Florida Medical Records Retention Laws (2026 Guide)

Florida physicians must retain medical records for at least 5 years from the date of last patient contact under Fla. Admin. Code R. 64B8-10.002. Providers who participate in Medicare must keep records for 7 years from the date of service, and the stricter requirement always applies.

Florida law creates a layered system for medical records retention. Different rules apply depending on whether the provider is a hospital, a physician in private practice, a nursing home, a home health agency, or a hospice. Federal rules under Medicare add another layer on top of the state requirements.

This guide breaks down every applicable statute, regulation, and federal rule so you know exactly how long your records must be kept and what rights you have as a patient.

Physician Records: 5 Years From Last Contact

The most commonly cited retention rule in Florida comes from the Florida Board of Medicine. Under Florida Administrative Code Rule 64B8-10.002, a licensed physician must maintain "the full and total responsibility for and control of all files and records relating to his patients and his medical practice for a period of at least five years from the last patient contact."

This is the baseline. The five-year clock starts from the date of the last patient contact, not from the date the record was created.

What "Last Patient Contact" Means

The phrase "last patient contact" refers to the most recent instance when the physician provided care to or communicated with the patient about their treatment. This could be an office visit, a phone consultation, a prescription refill, or any documented interaction related to the patient's care.

If a patient sees a physician in January 2024 and never returns, the five-year retention period runs until January 2029. If that same patient returns for a follow-up in June 2025, the clock resets and the records must be kept until at least June 2030.

The 5-Year Minimum Is a Floor, Not a Ceiling

The Board of Medicine itself warns that the five-year minimum "may well be less than the length of time necessary for protecting the physician." The rule explicitly states that physicians should consider community standards for retention, specific patient needs, and the advice of legal counsel or malpractice insurance carriers when deciding how long to keep records.

Many malpractice insurers and legal advisors in Florida recommend keeping records for at least seven years because of the medical malpractice statute of limitations.

Hospital Records: A Different Framework

Florida Statute § 395.3025 governs patient records at licensed facilities including hospitals and ambulatory surgical centers. It is an access and confidentiality statute, not a retention statute. The section never uses the words "retain" or "retention" and sets no minimum number of years, so it cannot be read as the source of any hospital retention duty.

What § 395.3025 Actually Requires

The statute requires licensed facilities to:

• Furnish copies of all patient records, including X-rays and insurance information, upon written request after discharge
• Provide records "in a timely manner, without delays for legal review"
• Maintain patient record confidentiality
• Allow patients to examine original records under reasonable terms

Medicare Conditions of Participation

Most Florida hospitals participate in Medicare. Under 42 CFR 482.24, Medicare-participating hospitals must retain medical records for at least 5 years after the date of discharge. This federal regulation effectively sets the minimum for the vast majority of Florida hospitals.

For general Medicare providers (including hospitals), CMS guidelines require records to be maintained for 7 years from the date of service under 42 CFR 424.516(f). Since 7 years is longer than 5 years, the 7-year standard is the one most hospitals follow in practice.

Florida Statutes That Set an Actual Retention Period

Most Florida retention duties come from board rules and federal Medicare participation requirements rather than from the statute books. Only a short list of statutes fixes a retention duration directly, and it is worth knowing which ones do.

• Fla. Stat. § 400.491 requires a home health agency to maintain the clinical record of each patient who receives skilled care "for 6 years following termination of services," and to maintain the service provision plan for each nonskilled-care client for 3 years following termination of services.
• Fla. Stat. § 400.611 requires hospice patient records to be retained for 6 years after termination of hospice services, unless otherwise provided by law.
• Fla. Stat. § 456.058 directs every health care licensing board to adopt rules for the disposition of a practitioner's records, and commands that those rules "provide that the records be retained for at least 2 years after the practitioner's death, termination of practice, or relocation." The 2-year figure in the Board of Medicine rules is therefore a statutory minimum, not a rule the board chose on its own.

Home health agencies in particular should note that the 6-year skilled-care period is a state statutory duty that runs from the termination of services, which can be longer than the 7-year-from-date-of-service Medicare standard for a course of care that lasted several years.

Records for Minor Patients

Florida's only express retention extension for minor patients appears in the hospice statute. Under Fla. Stat. § 400.611, for a patient who is a minor, the 6-year period "shall begin on the date the patient reaches or would have reached the age of majority."

In Florida, the age of majority is 18. For a minor hospice patient, the retention clock does not start ticking until the patient turns 18.

Practical Example

A child who receives hospice services at age 5 has records that must be kept until the child turns 24 (age 18 plus the statute's 6 years).

That tolling clause is written into the hospice statute alone. No Florida statute and no Board of Medicine rule tolls the 5-year physician period for minors, so a physician's five-year clock still runs from the last patient contact regardless of the patient's age. Many providers and malpractice carriers recommend holding pediatric records well past the age of majority because of the extended exposure described below, but that is a risk-management practice, not a legal entitlement a patient can rely on.

Why the Malpractice Statute of Limitations Matters for Minors

Under Fla. Stat. § 95.11, medical malpractice actions must generally be filed within 2 years of discovery, with an absolute outer limit of 4 years from the incident (7 years if fraud or concealment is involved). However, these outer limits do not bar an action brought on behalf of a minor "on or before the child's eighth birthday."

This means a child injured at age 2 could potentially have a claim filed until age 8, well beyond the normal 4-year window. Providers treating minor patients should factor this extended exposure into their retention decisions.

HIPAA and Medical Records Retention

One of the most widespread misconceptions in healthcare is that HIPAA requires providers to keep medical records for a specific number of years. It does not.

What HIPAA Actually Requires

According to the U.S. Department of Health and Human Services, "the HIPAA Privacy Rule does not include medical record retention requirements." State laws control how long patient medical records must be kept.

What HIPAA does require is that covered entities retain HIPAA-related administrative documentation for 6 years from the date of creation or last effective date. This includes:

• Privacy policies and procedures
• Privacy practices notices
• Complaint records and disposition
• Training documentation
• Business associate agreements

This 6-year rule applies to compliance paperwork, not to patient charts or clinical records.

HIPAA's Role in Record Security

While HIPAA does not dictate retention periods, it does govern how records are stored and protected for as long as they exist. All protected health information (PHI) must be safeguarded against unauthorized access, whether in paper or electronic form, throughout the entire retention period and during the destruction process.

CMS and Medicare Requirements

Federal Medicare requirements create a second layer of retention obligations for any Florida provider that participates in Medicare or Medicaid.

Standard Medicare Retention

CMS requires all Medicare providers to maintain medical records for 7 years from the date of service. This applies to physicians, non-physician practitioners, hospitals, and other suppliers as specified in 42 CFR 424.516(f).

Providers who fail to produce documentation when requested may face revocation of their Medicare enrollment under 42 CFR 424.535(a)(10).

Medicare Part D

Medicare Part D sponsors have an even longer requirement. Federal regulation mandates 10 years of records retention for Part D programs. If a Part D sponsor is discontinued, merged, or acquired, the gaining sponsor must provide access to the prior contract's documents for the full 10-year period.

Which Rule Wins?

The stricter requirement always applies. A Florida physician who participates in Medicare must keep records for at least 7 years (the Medicare standard), even though the state Board of Medicine only requires 5 years. The state minimum serves as the floor, but federal participation agreements often push the effective minimum higher.

Patient Access Rights in Florida

Florida law gives patients robust rights to access their medical records through several overlapping statutes.

Hospital Records (§ 395.3025)

Under Fla. Stat. § 395.3025, hospitals and ambulatory surgical centers must provide patients with copies of all records, including X-rays and insurance information, upon written request after discharge. The statute requires that records be provided "in a timely manner, without delays for legal review."

Patients also have the right to examine original records, including microforms, under reasonable terms set by the facility.

Physician Records (§ 456.057)

Under Fla. Stat. § 456.057, health care practitioners must furnish copies of all reports and records relating to examination or treatment upon patient request. This includes X-rays and insurance information.

For psychiatric and psychological records, practitioners may provide an examination report instead of complete records, though patients can request that full records be sent directly to a subsequent treating psychiatrist.

Nursing Home Records (§ 400.145)

Under Fla. Stat. § 400.145, nursing homes must provide copies within 14 working days for current residents and 30 working days for former residents. Records of deceased residents may be requested by court-appointed estate representatives, persons designated in a self-proved will, or surviving spouses, children, or parents.

HIPAA Right of Access

Under the federal HIPAA Privacy Rule, patients have the right to access their medical records within 30 days of a written request. Providers may extend this by an additional 30 days with written notice. Electronic copies must be provided if the records are maintained electronically and the patient requests an electronic format.

Copy Fees in Florida

Florida law sets specific caps on what providers can charge for copies of medical records.

Hospital Copy Fees

Under Fla. Stat. § 395.3025, the maximum charges for hospital record copies are:

There is one important exception: a patient whose records are copied or searched for the purpose of continuing to receive medical care cannot be charged any copying or search fees.

Physician Copy Fees

Under Florida Administrative Code Rule 64B8-10.003, the maximum charges for physician office record copies are:

Nursing Home Copy Fees

Under Fla. Stat. § 400.145, the fee structure mirrors the physician schedule: $1.00 per page for the first 25 pages and $0.25 per page for each additional page. Residents may also choose to examine original records at the facility instead of requesting copies.

HIPAA Fee Limits

Under HIPAA, providers may charge a reasonable, cost-based fee for copies. HHS has established a flat fee option of $6.50 for electronic copies of records maintained electronically, regardless of the number of pages. Florida's state fee caps apply to paper records, while the HIPAA limit typically governs electronic copy requests.

Record Destruction Requirements

When the retention period has passed and a provider decides to destroy records, both state and federal rules govern the process.

Physician Record Destruction

The 2-year minimum that applies after a physician dies is set by statute. Fla. Stat. § 456.058 requires each licensing board to provide by rule for the disposition of a practitioner's records and specifies that those rules "provide that the records be retained for at least 2 years after the practitioner's death, termination of practice, or relocation."

The Board of Medicine implements that command in Florida Administrative Code Rule 64B8-10.001. When a physician dies, the executor or representative must retain patient records for at least 2 years from the date of death. Within one month of death, they must publish notices in local newspapers indicating where records are available. After 22 months, they must publish notices for four consecutive weeks announcing that records will be destroyed one month later.

For physicians who are closing or relocating their practice, Rule 64B8-10.002 requires:

• Publishing notice once weekly for four consecutive weeks in newspapers of greatest circulation in the counties where they practiced
• Including the termination date and the address where records may be obtained
• Submitting a copy of the notice to the Board of Medicine within one month

HIPAA Destruction Standards

Under the HIPAA Privacy Rule, covered entities must implement reasonable safeguards when disposing of protected health information. Acceptable methods include:

• Paper records: Shredding, burning, or pulping so that PHI is rendered unreadable, indecipherable, and unable to be reconstructed
• Electronic media: Clearing, purging, or destroying the media so that PHI cannot be retrieved
• Third-party disposal: Providers may hire business associates to handle destruction, but must have a business associate agreement in place

Records may never be placed in dumpsters, recycling bins, or other receptacles accessible to the public or unauthorized persons without first being properly destroyed.

Practice Closure and Relocating Physicians

When a Florida physician closes a practice, relocates, or retires, Fla. Stat. § 456.057 and § 456.058 impose specific obligations. Section 456.058 is both the notification framework and the source of the 2-year retention floor that applies after a practitioner dies, terminates practice, or relocates.

Required Steps

1. Notify patients: Place an advertisement in a local newspaper or send written notice to patients, informing them of the closure and offering the opportunity to obtain copies of their records
2. Notify the Board: Contact the appropriate board office, specifying who the new records owner is and where medical records can be found
3. Transfer records responsibly: When records are transferred to a new owner, that new owner assumes full responsibility for providing copies upon written request
4. Maintain the applicable minimums: The 5-year period from last patient contact still applies during closure, and Fla. Stat. § 456.058 sets a floor of at least 2 years after the termination of practice or relocation

Deceased Physician Records

Under Fla. Stat. § 456.058 and its implementing rule, Rule 64B8-10.001, when a physician dies, the executor or personal representative must:

• Retain records for at least 2 years from the date of death, the statutory minimum commanded by § 456.058
• Publish newspaper notices within one month of death
• Publish destruction notices for four consecutive weeks beginning at 22 months after death
• Allow records to be destroyed no sooner than one month after the final destruction notice

If a practitioner becomes incapacitated or abandons their practice, the appropriate board may appoint a custodian for the records under Fla. Stat. § 456.057(20).

Electronic Health Records in Florida

Florida addresses electronic health records under Fla. Stat. § 408.051. The statute defines an "electronic health record" as a record of medical treatment created by a licensed health care provider and stored in an interoperable and accessible digital format.

Key Requirements for EHR

• All patient information stored in offsite physical or virtual environments (including cloud computing services) must be physically maintained in the continental United States
• Providers must comply with HIPAA Security Rule requirements in addition to state law
• Electronic records are subject to the same retention periods as paper records
• Providers may accept authorization forms in electronic or paper format, or both

Digital Scanning and Copy Fees

Under Fla. Stat. § 456.057, practitioners who make records available for digital scanning may charge "no more than the actual cost of copying, including reasonable staff time," or the amount specified in administrative rules by the appropriate board.

Frequently Asked Questions

How long must a Florida doctor keep my medical records?

Florida physicians must keep your medical records for at least 5 years from your last patient contact under Florida Administrative Code Rule 64B8-10.002. If the physician participates in Medicare, federal rules require records to be kept for 7 years from the date of service. The longer period always applies, so most physicians in practice keep records for 7 years or more.

Does Florida have a different retention period for hospital records?

Fla. Stat. § 395.3025 is an access and confidentiality statute and does not specify a retention period for hospital records. Medicare-participating hospitals must retain records for at least 5 years after discharge under 42 CFR 482.24, and CMS guidelines require 7 years from date of service for general Medicare providers. Most Florida hospitals follow the 7-year standard.

How long are records kept for children in Florida?

It depends on the provider. For hospice providers, Fla. Stat. § 400.611 provides that the 6-year retention period for a minor patient does not begin until the patient reaches or would have reached age 18, so a child who received hospice services at age 5 would have records kept until age 24. That tolling clause is limited to hospice records. No Florida statute or Board of Medicine rule extends the 5-year physician period for minors, so keeping a pediatric chart past the age of majority is a risk-management practice many providers follow rather than something the law guarantees a patient.

How long must a Florida home health agency keep my records?

Under Fla. Stat. § 400.491, a home health agency must keep the clinical record of a patient who received skilled care for 6 years following termination of services. For clients who received nonskilled care, the service provision plan must be kept for 3 years following termination of services.

Can a Florida provider charge me for copies of my records?

Yes, but fees are capped by law. Hospitals may charge up to $1 per page under § 395.3025. Physician offices may charge $1 per page for the first 25 pages and $0.25 per page after that under Rule 64B8-10.003. However, if you need copies for continuing medical care, the hospital cannot charge you anything.

What happens to my records if my doctor retires or dies?

If your doctor retires or closes their practice, Fla. Stat. § 456.057 requires them to notify you by advertisement or direct written notice and offer you the opportunity to obtain copies. Fla. Stat. § 456.058 requires that records be retained for at least 2 years after a practitioner's death, termination of practice, or relocation, and the Board of Medicine implements that floor in Rule 64B8-10.001, which also requires the estate to publish newspaper notices so patients can retrieve their records before destruction.