 3 years after the resident reaches legal age under state law.
That ladder means the answer for an Arkansas nursing home turns on what the OLTC rules require. Where the OLTC rules set a period, that period controls; where they do not, the 5-year federal default applies.
Resident Assessment Instruments
Federal participation rules do not impose a separate multi-year retention schedule on resident assessment instruments. Under 42 CFR 483.20(d), a facility must maintain all resident assessments completed within the previous 15 months in the resident's active record and use the results to develop, review, and revise the resident's comprehensive care plan. Older assessments fall under the general medical records retention rule at 42 CFR 483.70(h)(4) rather than under an assessment-specific period.
Federal HIPAA Retention Requirements
The Health Insurance Portability and Accountability Act (HIPAA) does not directly mandate how long healthcare providers must retain patient medical records. According to the U.S. Department of Health and Human Services (HHS), the HIPAA Privacy Rule does not include medical record retention requirements. State laws govern how long medical records must be retained.
However, HIPAA does require covered entities to retain certain compliance and administrative documentation for a minimum of 6 years. Under 45 CFR 164.530(j), covered entities must keep the following types of records for 6 years from the date of creation or the date when the document last was in effect, whichever is later:
- HIPAA privacy policies and procedures
- Privacy practices notices
- Disposition of complaints
- Required accounting of disclosures
- Business associate agreements
- Training records
- Sanctions applied to workforce members
How HIPAA Interacts with Arkansas Law
For Arkansas healthcare providers, the practical effect is a layered compliance obligation. The state 10-year requirement for hospital medical records exceeds the HIPAA 6-year documentation retention period, so the state rule controls for clinical records. However, HIPAA administrative documentation must be retained for 6 years regardless of whether the underlying patient records are still on file.
Providers who destroy patient records after the state retention period must still be able to produce their HIPAA compliance documentation if audited by the HHS Office for Civil Rights (OCR). This means privacy policies, business associate agreements, and training records from the period in question must remain accessible.
CMS and Medicare Conditions of Participation
Hospitals that participate in the Medicare program must meet the Conditions of Participation (CoPs) set by the Centers for Medicare and Medicaid Services. Under 42 CFR 482.24, Medicare-participating hospitals must retain medical records in their original or legally reproduced form for a minimum of 5 years.
Since Arkansas state law requires 10 years, the state requirement controls for hospitals in Arkansas. The CMS 5-year minimum becomes relevant only if a state does not set its own longer retention requirement.
Broader Medicare Provider Requirements
A separate federal rule reaches non-hospital providers and suppliers, but it is narrower than a general retention mandate. Under 42 CFR 424.516(f), a provider or supplier furnishing covered Part A or Part B services must maintain documentation relating to written orders, certifications, referrals, prescriptions, and requests for payment for 7 years from the date of service, and must provide access to that documentation on request by CMS or a Medicare contractor. The same 7-year obligation falls on the physician or other eligible professional who ordered, certified, referred, or prescribed the service.
That rule covers ordering and certification paperwork, not the complete clinical record, so it is not a general medical records retention mandate for every Medicare provider. Arkansas physicians who participate in Medicare should still plan to retain the full patient record for at least 10 years under the state recommended standard, which comfortably covers the 7-year federal documentation period.
CMS Documentation Standards
CMS also requires that medical records be accurately written, promptly completed, properly filed and retained, and accessible. The hospital must have a system for coding and indexing medical records that allows timely retrieval by diagnosis and procedure. These standards apply throughout the entire retention period.
Patient Access to Medical Records
Arkansas patients have a legal right to access their medical records through multiple pathways established by both state and federal law.
State Law: Ark. Code Ann. 16-46-106
Under Ark. Code Ann. 16-46-106, patients or their authorized representatives may submit a written request for copies of their medical records. This statute originally focused on access for legal proceedings, insurance claims, and life insurance applications, but has been interpreted broadly to support general patient access.
The statute establishes specific procedures when a physician or facility receives a records request. Providers must respond and produce records within a reasonable timeframe. If a physician believes releasing certain records could harm the patient, the physician may deny direct access and instead provide the records to another physician designated by the patient for review.
Federal Law: HIPAA Right of Access
Under the HIPAA Privacy Rule (45 CFR 164.524), patients have a broad right to access their protected health information (PHI) held by covered entities. Key provisions include:
- Covered entities must act on a request within 30 calendar days
- One extension of up to 30 additional days is permitted with written notice to the patient explaining the reason for the delay
- Records must be provided in the form and format requested by the patient, if readily producible (including electronic format for electronically maintained records)
- If the requested format is not available, the provider must offer a readable hard copy or mutually agreed alternative
- The fee charged must be reasonable and cost-based
The HIPAA right of access is broader than the Arkansas statutory provision and applies to virtually all protected health information maintained by covered entities, with limited exceptions for psychotherapy notes, information compiled for legal proceedings, and certain research records.
Copy Fees and Timelines
Arkansas law sets specific caps on the fees that providers may charge for copies of medical records. These caps apply to requests made under Ark. Code Ann. 16-46-106.
Paper Copy Fees
| Pages | Maximum Fee Per Page |
|---|---|
| First 25 pages | $0.50 per page |
| Each additional page beyond 25 | $0.25 per page |
Additional Allowable Charges
| Charge Type | Maximum Amount |
|---|---|
| Labor fee per request | $15.00 |
| Postage | Actual cost |
| Retrieval fee, charged instead of the labor fee, for records stored off-site | Reasonable cost |
The statute permits a labor charge of no more than $15.00 for each request for medical records. As an alternative to that labor charge, a hospital, physician office, or ambulance provider may add a reasonable retrieval fee, but only when the requested records are stored at a location other than the provider's own. The two are alternatives rather than charges that stack. The statute also allows reasonable fees for a narrative medical report or medical review, but only when the requester specifically asks for one. Statutory fee amounts can be amended, so confirm the current figures if a bill looks higher than expected.
Electronic Records
Ark. Code Ann. 16-46-106 does not set a separate flat fee for producing records in electronic format, and it does not set a production deadline of any kind.
Requests for electronic copies are governed instead by the HIPAA right of access described above. The provider must act on the request within 30 calendar days, may take one 30-day extension with written notice, and must supply the records in the electronic form requested where the records are maintained electronically and the format is readily producible.
HIPAA Fee Limitations
HIPAA may further limit the fees a provider can charge. HHS guidance states that fees must be reasonable and cost-based, limited to the cost of copying (including supplies and labor), postage, and preparing a summary or explanation if requested and agreed to by the patient. Providers cannot charge search or retrieval fees under HIPAA, even if Arkansas state law would otherwise permit a retrieval fee.
When a patient makes a direct request for their own records, the more restrictive HIPAA fee limitations generally apply.
Proper Destruction of Medical Records
After the applicable retention period has expired, Arkansas healthcare providers may destroy medical records. However, destruction must be carried out in a manner that protects patient privacy and complies with both state standards and HIPAA destruction requirements.
Paper Record Destruction
For paper medical records, HHS requires that records be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed." Acceptable methods include:
- Shredding using cross-cut or micro-cut shredders
- Burning in a controlled, supervised environment
- Pulping through a commercial document destruction service
- Pulverizing to reduce records to unrecoverable fragments
Simply placing records in a dumpster, recycling bin, or trash receptacle accessible to the public is a HIPAA violation, regardless of whether the state retention period has passed.
Electronic Record Destruction
For electronically stored medical records, acceptable destruction methods include:
- Clearing (overwriting) the storage media so data cannot be recovered
- Purging (degaussing) magnetic media to eliminate all data
- Physical destruction of storage media through pulverization, melting, or incineration
Deletion of files without overwriting or physical destruction of the media is generally insufficient, as deleted electronic data can often be recovered using forensic tools.
Documentation of Destruction
Providers should maintain a log of destroyed records that includes the patient name or record identifier, the date of destruction, the method used, and the name of the individual who carried out or supervised the destruction. This documentation should be retained permanently as part of the facility's records management program.
Master Patient Index Preservation
As noted above, Arkansas hospitals must permanently maintain the master patient index even after destroying the detailed clinical records. Facilities should verify that index information is preserved before proceeding with any record destruction.
Practice Closure and Records Custodianship
When an Arkansas medical practice closes, the provider remains responsible for ensuring that patient medical records are properly maintained and accessible for the duration of the applicable retention period.
Notification Requirements
The Arkansas Medical Society recommends the following steps when closing a practice:
- Place a notice in the local newspaper announcing the closure and providing instructions for patients to obtain copies of their records
- Send a letter to all patients seen within the past year informing them of the closure, providing the expected date of closure, and explaining how to request their records
- Notify the Arkansas State Medical Board of the practice closure and provide contact information for the records custodian
Designating a Records Custodian
A records custodian is the individual or entity responsible for maintaining and providing access to medical records after a practice closes. In Arkansas, the custodian is typically:
- The physician who operated the practice (if retiring but still accessible)
- The executor of the physician's estate (if the physician is deceased)
- A successor practice or purchasing physician who acquires the practice
- A professional medical records storage company contracted to maintain the records
The custodian must maintain the records for the remainder of the retention period and respond to authorized requests for copies. Contact information for the custodian should be filed with the Arkansas State Medical Board so that patients and other authorized requestors can locate their records.
Records Transfer
If a practice is being acquired by another physician or group, patient records may be transferred to the new provider. Patients should be notified of the transfer and given the opportunity to request that their records be sent elsewhere if they prefer.
Statute of Limitations Considerations
Medical records retention is closely connected to the statute of limitations for medical malpractice claims in Arkansas. Providers should consider these timelines when determining how long to keep records.
General Medical Malpractice Statute of Limitations
Under Ark. Code Ann. 16-114-203, all actions for medical injury must be filed within 2 years after the cause of action accrues.
Tolling for Minors
Special rules apply to minor patients:
- Minors age 9 or younger at the time of the alleged injury have until the later of their 11th birthday or 2 years from the act to file a claim
- Undiscovered injuries in minors extend the deadline to 2 years after the injury is discovered or the patient's 19th birthday, whichever comes first
These tolling provisions for minors are one reason why the state requires extended retention of minor patient records. A claim filed when a patient is 19 years old could involve medical records from infancy.
Practical Impact on Retention
Because the statute of limitations can extend well beyond the standard 2-year period for minors and in cases involving undiscovered injuries, the 10-year retention requirement and the minor patient retention extension work together to ensure that records are available during the period when claims are most likely to be filed.
Frequently Asked Questions
How long do Arkansas hospitals have to keep medical records?
Arkansas hospitals must retain patient medical records for a minimum of 10 years following the patient's last discharge. This requirement comes from the Arkansas State Board of Health Rules for Hospitals and Related Institutions, codified at Ark. Code R. 007.05.17. Records may be stored in their original form, on microfilm, or in electronic format. After the 10-year period, records may be destroyed, but the facility must permanently maintain its master patient index.
How long must doctors keep medical records in Arkansas?
Arkansas does not have a specific statute requiring physician offices to retain records for a set period. However, the Arkansas Medical Society recommends that physicians keep records for at least 10 years from the date of last treatment. Physicians who bill Medicare must also keep documentation of orders, certifications, referrals, and prescriptions for 7 years under 42 CFR 424.516(f), though the 10-year recommendation for the complete record remains the best practice standard. Records for minor patients should be kept until at least 2 years after the patient reaches age 18.
What are the fees for obtaining copies of medical records in Arkansas?
Under Ark. Code Ann. 16-46-106, paper copies are capped at $0.50 per page for the first 25 pages and $0.25 per page after that. A labor charge of up to $15.00 per request may be added, along with actual postage costs. In place of that labor charge, a provider may add a reasonable retrieval fee when the records are stored off-site. The statute does not set a separate flat fee for electronic copies, a certification or notarization fee, or a production deadline. HIPAA may further limit fees when a patient requests their own records directly, and the HIPAA 30-day response deadline applies.
What happens to medical records when an Arkansas practice closes?
When a medical practice closes in Arkansas, the provider must arrange for a records custodian to maintain patient records for the remainder of the retention period. The Arkansas Medical Society recommends placing a newspaper notice, sending letters to recent patients, and notifying the Arkansas State Medical Board with custodian contact information. The custodian may be the retiring physician, the physician's estate executor, a successor practice, or a professional records storage company.
Does HIPAA require keeping medical records for a specific number of years?
No. According to HHS, the HIPAA Privacy Rule does not include medical record retention requirements. State laws govern how long medical records must be retained. HIPAA does require covered entities to retain certain administrative and compliance documentation, such as privacy policies, training records, and business associate agreements, for 6 years under 45 CFR 164.530(j). The 6-year requirement applies to these compliance documents, not to patient clinical records.
Related State Laws
- Medical Records Retention Laws by State
- Alabama Medical Records Retention Laws
- Arizona Medical Records Retention Laws
- California Medical Records Retention Laws
- Florida Medical Records Retention Laws
- Georgia Medical Records Retention Laws
- Illinois Medical Records Retention Laws
- Louisiana Medical Records Retention Laws
- Kentucky Medical Records Retention Laws
Updates
Corrected the medical records copy-fee table and FAQ to match Ark. Code Ann. 16-46-106 (a $15.00 labor charge, no certification fee, no flat electronic-records fee and no statutory production deadline), narrowed the description of the 42 CFR 424.516(f) seven-year rule to the ordering and certification documentation it actually covers, and replaced the unsupported nursing-home retention and six-year MDS claims with the federal requirements at 42 CFR 483.70(h)(4) and 483.20(d).
Independently fact-checked against the cited primary sources
Governing law re-checked for recent changes
Governing law re-checked for recent changes
Reviewed and approved by an editor
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
Arkansas Code of 1987 Annotated
§ 16-46-106Access to medical records.In force
(a)(1) In contemplation of, preparation for, or use in any legal proceeding, any person who is or has been a patient of a doctor, hospital, ambulance provider, medical healthcare provider, or other medical institution shall be entitled to obtain access, personally or by and through his or her…
Official text (excerpt) · last checked 2020-11-06 · Read the full text in our law library
Cited in 8 court opinions in our collectionLatest citing opinion in our collection: 2017
Opinions citing this section in our collection:
- Holbrook v. Healthport, Inc. (Supreme Court of Arkansas 2014, 432 S.W.3d 593)“…hat providing paper copies of medical records pursuant to Ark. Code Ann. § 16-46-106 constitute[d] a sale of tangible person…”
- Opinion No. (Arkansas Attorney General Reports 2001)“…potential application to forensic psychological records of A.C.A. § 16-46-106 , which provides that patients upon req…”
- ChartOne, Inc. v. Raglon (Supreme Court of Arkansas 2008, 373 Ark. 275)“…constituted a statewide deceptive practice in violation of Ark. Code Ann. § 16-46-106 (Repl. 1999), 1 the Arkan…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 16-114-203Statute of limitations.In forcecited in 3 of our articles
(a) Except as otherwise provided in this section, all actions for medical injury shall be commenced within two (2) years after the cause of action accrues. (b) The date of the accrual of the cause of action shall be the date of the wrongful act complained of and no other time.…
Official text (excerpt) · last checked 2020-11-06 · Read the full text in our law library
Cited in 89 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Adams v. Arthur (Supreme Court of Arkansas 1998, 333 Ark. 53)“…d for medical injury found in the Medical Malpractice Act, Ark. Code Ann. § 16-114-203 (a) (Supp. 1997). The trial court addit…”
- St. Paul Mercury Insurance v. Circuit Court (Supreme Court of Arkansas 2002, 348 Ark. 197)“…date of the wrongful act complained of and no other time." Ark.Code Ann. § 16-114-203 (Supp.2001). The medical malpractice ac…”
- McQuay v. Guntharp (Supreme Court of Arkansas 1998, 331 Ark. 466)“…man Rowe through the two-year statute of limitations. See Ark.Code Ann. § 16-114-203 (Supp.1997). The trial court dismisse…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Arkansas Statute of Limitations: Filing Deadlines by Case Type, Medical Malpractice Laws in Arkansas (2026): Deadlines & Caps
Code of Federal Regulations Title 42
§ 482.24Condition of participation: Medical record services.In forcecited in 52 of our articles
The hospital must have a medical record service that has administrative responsibility for medical records. A medical record must be maintained for every individual evaluated or treated in the hospital. (a) Standard: Organization and staffing. The organization of the medical record service must be appropriate to the scope and complexity of the services performed. The hospital must employ adequate personnel to ensure prompt completion, filing, and retrieval of records. (b) Standard: Form and retention of record. The hospital must maintain a medical record for each inpatient and outpatient. Medical records must be accurately written, promptly completed, properly filed and retained, and accessible. The hospital must use a system of author identification and record maintenance that ensures the integrity of the authentification and protects the security of all record entries. (1) Medical records must be retained in their original or legally reproduced form for a period of at least 5 years. (2) The hospital must have a system of coding and indexing medical records. The system must allow for timely retrieval by diagnosis and procedure, in order to support medical care evaluation studies.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 18 court opinions in our collectionLatest citing opinion in our collection: 2024
In the courts (editorial summary, independently checked):United States ex rel. Janssen v. Lawrence Memorial Hospital (2020) held the accurate medical record duty in 42 C.F.R. 482.24 is a generic regulatory requirement that does not establish False Claims Act materiality. United States Ex Rel. El-Amin v. George Washington University (2008) applied 482.24(c) to record completion evidence.
Opinions citing this section in our collection:
- United States ex rel. Janssen v. Lawrence Memorial Hospital (Court of Appeals for the Tenth Circuit 2020, 949 F.3d 533)✓A relator alleged the hospital falsified patient arrival times to raise its Medicare quality-program payments. The court held the general duty to keep accurate medical records under 42 C.F.R. 482.24 does not address those programs and cannot show False Claims Act materiality.
- United States Ex Rel. El-Amin v. George Washington University (District Court, District of Columbia 2008, 533 F. Supp. 2d 12)✓Nurse anesthetists claimed the hospital billed Medicare as though anesthesiologists performed whole procedures. Citing the 30-day rule in 42 C.F.R. 482.24(c)(2), the court excluded late-signing evidence, and excluded mass-signing evidence too though (c)(1) made it probative.
- NATIONAL ASS'N OF PSYCHIATRIC HEALTH SYSTEM v. Shalala (District Court, District of Columbia 2000, 120 F. Supp. 2d 33)“…to preexisting recordkeeping requirements, as specified in 42 C.F.R. § 482.24 . 7 . Proposed Rul…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: How Long Do Hospitals Keep Medical Records? (2026), How to Find Old Medical Records Online, Medical Records Retention Laws by State (2026 Guide)
§ 424.516Additional provider and supplier requirements for enrolling and maintaining active enrollment status in the Medicare program.In forcecited in 15 of our articles
(a) Certifying compliance. CMS enrolls and maintains an active enrollment status for a provider or supplier when that provider or supplier certifies that it meets, and continues to meet, and CMS verifies that it meets, and continues to meet, all of the following requirements: (1) Compliance with title XVIII of the Act and applicable Medicare regulations. (2) Compliance with Federal and State licensure, certification, and regulatory requirements, as required, based on the type of services or supplies the provider or supplier type will furnish and bill Medicare. (3) Not employing or contracting with individuals or entities that meet either of the following conditions: (i) Excluded from participation in any Federal health care programs, for the provision of items and services covered under the programs, in violation of section 1128A(a)(6) of the Act. (ii) Debarred by the General Services Administration (GSA) from any other Executive Branch procurement or nonprocurement programs or activities, in accordance with the Federal Acquisition and Streamlining Act of 1994, and with the HHS Common Rule at 45 CFR part 76.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 7 court opinions in our collectionLatest citing opinion in our collection: 2024
Opinions citing this section in our collection:
- United States Ex Rel. Westmoreland v. Amgen, Inc. (District Court, D. Massachusetts 2011, 812 F. Supp. 2d 39)“…recon *52 dition of payment can be found in 42 C.F.R. § 424.516 (a)(1), which states that “CMS enrolls…”
- Johnson v. Kelly (District Court, W.D. Oklahoma 2024)“…care laws, regulations, and program instructions. Id. ¶ 22; 42 C.F.R. § 424.516(a). To that end, a healthcare provider…”
- LILIA GOROVITS, M.D., P.C. v. AZAR (District Court, E.D. Pennsylvania 2021)“…2 Pursuant to 42 C.F.R. § 424.516(d)(1)(ii), Medicare physicians are requ…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Louisiana Medical Records Retention Laws (2026 Guide), Mississippi Medical Records Retention Laws (2026 Guide), New York Medical Records Retention Laws (2026 Guide)
Code of Federal Regulations Title 45
§ 164.530Administrative requirements.In forcecited in 40 of our articles
(a)(1) Standard: Personnel designations. (i) A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity. (ii) A covered entity must designate a contact person or office who is responsible for receiving complaints under this section and who is able to provide further information about matters covered by the notice required by § 164.520. (2) Implementation specification: Personnel designations. A covered entity must document the personnel designations in paragraph (a)(1) of this section as required by paragraph (j) of this section. (b)(1) Standard: Training. A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity. (2) Implementation specifications: Training.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 23 court opinions in our collectionLatest citing opinion in our collection: 2025
In the courts (editorial summary, independently checked):Surprise v. Innovation Group, Inc. (2013) applied 45 CFR 164.530(c), noting it requires appropriate safeguards but does not specify what they must be, and rejected a wrongful discharge claim resting on it. Baum v. KEYSTONE MERCY HEALTH PLAN (2011) treated the same duty as background to state tort claims and remanded.
Opinions citing this section in our collection:
- Baum v. KEYSTONE MERCY HEALTH PLAN (District Court, E.D. Pennsylvania 2011, 826 F. Supp. 2d 718)✓A lost flash drive exposed health data on 280,000 insured children, and a parent sued in state court for negligence per se. The court held that resting the claim on the HIPAA safeguard rule at 45 C.F.R. 164.530(c)(2)(i) raised no substantial federal question, and remanded.
- Surprise v. Innovation Group, Inc. (District Court, D. Massachusetts 2013, 925 F. Supp. 2d 134)✓An employee fired after complaining that health-information documents went into unsecured trash sued for wrongful discharge. The court read 45 C.F.R. 164.530(c) to require safeguards without prescribing a method, and held HIPAA disposal rules are not well-defined public policy.
- Michael Terpin v. at and T Mobility LLC (Court of Appeals for the Ninth Circuit 2024, 118 F.4th 1102)“…viders to protect patients’ “protected health information.” 45 C.F.R. § 164.530(c)(1); Moore, 299 Cal. Rptr. 3d at 561.…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Alaska Medical Records Retention Laws (2026 Guide), District of Columbia Medical Records Retention Laws (2026 Guide), Delaware Medical Records Retention Laws (2026 Guide)
§ 164.524Access of individuals to protected health information.In forcecited in 23 of our articles
(a) Standard: Access to protected health information —(1) Right of access. Except as otherwise provided in paragraph (a)(2) or (a)(3) of this section, an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for: (i) Psychotherapy notes; and (ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. (2) Unreviewable grounds for denial. A covered entity may deny an individual access without providing the individual an opportunity for review, in the following circumstances. (i) The protected health information is excepted from the right of access by paragraph (a)(1) of this section.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 88 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):Webb v. Smart Document Solutions, LLC (2007) held the reduced, cost-based fee in section 164.524(c)(4) applies only when the individual himself requests his records, not a law firm acting as his agent. Ciox Health, LLC v. Hargan (2020) vacated 2016 guidance that extended that patient rate to third-party directives.
Opinions citing this section in our collection:
- Webb v. Smart Document Solutions, LLC (Court of Appeals for the Ninth Circuit 2007, 499 F.3d 1078)✓A law firm ordered its client's hospital records and was billed a copying company's higher third-party rate; the Ninth Circuit held Section 164.524(c)(4)'s cost-based fee limit applies only when the individual or a personal representative asks, not an attorney acting as agent.
- Evenson v. Hartford Life & Annuity Insurance (District Court, M.D. Florida 2007, 244 F.R.D. 666)✓A therapist refused a subpoena for her psychotherapy notes, citing Section 164.524(a)(1)'s exclusion of those notes from a patient's right of access; the court held that exclusion governs only individual access, not discovery, and ordered the notes produced.
- Ciox Health, LLC v. Hargan (District Court, District of Columbia 2020)“…fee that can be charged for such production. See generally 45 C.F.R. § 164.524. For requests brought by an individual…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Medical Records Retention Laws by State (2026 Guide), Kentucky Medical Records Retention Laws (2026 Guide), North Carolina Medical Records Retention Laws (2026 Guide)
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- Arkansas State Board of Health Rules for Hospitals and Related Institutions(healthy.arkansas.gov).gov
- Ark. Code Ann. 16-46-106 - Access to Medical Records(law.justia.com)
- Ark. Code Ann. 16-114-203 - Statute of Limitations for Medical Malpractice(law.justia.com)
- HHS - Does HIPAA Require Keeping Medical Records?(hhs.gov).gov
- 45 CFR 164.530 - HIPAA Administrative Requirements(ecfr.gov).gov
- 45 CFR 164.524 - Individual Right of Access to PHI(ecfr.gov).gov
- 42 CFR 482.24 - CMS Conditions of Participation: Medical Record Services(ecfr.gov).gov
- CMS Medical Record Maintenance and Access Requirements(cms.gov).gov
- HHS - Individuals Right to Access Health Information(hhs.gov).gov
- HHS - Disposal of Protected Health Information(hhs.gov).gov
- Arkansas Medical Society FAQs(arkmed.org)
- Arkansas State Medical Board FAQs(armedicalboard.org)
- Arkansas Office of Long Term Care(humanservices.arkansas.gov).gov
- 42 CFR 424.516 - Additional provider and supplier requirements for enrolling and maintaining active enrollment status in the Medicare program(ecfr.gov)
- 42 CFR 483.70 - Long Term Care Facilities: Administration (medical record retention)(ecfr.gov)
- 42 CFR 483.20 - Long Term Care Facilities: Resident Assessment(ecfr.gov)