Hawaii Medical Records Retention Laws (2026 Guide)

Hawaii health care providers must retain complete medical records for a minimum of 7 years after the last data entry, and basic patient information for 25 years after the last entry, under HRS Section 622-58. For minors, both periods run longer: complete records must be kept through the period of minority plus 7 additional years, and basic patient information must be kept through the period of minority plus 25 additional years after the minor turns 18.

Hawaii law sets clear requirements for how long hospitals, physicians, and other health care providers must keep patient medical records. The primary statute governing this area is Hawaii Revised Statutes (HRS) Section 622-58, which establishes a minimum 7-year retention period for complete medical records and a 25-year retention period for basic patient information, both extended for minor patients.

Whether you are a patient trying to access old records, a physician planning for retirement, or a hospital administrator managing compliance, understanding these requirements is essential. This guide covers every aspect of Hawaii's medical records retention laws, including how they interact with federal regulations under HIPAA and CMS.

How Long Must Medical Records Be Kept in Hawaii?

Under HRS Section 622-58(a), health care providers in Hawaii must retain medical records in the original or reproduced form for a minimum of 7 years after the last data entry.

This 7-year clock starts from the date of the most recent entry in the patient's record, not from the date of the first visit or the date of discharge. If a patient returns for a follow-up visit years later, the retention period resets from that new entry date.

The statute permits records to be stored in several formats, including the original paper form, microfilm, digital scans, or any other photographic reproduction process. The only requirement is that the method used must create an unalterable record of the original.

Retention Rules for Minor Patients

Hawaii law provides extended protections for the records of minors. Under HRS Section 622-58(a), records for patients who are minors must be retained during the entire period of minority plus 7 years after the minor reaches the age of majority.

Since the age of majority in Hawaii is 18, this means a child's medical records must be kept until they turn 25 at minimum. For a newborn, this creates a retention obligation of up to 25 years. For a child who was 10 years old at the time of their last medical visit, the records must be kept for at least 15 years (8 years of remaining minority plus 7 years after turning 18).

This extended period exists because minors cannot bring their own legal claims. By the time they reach adulthood and could pursue a medical malpractice or other legal action, they need access to their childhood medical records.

The same minors extension applies to the separate 25-year basic-information rule under HRS Section 622-58(e). If a provider destroys a minor's complete record after the minority-plus-7-years period and retains only the basic information, that basic information must still be kept during the period of minority plus 25 years after the minor turns 18. For a newborn, that means basic information cannot be destroyed until age 43.

Hospital vs. Physician Retention Requirements

While HRS Section 622-58 applies to all health care providers, the statute draws an important distinction between physicians/surgeons and health care facilities when it comes to what basic information must be preserved after the full record is destroyed.

Physician and Surgeon Requirements

Individual physicians and surgeons in private practice must follow the same 7-year minimum retention period for complete medical records. After that period, if a physician chooses to destroy the full record, they must retain the following basic information for 25 years after the last entry (period of minority plus 25 years after age 18 for minor patients):

• Patient's name and date of birth
• A list of dated diagnoses and intrusive treatments
• A record of all drugs prescribed or given

This basic information requirement under HRS Section 622-58(d) ensures that even decades later, there is a core record of what care a patient received.

Hospital and Health Care Facility Requirements

Hospitals and other health care facilities (as defined in HRS Section 323D-2) have a more extensive basic information requirement. After destroying full records past the 7-year mark, facilities must preserve the following for 25 years (period of minority plus 25 years after age 18 for minor patients):

• Patient's name and date of birth
• Dates of admission and discharge
• Names of attending physicians
• Final diagnosis
• Major procedures performed
• Operative reports
• Pathology reports
• Discharge summaries

This broader requirement reflects the typically more complex care delivered in hospital settings, where multiple providers may be involved and surgical or invasive procedures are common.

Imaging and Diagnostic Records

Under HRS Section 622-58(c), X-ray films, electroencephalogram (EEG) tracings, and similar imaging records must be retained for at least 7 years. After that period, the provider may either present the imaging records to the patient or destroy them.

Subsection (c) carries an important proviso, however: interpretations or separate reports of those X-ray films, EEG tracings, and similar imaging records remain subject to subsection (e). So the radiologist's read or the written report generated from an imaging study must still be preserved for 25 years after the last entry (period of minority plus 25 years after age 18 for minor patients), even though the films or tracings themselves may be handed to the patient or destroyed once the 7-year period ends.

This structure lets patients take possession of the physical imaging records while keeping the diagnostic conclusions on file for the full basic-information period.

Who Qualifies as a Health Care Provider Under This Law?

HRS Section 622-58(f) defines "health care provider" by reference to HRS Section 671-1, the definitions section of Hawaii's medical torts chapter. That definition is narrower than many providers assume. It covers:

• Physicians, osteopathic physicians, surgeons, and physician assistants licensed under chapter 453
• Podiatrists licensed under chapter 463E
• Health care facilities as defined in HRS Section 323D-2
• Midwives licensed under chapter 457J
• The employees of any of the above

The statute expressly carves out nursing institutions and nursing services conducted by and for people who rely on treatment by spiritual means through prayer alone, along with the employees of those institutions and services.

Practitioners outside that list are not brought under HRS Section 622-58 by the 671-1 definition. A dentist, a psychologist, or a nurse in independent practice is not a "health care provider" for purposes of this retention statute unless that person is an employee of a covered provider or is working within a health care facility as defined in HRS Section 323D-2. Those practitioners may still have record-keeping obligations under their own licensing board rules, under contract, or under HIPAA, but the 7-year and 25-year clocks in HRS Section 622-58 are not the source of them.

Records Exempt from Retention Requirements

HRS Section 622-58(b) lists several categories of records that are exempt from the standard retention requirements:

• Public health mass screening records
• Pupils' health records and related school health room records
• Preschool screening program records
• Communicable disease reports
• Mass testing epidemiological projects and study records, including consents
• Topical fluoride application consents
• Psychological test booklets
• Laboratory copies of reports that are duplicated within the main medical record
• Pharmacy copies of prescriptions that are duplicated within the main medical record
• Patient medication profiles that are duplicated within the main medical record
• Hospital nutritionists' special diet orders that are duplicated within the main medical record
• Public health nurses' case records that do not contain any physician's direct notations
• Social workers' case records
• Diagnostic or evaluative studies for the Department of Education or other state agencies

The common thread among these exemptions is that the records either serve a different public health purpose, are duplicated within the main medical record, or do not contain direct physician involvement.

Federal Requirements: HIPAA and Medical Records Retention

Many patients and providers assume that HIPAA (the Health Insurance Portability and Accountability Act) sets a federal minimum for how long medical records must be kept. It does not.

According to the U.S. Department of Health and Human Services (HHS), the HIPAA Privacy Rule does not include medical record retention requirements. Instead, state laws govern how long records must be retained.

However, HIPAA does impose important requirements that affect records management in Hawaii:

HIPAA Privacy Rule Requirements

The HIPAA Privacy Rule (45 CFR Part 164) requires covered entities to:

• Apply appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information (PHI) for as long as records exist
• Implement reasonable safeguards to prevent unauthorized access
• Maintain documentation of HIPAA policies and procedures for 6 years from the date of creation or the date when the policy was last in effect, whichever is later

This 6-year HIPAA documentation requirement applies to the provider's own compliance records, not to patient medical records. Since Hawaii's 7-year retention period exceeds HIPAA's 6-year documentation requirement, providers who comply with Hawaii law will generally satisfy this federal obligation.

HIPAA Security Rule for Electronic Records

Providers storing medical records electronically must also comply with the HIPAA Security Rule, which requires:

• Access controls limiting who can view patient records
• Audit controls tracking who accessed records and when
• Encryption of electronic PHI during transmission and, where appropriate, at rest
• Regular risk assessments of electronic record systems

These security requirements apply throughout the entire retention period and during the destruction process.

CMS and Medicare Records Requirements

Health care providers who participate in Medicare must also comply with the Centers for Medicare and Medicaid Services (CMS) Conditions of Participation. Under 42 CFR Section 482.24, hospitals participating in Medicare must maintain a medical record for every patient evaluated or treated.

Under 42 CFR Section 482.24(b)(1), those records "must be retained in their original or legally reproduced form for a period of at least 5 years." That federal floor is shorter than Hawaii's, so a Hawaii hospital that meets the 7-year state minimum under HRS Section 622-58 will already satisfy the CMS retention condition. Hawaii's clock also runs from the last data entry rather than from a single episode of care, which extends the effective retention period further for patients who keep returning.

Additionally, CMS requires that medical records be:

• Accurately written, promptly completed, and properly filed
• Accessible to authorized practitioners
• Protected against unauthorized access
• Organized to facilitate data retrieval for clinical, research, and administrative purposes

Patient Access to Medical Records in Hawaii

Patients in Hawaii have the right to obtain copies of their medical records under both state and federal law.

State Law: HRS Section 622-57

Under HRS Section 622-57, when a patient requests copies of their medical records, the provider must make those copies available unless the provider believes disclosure would be detrimental to the patient's health.

If a provider withholds records on that basis, the provider must inform the patient that the records can be released to the patient's attorney upon presentation of a proper written authorization signed by the patient.

When an attorney requests records with proper patient authorization, the provider must supply complete and accurate copies within 10 working days.

The patient or requesting party is responsible for the reasonable costs of copying.

Access to a Deceased Patient's Records

HRS Section 622-57(c)-(f) sets out a separate process for a deceased patient's records. A deceased person's next of kin, in order of superseding priority, may obtain or authorize release of the records without a court order, but must submit an affidavit to the provider attesting to their status as next of kin with superseding priority. Providers may honor these requests even where the records concern HIV/AIDS status, a mental illness diagnosis or treatment, or participation in a substance abuse treatment program. However, a provider must refuse a next-of-kin request if the deceased patient had previously told the provider in writing that they did not want their records released to next of kin.

Federal Law: HIPAA Right of Access

The HIPAA Privacy Rule at 45 CFR Section 164.524 provides patients with a broad right to access their protected health information in all designated record sets maintained by covered entities.

Key provisions of the HIPAA right of access include:

• Providers must act on a patient's access request within 30 days of receiving it
• Patients can request records in a specific format (such as electronic), and providers must comply if the format is readily producible
• Providers may charge only a reasonable, cost-based fee limited to labor, supplies, and postage
• There are limited exceptions, including psychotherapy notes and information compiled for legal proceedings

For Hawaii patients, HIPAA provides a stronger access right than state law in some respects, because it does not include the "detrimental to health" exception that HRS Section 622-57 allows.

Proper Destruction of Medical Records

When the retention period has expired, Hawaii law permits destruction of medical records, but with specific conditions.

State Requirements

Under HRS Section 622-58(d), medical records may be destroyed after the 7-year retention period in a manner that will preserve the confidentiality of the information in the record. The statute requires that the provider retain the basic information described above (patient name, diagnoses, treatments, medications for physicians; a broader set of data for facilities) for 25 years (period of minority plus 25 years after age 18 for minor patients).

HIPAA Disposal Requirements

The HHS guidance on disposal of protected health information specifies that covered entities must use appropriate safeguards when destroying records:

For paper records:

• Shredding, burning, pulping, or pulverizing so that PHI is rendered unreadable and cannot be reconstructed
• Simply placing records in a trash receptacle accessible to the public is not an acceptable method

For electronic records:

• Clearing (overwriting media with non-sensitive data using certified software)
• Purging (degaussing or exposing media to a strong magnetic field)
• Physical destruction (disintegration, pulverization, melting, incinerating, or shredding of storage media)

Providers may hire a business associate to handle destruction, but they must have a signed Business Associate Agreement (BAA) that requires the associate to appropriately safeguard the PHI through the disposal process.

Practice Closure and Succession Requirements

Hawaii law places specific obligations on providers who close their practice, retire, or transfer their practice to another entity.

Before Ceasing Operations

Under HRS Section 622-58, before a health care provider ceases operations, the provider must make immediate arrangements, subject to the approval of the Hawaii Department of Health, for the retention and preservation of medical records consistent with the statute's requirements.

This means a physician cannot simply close their doors and leave records unattended. They must have an approved plan for records storage, patient notification, and continued access.

Successor Obligations

If a health care provider's practice is taken over by another entity, the burden of compliance transfers to the successor. The successor assumes full responsibility for:

• Maintaining complete records for the remainder of the 7-year period
• Preserving basic information for the full 25-year period
• Providing patient access to records upon request
• Properly destroying records when retention periods expire

Recommended Best Practices for Closing a Practice

While Hawaii law does not specify every detail of the notification process, widely accepted best practices include:

• Notifying patients at least 30 days before the practice closes
• Publishing a notice in a local newspaper
• Sending individual letters to active patients
• Arranging for a records custodian to maintain records for the required retention periods
• Filing the records preservation plan with the Hawaii Department of Health
• Notifying the Hawaii Medical Board of the practice closure

Penalties for Non-Compliance

Violating Hawaii's medical records retention laws can expose providers to several forms of liability:

• Malpractice claims: Missing records can create a presumption of negligent care, making it harder for providers to defend against malpractice lawsuits
• HIPAA penalties: The HHS Office for Civil Rights can impose civil penalties ranging from $145 (minimum, per violation, lowest culpability tier) up to a $2,190,294 calendar-year cap per identical violation, under the current inflation-adjusted tiers at 45 CFR 160.404 (effective January 28, 2026), including for improper disposal of records
• Professional discipline: The Hawaii Medical Board can take disciplinary action against licensed providers who fail to maintain records as required
• Loss of Medicare participation: CMS can terminate a provider's Medicare enrollment for failure to comply with Conditions of Participation, including medical records requirements

Summary of Hawaii Medical Records Retention Periods