Georgia Medical Records Retention Laws (2026 Guide)

Georgia requires physicians to retain patient medical records for at least 10 years from the date each record was created, under O.C.G.A. Section 31-33-2, which does not carve out a separate rule for minor patients. Hospitals must retain records for at least 5 years after discharge.

Overview of Georgia Medical Records Retention Laws

Georgia law establishes specific timeframes that healthcare providers must follow when retaining patient medical records. The primary state statute governing this area is O.C.G.A. Section 31-33-2, which falls under Title 31, Chapter 33 of the Georgia Code, titled "Health Records."

These retention requirements exist to protect patient rights, support continuity of care, and preserve records for potential legal proceedings. Georgia's framework applies differently depending on the type of healthcare provider and the age of the patient at the time of treatment.

Understanding these rules is essential for physicians, hospitals, clinics, and patients who may need access to past medical documentation.

Physician Medical Records Retention in Georgia

Under O.C.G.A. Section 31-33-2, any provider who has custody and control of a patient's evaluation, diagnosis, prognosis, laboratory report, or biopsy slide must retain that item for a minimum of 10 years from the date it was created.

This 10-year requirement applies broadly to physicians and other individual healthcare providers licensed to practice in Georgia. The law covers all clinical documentation that forms part of the patient's medical record, including diagnostic imaging reports, pathology slides, treatment notes, and specialist consultations.

What Records Are Covered

The statute specifically identifies these categories of records that must be retained:

• Evaluations and assessments
• Diagnoses and clinical impressions
• Prognoses and treatment plans
• Laboratory reports and test results
• Biopsy slides and pathology specimens

The 10-year clock starts from the date each individual item was created, not from the patient's last visit or discharge date. This distinction matters because a patient's chart may contain records spanning many years of care, each with its own retention deadline.

Records of Minor Patients

Georgia recognizes 18 as the age of legal majority under O.C.G.A. Section 39-1-1. O.C.G.A. Section 31-33-2's text does not set out a separate retention period for minor patients: the same 10-year-from-creation rule applies regardless of the patient's age at the time of treatment.

This means records for a child treated at age 10 are subject to the same 10-year clock as any other patient's records, running from the date each item was created, not from the date the child turns 18.

Hospital Medical Records Retention in Georgia

Georgia hospitals operate under a different retention framework than individual physicians. Under O.C.G.A. Section 31-33-2, hospitals defined as institutions under O.C.G.A. Section 31-7-1 are specifically exempt from the 10-year physician retention requirement. Instead, hospitals must follow the rules and regulations issued under O.C.G.A. Section 31-7-2.

The Five-Year Hospital Rule

Ga. Comp. R. & Regs. R. 111-8-40-.18 establishes that hospitals must retain all patient medical records for at least 5 years from the date of the patient's discharge.

Georgia's hospital regulations separately address minor patients: hospital records for a minor must be kept for at least 5 years after the patient turns 18 under Rule 111-8-40-.18.

Hospital Record Format Requirements

Georgia regulations give hospitals flexibility in how they store medical records. Under Rule 111-8-40-.18, records may be preserved in the hospital's format of choice, including paper or electronic formats, as long as the records are:

• Readable and accessible to authorized personnel
• Capable of being reproduced in paper format upon request
• Secured to provide protection from damage or unauthorized access

Hospital Record Completion Deadlines

Georgia regulations require that hospital patient records be completed within 30 days after the patient is discharged. This requirement ensures that documentation is finalized while clinical details remain fresh and accurate.

Comparing Physician vs. Hospital Retention Periods

Georgia maintains different retention standards depending on the type of provider. The following table summarizes the key differences.

It is important to note that these are minimum retention periods. Many providers choose to retain records longer than required to reduce liability risk and support continuity of care.

Federal Requirements: HIPAA and CMS

Georgia's state retention laws do not operate in isolation. Federal regulations from HIPAA and the Centers for Medicare and Medicaid Services (CMS) add additional layers of compliance.

HIPAA Record Retention

Contrary to common misconception, HIPAA does not require covered entities to retain medical records for any specific period. The U.S. Department of Health and Human Services has clarified that HIPAA defers to state law on medical records retention.

However, HIPAA does require covered entities to retain HIPAA-related documentation for a minimum of 6 years. This includes:

• Privacy policies and procedures
• Privacy practices notices
• Complaint disposition records
• Training records
• Business associate agreements
• Risk assessments and security documentation

While medical records themselves are not subject to HIPAA retention mandates, HIPAA does require that covered entities apply appropriate administrative, technical, and physical safeguards to protect patient records for as long as those records are maintained.

CMS and Medicare Requirements

Healthcare providers that participate in Medicare must follow additional retention rules established by CMS.

Under 42 CFR Section 482.24, hospitals participating in Medicare must retain medical records in their original or legally reproduced form for at least 5 years. This aligns with Georgia's hospital retention requirement.

For physicians and suppliers participating in Medicare, 42 CFR Section 424.516(f) requires maintenance of medical records for 7 years from the date of service. This exceeds the general 5-year hospital requirement but falls within Georgia's 10-year physician retention period.

Georgia providers participating in Medicare should follow the longer of the state or federal requirement for each record type to ensure full compliance.

Patient Access Rights in Georgia

Georgia law gives patients substantial rights to access their own medical records. Under O.C.G.A. Section 31-33-2, patients or their authorized representatives may request copies of their medical records.

Who Can Request Records

The statute authorizes the following individuals to request medical records:

• The patient
• A person authorized under an advance directive for health care
• A person holding durable power of attorney for health care
• Another provider designated by the patient
• Any other person designated by the patient in writing
• Persons authorized by statute to request patient records (such as certain government agencies)

Response Timeline

Providers must furnish requested records within 30 days of receiving the request. This applies regardless of whether the request comes from the patient, another provider, or an authorized third party.

Copying Fees

Under O.C.G.A. Section 31-33-3 and the fee schedule maintained by the Georgia Department of Community Health, providers may charge patients for copies of their records. Effective July 1, 2026, the fee schedule allows:

These rates are adjusted annually based on the medical component of the Consumer Price Index (CPI).

When patients request their own records under HIPAA's right of access, covered entities should apply the HIPAA fee standard rather than the state fee schedule. Under HIPAA, fees for patient-requested copies are limited to reasonable, cost-based charges for copying labor, supplies, and postage only. Retrieval and verification costs cannot be charged for HIPAA right-of-access requests.

Proper Destruction of Medical Records in Georgia

Once the required retention period has expired, Georgia providers must follow specific procedures when destroying medical records containing protected health information.

Georgia State Destruction Requirements

O.C.G.A. Section 10-15-2 requires that businesses, including healthcare providers, properly dispose of records containing personal information such as medical or disability information, as Georgia's consumer protection guidance on disposing of business records explains. Acceptable destruction methods include:

• Shredding paper records before discarding them
• Erasing personal information from the records before disposal
• Modifying records to make personal information unreadable

The business must take every reasonable action to ensure no unauthorized person can access the personal information between the time of disposal and final destruction.

HIPAA Destruction Standards

Federal HIPAA regulations add additional requirements for destroying protected health information. The U.S. Department of Health and Human Services recommends the following destruction methods:

For paper records:

• Shredding
• Burning
• Pulping
• Pulverizing

The goal is to render protected health information unreadable, indecipherable, and impossible to reconstruct.

For electronic records:

• Clearing (overwriting) the data
• Purging (degaussing) magnetic media
• Destroying the physical media through pulverization, melting, or incineration

Providers should document the date, method, and personnel involved in record destruction to maintain a defensible audit trail.

Criminal Penalties for Improper Destruction

Georgia takes the improper destruction of medical records seriously. Under O.C.G.A. Section 16-10-94.1, any person who knowingly and willfully destroys, alters, or falsifies any medical record with the intent to conceal a material fact relating to a potential claim or cause of action is guilty of a misdemeanor.

This statute applies specifically to destruction done with the intent to hide information relevant to potential legal claims. Routine destruction of records after the retention period has expired, done in accordance with proper procedures, does not violate this statute.

Practice Closure and Physician Retirement

Georgia law includes provisions for what happens to medical records when a physician retires, sells a practice, or closes an office. These provisions protect patients from losing access to their records during provider transitions.

Physician Obligations at Practice Closure

Under O.C.G.A. Section 31-33-2, a physician who retires or sells a practice may be exempt from the 10-year retention requirement if they take the following steps:

1. Notify patients of the retirement or sale of the practice
2. Offer to provide the patient's records or copies to another provider of the patient's choice
3. If the patient requests it, provide the records directly to the patient

The Georgia Composite Medical Board recommends that physicians closing a practice notify patients by mail at their last known address and also publish a notice in the newspaper of greatest circulation in each county where they practiced. The notice should include the date of retirement or sale and information about how patients can obtain their records.

What Patients Should Do When a Practice Closes

The Georgia Attorney General's Consumer Protection Division recommends the following steps for patients who cannot access records after a practice closure:

• Send a written request to the practice's last known address and registered agent (available through the Georgia Secretary of State)
• Inform your new physician that previous records are unavailable
• Request copies of claims from your health insurance company
• Contact area hospitals that may have copies of your records
• Contact the Medical Association of Georgia for help locating the provider
• File a complaint with the Georgia Composite Medical Board if the provider cannot be reached

Statute of Limitations Considerations

Georgia's medical records retention periods interact with the state's statute of limitations for medical malpractice claims. Under O.C.G.A. Section 9-3-71, medical malpractice actions must be filed within 2 years of when the injury occurred, with an absolute outer limit of 5 years from the date of the negligent act (the statute of repose).

Because Georgia's physician records retention period of 10 years exceeds the 5-year statute of repose, records should be available for the full duration of any potential malpractice claim. However, the 5-year hospital retention period aligns exactly with the statute of repose, making timely record requests important for patients considering legal action related to hospital care.

Medical malpractice claims involving minors do not follow the general minority rule found elsewhere in Georgia's statute of limitations scheme. Under O.C.G.A. Section 9-3-73(b), every minor who has reached age five is subject to the same medical malpractice limitation periods as an adult, and a child injured before age five has only until two years after that child's fifth birthday to sue. Section 9-3-73(c)(2) adds an absolute repose: no medical malpractice action may be brought after the minor's tenth birthday when the act occurred before age five, or more than five years after the act when the minor was five or older.

Because these deadlines can expire long before a child turns 18, families should request records and consult a lawyer early rather than assuming the claim stays open until the age of majority. Hospital records for a minor are kept 5 years past age 18 under Rule 111-8-40-.18, so the records may still exist well after the claim itself is time barred.

More Georgia Laws

• Georgia Medical Recording Laws
• Georgia Data Privacy Laws
• Georgia Data Breach Notification Laws
• Georgia Hit and Run Laws