Idaho Medical Records Retention Laws (2026 Guide)

Idaho Code 39-1394 lets hospitals destroy clinical laboratory records 5 years after the test and X-ray films 5 years after exposure, or 5 years after a minor patient turns 18, whichever is later, so those records stay on file at least that long. The general 5-year floor for all hospital medical records comes from federal law, 42 CFR 482.24. Idaho has no retention statute for private physician practices.

Medical records retention in Idaho is governed primarily by Idaho Code 39-1394, which sets the rules for how hospitals may store patient records and when and how they can be destroyed. Federal regulations from the Centers for Medicare and Medicaid Services (CMS) and HIPAA add additional layers of requirements.

This guide covers every aspect of medical records retention law in Idaho, from hospital and physician obligations to patient access rights, minor records, destruction rules, and what happens when a medical practice closes.

Hospital Records Retention Requirements

Idaho's primary medical records retention law is Idaho Code Section 39-1394, which falls under Title 39, Chapter 13 (Hospitals) of the Idaho Statutes.

General Retention Period

Hospitals in Idaho must retain medical records in their original or legally reproduced form. The Idaho Administrative Code (IDAPA 16.03.14.360) requires that hospital medical records conform with Section 39-1394 of the Idaho Code.

While Idaho Code 39-1394 specifically addresses the retention and destruction of clinical laboratory records and X-ray films, federal law under 42 CFR 482.24 requires all hospitals participating in Medicare to retain medical records for a minimum of 5 years.

Clinical Laboratory Records

Under Idaho Code 39-1394, clinical laboratory test records and reports may be destroyed 5 years after the date of the test recorded or reported in those records. This 5-year period begins from the date the test was performed, not from the date of patient discharge.

X-Ray Films

X-ray films follow a similar 5-year retention rule, but with an important exception for minors. Under the same statute, X-ray films may be destroyed 5 years after the date of exposure, or 5 years after the patient reaches the age of majority (18 in Idaho), whichever is later.

This means for a 10-year-old patient, X-ray films could not be destroyed until they turn 23 years old, which is 5 years after they reach the age of 18.

The statute includes an important condition: X-ray films may only be destroyed when the hospital record contains written findings of a physician who has read those X-ray films. If no written physician interpretation exists in the record, the original films must be preserved.

Acceptable Storage Formats

Idaho Code 39-1394 specifically authorizes hospitals to preserve patient care records in:

• Microfilm
• Other photographically reproduced forms
• Electronic medium

Records preserved in any of these formats are treated as originals for all legal purposes, including court proceedings under Idaho Code 9-420.

Physician and Private Practice Records

Idaho does not have a specific statute that governs how long private physicians or physician groups must retain medical records. Idaho Code 39-1394 applies only to hospitals as defined in Chapter 13, Title 39 of the Idaho Code.

Recommended Retention Periods for Physicians

Because Idaho law does not set a specific period for physician practices, providers should consider several overlapping requirements when establishing their own retention policies:

Idaho Medicaid requirements. Providers participating in Idaho Medicaid must maintain records to support claims for at least 5 years.

Federal Medicare requirements. 42 CFR 424.516(f) requires providers and suppliers that furnish covered Part A or Part B services, and the physicians or eligible professionals who order, certify, refer, or prescribe them, to keep the written and electronic documents relating to those orders, certifications, referrals, and prescriptions for 7 years from the date of service. This is a targeted documentation duty tied to ordering and certifying, not a general federal rule that the entire patient chart be kept for 7 years.

Malpractice statute of limitations. Under Idaho Code 5-219, the general statute of limitations for professional malpractice in Idaho is 2 years from the date of the occurrence. However, in cases involving foreign objects left in a patient or fraudulent concealment of malpractice, the timeline can be extended. Many legal experts recommend retaining records for at least 7 to 10 years to account for potential discovery rule extensions.

Best Practice Recommendation

The American Medical Association and most state medical associations recommend that physicians retain patient medical records for at least 10 years from the date of the last encounter. In the absence of a specific Idaho statute for physician practices, following the 10-year guideline provides a reasonable margin of safety for both legal protection and continuity of care.

Records for Minor Patients

Idaho law provides extended protections for records involving minor patients. These extended retention requirements apply across multiple record types.

Hospital Records for Minors

Under Idaho Code 39-1394, X-ray films for minor patients may not be destroyed until 5 years after the patient reaches 18 years of age (the age of majority in Idaho). This means hospitals keep X-ray films for minors until the patient turns 23.

Malpractice Considerations for Minor Records

Idaho caps how far a minor's disability can push out a filing deadline, and the cap is unusually strict. Under Idaho Code 5-230, the time limited for commencing an action "shall not be tolled for a period of more than six (6) years on account of minority, incompetency, a defendant's absence from the jurisdiction, any legal disability or for other cause or reason," except as section 5-213 specifically provides.

Combined with the 2-year professional malpractice period in Idaho Code 5-219(4), which runs from the occurrence rather than from discovery, that cap means a minor's Idaho malpractice claim is generally time-barred roughly 8 years after the act or omission. It does not stay open until the child turns 18. Idaho is one of a minority of states with a hard tolling ceiling of this kind, so do not assume the age-of-majority rule that applies in neighboring states applies here.

The practical reason Idaho providers hold a minor's records until age 23 is therefore the X-ray rule in Idaho Code 39-1394, not an open-ended malpractice window. Providers whose malpractice insurer recommends a longer hold should follow that advice.

Federal Requirements That Apply in Idaho

Idaho healthcare providers are subject to both state and federal medical records retention requirements. When federal law requires a longer retention period than Idaho law, the longer period controls.

HIPAA Documentation Requirements

The HIPAA Privacy Rule does not require providers to keep patient medical records for any specific period. HIPAA defers to state law on medical records retention.

However, HIPAA does require covered entities to retain HIPAA-related administrative documentation for 6 years from the date of creation or last effective date. This includes:

• Privacy policies and procedures
• Privacy practices notices
• Complaint disposition records
• Training records
• Business associate agreements
• Risk assessments and audit logs

This 6-year HIPAA documentation requirement is separate from and in addition to any state medical records retention requirement.

CMS Conditions of Participation

Under 42 CFR 482.24, hospitals that participate in Medicare must retain medical records in their original or legally reproduced form for at least 5 years. This federal minimum applies to all hospitals in Idaho that accept Medicare patients.

The CMS requirement covers all medical records, not just specific record types like lab reports or X-rays. Records must be accurately written, promptly completed, properly filed, and accessible for the full retention period. This, and not Idaho Code 39-1394, is the source of the general 5-year floor for a hospital chart in Idaho.

Medicare Provider Records

42 CFR 424.516(f) requires providers and suppliers that furnish covered Part A or Part B services, items, or drugs, and the physicians or eligible professionals who order, certify, refer, or prescribe them, to retain the written and electronic documents relating to those written orders, certifications, referrals, and prescriptions for 7 years from the date of service.

Read that rule for what it is: a documentation requirement covering the paperwork behind ordering and certifying, not a general CMS instruction to keep the whole patient chart for 7 years. Hospital charts are governed by the 5-year rule in 42 CFR 482.24, and Idaho sets no period at all for physician practices. Many providers still adopt a single 7-year or 10-year policy across the board, simply because one long policy satisfies every overlapping obligation at once.

Patient Access to Medical Records

Idaho patients have the right to access their medical records under both state and federal law.

Idaho State Access Rights

Under IDAPA 16.03.14.220, patients at Idaho hospitals have the right to access information contained in their clinical records within 3 business days. This state regulation, effective since July 2019, is more protective than the federal HIPAA standard.

Key provisions of Idaho's hospital patient access rules include:

• Patients may request records in paper or electronic format
• When electronic format is requested, the hospital must provide records on a currently popular media storage device in a coherent format
• Hospitals may not charge patients a rate for copies that exceeds the rate charged by the local library
• No medical information may be released without the patient's written consent or official court order, except to legally authorized entities such as third-party payers, peer review organizations, and licensing agencies

HIPAA Right of Access

Under the HIPAA Privacy Rule, all covered entities (not just hospitals) must provide patients with access to their medical records within 30 days of a request. A single 30-day extension is permitted if the provider sends written notice to the patient explaining the delay.

The U.S. Department of Health and Human Services (HHS) has actively enforced this right through its HIPAA Right of Access Initiative, resulting in significant financial penalties against providers that failed to provide timely access to patient records.

Fees for Medical Record Copies

Under 45 CFR 164.524(c)(4), a provider may impose only a reasonable, cost-based fee for copies, and that fee may include just four things: labor for copying the records in paper or electronic form, supplies for creating the paper copy or electronic media, postage when you ask for the copy to be mailed, and preparing an explanation or summary of the records if you agreed to receive one in place of the records themselves.

The regulation sets no dollar ceiling. What is reasonable turns on the actual cost of those four components, so a fee that is not built from them, such as a per-page charge for a record the provider stores electronically, is worth questioning.

Idaho's administrative rules provide additional fee protections for hospital patients, capping copy charges at the local library rate.

Records Destruction Requirements

When retention periods have been met, Idaho law permits destruction of medical records but imposes specific conditions on how that destruction must be carried out.

Idaho Destruction Rules

Under Idaho Code 39-1394, hospitals may destroy records that have met their retention period by:

• Burning
• Shredding
• Other effective methods consistent with the confidential nature of the records

The statute imposes two critical restrictions:

1. Ordinary course of business. Destruction must occur in the ordinary course of business. A hospital cannot selectively destroy individual patient records outside of its regular destruction schedule.

2. No individual destruction. No record may be destroyed on an individual basis. Records must be destroyed as part of a routine, systematic process that applies consistently across records of the same type and age.

HIPAA Destruction Standards

The HIPAA Privacy Rule requires that covered entities apply appropriate safeguards when disposing of protected health information (PHI). According to HHS guidance:

For paper records: Shredding, burning, pulping, or pulverizing are acceptable methods.

For electronic records: Clearing (overwriting with non-sensitive data), purging (degaussing), or physical destruction (disintegration, pulverization, melting, incineration, or shredding of media) are acceptable.

PHI must never be placed in dumpsters or other containers accessible to the public unless it has been rendered unreadable, indecipherable, and impossible to reconstruct.

When a Medical Practice Closes in Idaho

Idaho does not have a specific statute governing what happens to medical records when a physician practice closes. However, providers have both legal and ethical obligations to ensure continuity of access for patients.

Provider Obligations

When a physician practice closes in Idaho, the provider should:

• Notify patients in advance, providing at least 30 days' notice when possible
• Arrange for transfer of records to a successor physician or medical records custodian
• Ensure the custodian agrees to maintain records for the required retention period
• Make records available to patients upon request with a proper HIPAA authorization
• Maintain records in a secure location until they can be properly transferred or destroyed after the retention period expires

Records Custodian Requirements

If the practice is not being sold to another provider, the closing physician should designate a medical records custodian. The custodian must:

• Maintain the records for the full retention period required by law
• Keep records secure and confidential in compliance with HIPAA
• Respond to patient requests for access and copies
• Follow proper destruction procedures when the retention period expires

The Idaho Board of Medicine may provide guidance to physicians closing their practices, but there is no specific regulatory framework requiring a particular process.

Idaho Medical Records Retention Summary Table

Frequently Asked Questions

How long do Idaho hospitals have to keep medical records?

Idaho Code 39-1394 lets an Idaho hospital destroy clinical laboratory records 5 years after the test and X-ray films 5 years after exposure, or 5 years after a minor patient turns 18, whichever is later, so those records stay on file at least that long. The general 5-year floor for the rest of the chart comes from federal law: hospitals that participate in Medicare must comply with 42 CFR 482.24, which requires retention of medical records for at least 5 years in their original or legally reproduced form. In practice, many Idaho hospitals retain records for 7 to 10 years to account for potential litigation and audits.

Does Idaho require doctors to keep medical records for a specific number of years?

No. Idaho does not have a specific statute requiring private physicians or physician groups to retain medical records for any set period. Idaho Code 39-1394 applies only to hospitals. Physicians should follow the AMA's general recommendation of 10 years from the last patient encounter, their malpractice insurer's requirements, and the 7-year federal rule in 42 CFR 424.516(f) covering documentation behind Medicare orders, certifications, referrals, and prescriptions.

How long must hospitals keep medical records for children in Idaho?

For X-ray films, Idaho Code 39-1394 allows destruction only 5 years after the date of exposure or 5 years after the patient reaches 18 years of age, whichever is later, which is why records for a young child are often held until age 23. That age-23 practice rests on the X-ray rule, not on an open-ended malpractice window. Idaho Code 5-230 caps tolling on account of minority at six years, so combined with the 2-year period in Idaho Code 5-219(4) a minor's Idaho malpractice claim is generally time-barred about 8 years after the occurrence, not on the child's eighteenth birthday.

Can I get copies of my medical records from an Idaho hospital?

Yes. Under IDAPA 16.03.14.220, Idaho hospital patients have the right to access their clinical records within 3 business days of a request. You may request records in paper or electronic format. The hospital may not charge you more than the local library rate for copies. Under federal HIPAA law, all healthcare providers must provide access within 30 days and may charge only a reasonable, cost-based fee, which under 45 CFR 164.524(c)(4) is limited to labor for copying, supplies, postage, and any summary you agreed to receive.

What happens to my medical records if my doctor's office closes in Idaho?

Idaho does not have a specific law governing the disposition of medical records when a physician practice closes. However, the closing provider is expected to arrange for a successor physician or a medical records custodian to maintain the records for the required retention period. Patients should be notified before the closure so they can request copies or authorize transfer of their records. The Idaho Board of Medicine may provide guidance in specific situations.