District of Columbia Medical Records Retention Laws (2026 Guide)

District of Columbia medical records retention laws establish specific timeframes that healthcare providers must follow when storing patient health information. Whether you are a physician, hospital administrator, or patient seeking access to your records, understanding these requirements is essential.

DC has two layers of medical records retention rules. The primary statute, D.C. Code 3-1210.11, applies to all licensed healthcare providers. A separate and stricter set of regulations under DCMR Title 22-B, Section 2030 governs hospitals specifically. Federal requirements under HIPAA and CMS add additional layers that DC providers must follow when they create longer obligations.

Last verified: March 2026. This page reflects current D.C. Code 3-1210.11, as amended by D.C. Law 24-290 (effective March 10, 2023), and DCMR Title 22-B, Section 2030.

Table of Contents

• General Retention Requirements Under D.C. Code 3-1210.11
• Hospital-Specific Requirements Under DCMR Title 22-B
• Retention Rules for Minor Patients
• Hospital vs. Physician Office Requirements
• Federal Requirements That Apply in DC
• HIPAA Documentation Requirements
• CMS and Medicare Requirements
• Patient Access to Medical Records in DC
• Fees for Medical Record Copies
• Proper Destruction of Medical Records
• What Happens When a Practice Closes in DC
• Penalties for Non-Compliance
• Frequently Asked Questions
• Sources and References

General Retention Requirements Under D.C. Code 3-1210.11

The primary medical records retention law in the District of Columbia is found in D.C. Code 3-1210.11. This statute was originally enacted as part of the District of Columbia Health Occupations Revision Act of 1985 (D.C. Law 6-99, effective March 25, 1986). It was most recently amended by D.C. Law 24-290, the Personal Medical Record Fee Amendment Act of 2022, which took effect on March 10, 2023.

Under this statute, medical records must be maintained for a minimum of 5 years from the date of last contact with an adult patient.

The law applies broadly to all "health care entities," which the statute defines as any health care provider or business associate as defined in 45 CFR 160.103. This includes physicians, dentists, psychologists, nurses, chiropractors, and all other licensed health professionals practicing in the District.

The 5-year period begins running from the date of the patient's last contact with the provider, not from the date of initial treatment or any specific medical event. If a patient returns for a follow-up visit, the clock resets.

What Records Must Be Retained

The statute does not limit its scope to a narrow category of documents. "Medical records" under DC law encompasses the complete patient chart, including:

• Medical history and physical examination notes
• Diagnostic test results and lab reports
• Treatment plans and progress notes
• Medication records and prescription histories
• Surgical reports and anesthesia records
• Consultation reports from specialists
• Imaging studies and their interpretations
• Consent forms and authorization documents
• Discharge summaries

Hospital-Specific Requirements Under DCMR Title 22-B

Hospitals licensed in the District of Columbia are subject to stricter retention requirements under the District of Columbia Municipal Regulations (DCMR) Title 22-B, Section 2030. These regulations apply specifically to hospitals and set a longer retention period than the general statute.

Under DCMR 22-B2030, hospitals must maintain patient medical records for at least 10 years following discharge. This is double the 5-year requirement that applies to physician offices and other non-hospital providers.

Hospital Record Format Requirements

Hospitals may maintain medical records in any of the following formats:

• Original paper records
• Microfilm
• Electronic health records (EHR)
• Other similar reproducible forms

Regardless of format, the hospital must ensure that a complete record is accessible at all times. Records must contain sufficient information to clearly identify the patient, justify the diagnosis and treatment, and document the results accurately.

Completion Deadlines

DC regulations require hospitals to monitor and ensure that medical records are completed within 30 days of patient discharge. All entries in the record must be dated, legible, and indelibly verified. The author of each entry must be identified and authenticated through a signature, written initials, or computer entry.

Hospital Record Destruction Standards

When hospital records have exceeded the 10-year retention period and are eligible for destruction, DCMR 22-B2030 requires that they be destroyed using one of the following methods:

• Shredding
• Incineration
• Electronic deletion
• Another equally effective protective measure

These destruction requirements exist to protect patient confidentiality and align with federal HIPAA disposal standards.

Retention Rules for Minor Patients

Both layers of DC medical records law include extended retention periods for minors.

Under D.C. Code 3-1210.11

For minor patients, medical records must be maintained for a minimum of 5 years after the minor reaches the age of majority. Under D.C. Code 46-101, the age of majority in the District of Columbia is 18 years old, as established by the District of Columbia Age of Majority Act (D.C. Law 1-75, effective 1976).

This means that for a child born today, a physician's office must keep their records until the patient turns 23 at minimum. For a child who receives treatment at age 5, the records must still be kept until age 23 (5 years after turning 18).

Under DCMR 22-B2030 (Hospitals)

Hospitals face a different rule for minors. Under the hospital regulations, records of minor patients must be kept until 3 years after the age of majority has been attained. Since the age of majority in DC is 18, this means hospital records for minors must be retained until the patient turns 21.

This creates an unusual situation where the general physician office requirement for minors (5 years after majority, or age 23) is actually longer than the hospital-specific requirement for minors (3 years after majority, or age 21), even though hospital adult retention (10 years) is longer than physician adult retention (5 years).

Summary of Minor Retention Periods

Provider Type	Retention Period for Minors	Effective Minimum Age
Physicians and other providers	5 years after age 18	Age 23
Hospitals	3 years after age 18	Age 21

In practice, hospitals typically apply the longer of the two periods (age 23) to remain in compliance with both sets of rules. Providers should consult with legal counsel when there is any uncertainty about which standard applies.

Hospital vs. Physician Office Requirements

The District of Columbia maintains separate retention standards for hospitals and non-hospital healthcare providers. This distinction matters because it determines how long your records will be available depending on where you received care.

Requirement	Hospitals (DCMR 22-B2030)	Physicians/Other Providers (D.C. Code 3-1210.11)
Adult retention period	10 years after discharge	5 years from last contact
Minor retention period	Until age 21 (3 yrs after majority)	Until age 23 (5 yrs after majority)
Record format	Paper, microfilm, electronic, or similar	Not specified by statute
Completion deadline	30 days after discharge	Not specified by statute
Destruction method	Shredding, incineration, electronic deletion	Not specified (HIPAA standards apply)

The 10-year hospital requirement is consistent with many other jurisdictions. According to the CMS Medical Record Maintenance guidelines, hospitals participating in Medicare must maintain records for at least 5 years after discharge, so DC's 10-year rule exceeds this federal minimum.

Federal Requirements That Apply in DC

DC healthcare providers must comply with both local and federal record retention requirements. When federal law requires a longer retention period than DC law, the federal standard controls.

The General Rule

The stricter requirement always applies. If DC law requires 5 years and federal law requires 7 years for a Medicare provider, the provider must retain records for 7 years. This principle applies across all overlapping federal and local mandates.

HIPAA Documentation Requirements

One of the most common misconceptions about medical records retention is that HIPAA requires providers to keep patient medical records for a specific number of years. It does not.

What HIPAA Actually Requires

HIPAA requires covered entities to retain HIPAA-related administrative documentation for 6 years from the date of creation or the date when it last was in effect, whichever is later. This requirement comes from 45 CFR 164.530(j).

The types of documentation subject to this 6-year requirement include:

• Privacy policies and procedures
• Patient authorization forms for disclosures
• Business associate agreements
• Staff training records
• Complaint logs and resolution records
• Risk assessments and security documentation
• Notice of Privacy Practices acknowledgments

These are compliance documents, not patient medical charts. The actual retention period for patient records is governed by state law, which in DC means D.C. Code 3-1210.11 and DCMR 22-B2030.

HIPAA and Record Security

While HIPAA does not set a medical records retention period, it does require that all protected health information (PHI) be safeguarded for as long as it exists. Under the HIPAA Security Rule, covered entities must implement administrative, physical, and technical safeguards to protect electronic PHI. This applies from the moment a record is created until it is properly destroyed.

CMS and Medicare Requirements

Healthcare providers in DC who participate in Medicare or Medicaid programs must meet additional federal retention requirements set by the Centers for Medicare and Medicaid Services (CMS).

Provider Type	CMS Minimum Retention	Regulatory Authority
Hospitals (Medicare)	5 years after discharge	42 CFR 482.24
Medicare fee-for-service providers	6 years from creation or last effective date	HIPAA administrative requirements
Medicare providers (general)	7 years from date of service	CMS guidelines
Medicare Part D sponsors	10 years from date of service	CMS guidelines
Medicare managed care providers	10 years	CMS guidelines

For DC hospitals, the local 10-year requirement under DCMR 22-B2030 already exceeds the 5-year federal minimum for Medicare-participating hospitals. For physician offices, however, the DC 5-year requirement may be shorter than the 7-year CMS guideline for general Medicare providers. In that case, a Medicare-participating physician in DC should follow the 7-year federal standard.

OSHA Employee Health Records

Providers who maintain occupational health records must follow an even longer standard. Under 29 CFR 1910.1020, employee exposure and medical records must be retained for the duration of employment plus 30 years.

Patient Access to Medical Records in DC

The District of Columbia provides strong protections for patients who need to access their medical records.

Right to Request Records

Under D.C. Code 3-1210.11, a healthcare entity that has custody and control of a patient's personal medical record must furnish a complete and current copy upon written request from the patient or their authorized representative.

Authorized representatives include individuals with a valid health care power of attorney for the patient. If the patient is deceased, records may be requested by the executor or administrator of the estate, survivors of the decedent, or other persons who were involved in the decedent's health care or payment before death.

However, access may be denied for a deceased patient if it would be inconsistent with any expressed preference of the decedent that was known to the healthcare entity.

Response Time

Under D.C. Code 3-1210.12, healthcare entities must transmit complete medical records within 30 days when the authorization is clear, conspicuous, and specific. If records cannot be produced within 30 days, the entity must provide a written explanation of the delay.

The absolute outside limit is 60 days. If a provider fails to produce records within 60 days, the patient receives a fee reduction of $15 per day, capped at the total copying charge amount.

Format of Records

Records must be provided in the format requested by the patient if readily producible. If the requested format is not readily producible, records must be provided in a readable electronic form and format, either by email or by uploading.

Fees for Medical Record Copies

D.C. Law 24-290 (the Personal Medical Record Fee Amendment Act of 2022) established specific fee caps for medical record copies in the District of Columbia, effective March 10, 2023.

Electronic Format Fees

Fee Type	Maximum Amount
Search and handling	$22.88
Per-page charge	$0.66
Total cap	$86.54

Non-Electronic (Paper) Format Fees

Fee Type	Maximum Amount
Search and handling	$22.88
Per-page charge	$0.88
Postage	Actual cost

These are the only fees that a healthcare entity may charge for providing medical record copies. Providers may not charge different rates based on who is requesting the records. An authorized representative under a health care power of attorney must be charged the same rate as the patient.

Annual Fee Adjustments

Starting January 1, 2024, the fee amounts are adjusted annually for inflation using the Consumer Price Index. The DC Department of Health publishes updated fee schedules by February 1 of each year.

Proper Destruction of Medical Records

Once medical records have exceeded the applicable retention period, they may be destroyed. However, both DC and federal law impose strict requirements on how destruction must be carried out.

DC Hospital Destruction Requirements

Under DCMR 22-B2030, hospitals must destroy medical records using one of the following approved methods:

• Shredding of paper documents
• Incineration of paper records
• Electronic deletion using methods that prevent data recovery
• Another equally effective protective measure that renders information unreadable

HIPAA Disposal Standards

HIPAA requires that protected health information be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed" when destroyed.

For paper records, acceptable methods include shredding, burning, pulping, or pulverizing. For electronic media, acceptable methods include clearing (overwriting with non-sensitive data), purging or degaussing (using a strong magnetic field), or physical destruction of the storage media.

Records may never be placed in dumpsters, recycling bins, or other publicly accessible containers. A covered entity may hire a business associate to handle disposal, but a business associate agreement must be in place.

Documentation of Destruction

Providers should maintain a destruction log that records the date of destruction, a general description of the records destroyed, the method of destruction, and the name of the person who carried out or supervised the destruction. This log should be retained as part of the provider's HIPAA administrative documentation for at least 6 years.

What Happens When a Practice Closes in DC

When a physician in the District of Columbia retires, relocates, or otherwise closes a practice, medical records must still be preserved for the full retention period. DC does not have a specific statute governing practice closure notification, but providers must comply with general record retention obligations and professional standards.

Recommended Steps for Practice Closure

The DC Board of Medicine oversees physician licensing in the District. Physicians planning to close their practice should follow these steps:

1. Notify patients in writing at least 30 to 60 days before closure
2. Offer patients the option to transfer their records to another provider
3. Provide patients with copies of their records upon request
4. Notify the DC Board of Medicine about the practice closure
5. Arrange for a custodian to maintain records for the remaining retention period
6. Destroy records properly once the retention period has expired, using HIPAA-compliant methods

Custodian Arrangements

If a physician cannot personally maintain records after closing a practice, a custodian arrangement should be established. This may involve transferring records to another physician, a medical records storage company, or a professional records management service. Any custodian who receives protected health information must enter into a HIPAA business associate agreement.

Selling a Practice

When a medical practice is sold, patient records typically transfer to the purchasing provider. The purchasing provider then assumes responsibility for maintaining the records for the remaining retention period. Patients should be notified of the ownership change and given the opportunity to transfer their records elsewhere if they prefer.

Penalties for Non-Compliance

Healthcare providers who fail to comply with DC medical records retention laws may face disciplinary action from the relevant licensing board. Violations can result in license suspension, revocation, or other sanctions.

DC Licensing Board Actions

The DC Health Occupations Boards have authority to investigate complaints and impose discipline on licensed providers. Failure to maintain adequate medical records or to provide patient access to records may be treated as unprofessional conduct.

HIPAA Penalties

Federal penalties for HIPAA violations, including improper destruction or failure to safeguard medical records, are tiered based on the level of negligence:

Violation Level	Penalty Range Per Violation
Did not know	$141 to $35,581
Reasonable cause	$1,424 to $71,162
Willful neglect (corrected)	$14,232 to $71,162
Willful neglect (not corrected)	$71,162 to $2,134,831

Criminal penalties for knowing violations can reach up to $250,000 in fines and 10 years of imprisonment.

Sources and References

• D.C. Code 3-1210.11: Patient or Client Records
• D.C. Code 3-1210.12: Persons Authorized to Receive Personal Medical Records
• D.C. Law 24-290: Personal Medical Record Fee Amendment Act of 2022
• D.C. Code 46-101: Age of Majority
• DCMR Title 22-B, Section 2030: Hospital Record Keeping Requirements
• HHS: Does HIPAA Require Covered Entities to Keep Medical Records?
• 45 CFR 164.530: HIPAA Administrative Requirements
• CMS: Medical Record Maintenance and Access Requirements
• HHS: HIPAA Privacy Rule Summary
• HHS: Disposal of Protected Health Information
• DC Board of Medicine
• DC Health Licensing Boards