Indiana Medical Records Retention Laws (2026 Guide)

Indiana law requires all licensed healthcare providers to retain patient medical records for a minimum of seven years under IC 16-39-7-1, which does not set a separate rule for minor patients. Many providers nonetheless extend retention for minors until the patient turns 21 or for seven years after the last service, whichever period is longer, as a common risk-management practice rather than a distinct statutory mandate.

Last verified: September 2026 against the Indiana Code 2026 text of IC 16-39-7 and IC 16-39-9, including the changes made by P.L.215-2025. This page also reflects Indiana Administrative Code Title 410, Article 15.

Table of Contents

• Overview of Indiana Medical Records Retention Laws
• How Long Must Providers Keep Medical Records in Indiana
• Hospital vs. Physician Retention Requirements
• Retention Rules for Minor Patients' Records
• X-Ray, Mammogram, and Imaging Record Retention
• Federal Requirements: HIPAA and CMS
• Patient Access to Medical Records in Indiana
• Copying Fees for Medical Records
• Proper Destruction of Medical Records
• Practice Closure and Record Transfer Requirements
• Indiana's Abandoned Health Records Act
• Penalties for Non-Compliance
• Frequently Asked Questions
• Sources and References

Overview of Indiana Medical Records Retention Laws

Indiana law sets clear minimum periods for how long healthcare providers must keep patient medical records. The primary statute governing retention is Indiana Code 16-39-7-1, which applies to hospitals, physicians, dentists, nurses, and all other licensed healthcare providers in the state.

The law requires providers to maintain original health records or microfilm copies for at least seven years. This requirement applies across the board to every type of licensed healthcare provider operating in Indiana, whether they run a large hospital system or a solo medical practice.

Indiana also imposes additional requirements through the Indiana Administrative Code (410 IAC 15-1.5-4), which governs hospital licensure and medical record services. These administrative rules work alongside the state statutes to form a comprehensive regulatory framework for medical records management.

Providers who fail to meet these retention requirements face disciplinary sanctions from their licensing boards. In addition, federal laws including HIPAA and CMS participation requirements may impose additional obligations on top of Indiana's state law minimums.

How Long Must Providers Keep Medical Records in Indiana

Indiana Code 16-39-7-1(b) requires all healthcare providers to maintain the original health records or microfilms of those records for a minimum of seven (7) years. This is the baseline retention period that applies to all provider types.

The seven-year clock typically begins from the date of the patient's last treatment or encounter. However, several situations require longer retention.

Standard Retention Periods in Indiana:

Providers should note that if a patient requests their records during the retention period, the provider must accommodate that request within 30 days under IC 16-39-1-1. Transferring records to a patient or another provider does not relieve the original provider of their retention obligations for any copies they retain.

Hospital vs. Physician Retention Requirements

While the seven-year minimum under IC 16-39-7-1 applies to both hospitals and individual physicians, these two provider types face different regulatory frameworks that create distinct compliance obligations.

Hospital Requirements

Hospitals licensed in Indiana must comply with 410 IAC 15-1.5-4, which governs medical record services as part of hospital licensure. This regulation requires:

• Medical record services directed by a Registered Health Information Administrator (RHIA) or Registered Health Information Technician (RHIT)
• Records retained in their original or legally reproduced form as required by federal and state law
• Patient identification data, diagnostic and therapeutic orders, and authentication of all entries
• Discharge summaries authenticated by the attending physician
• Procedures for releasing records only to authorized individuals under federal and state law

Hospitals that participate in Medicare must also meet the federal Conditions of Participation under 42 CFR 482.24, which requires maintaining a medical record for every inpatient and outpatient. These records must be accurately written, promptly completed, properly filed and retained, and accessible.

Physician Requirements

Physicians in private practice are subject to the same seven-year retention requirement under IC 16-39-7-1. They are also regulated by the Indiana Medical Licensing Board under 844 IAC 5-2, which sets professional standards for medical record keeping.

Physicians must maintain records that contain sufficient information to identify the patient, support the diagnosis, justify the treatment, and document the course and results of care. Solo practitioners and small practices bear full responsibility for establishing secure storage systems and ensuring records remain accessible throughout the entire retention period.

Both hospitals and physicians must ensure their records are legible, complete, and authenticated by the responsible provider. Electronic health records (EHR) systems are acceptable, but providers must have procedures to ensure accurate and complete reproduction of original documents.

Retention Rules for Minor Patients' Records

IC 16-39-7-1 does not create a separate minor-patient retention rule; it applies the same seven-year minimum to every patient regardless of age. Many Indiana providers nonetheless retain records for minor patients until the patient reaches the age of 21 or for seven years after the date of the last service, whichever period is longer, as a widely recommended risk-management practice.

This extended retention period recognizes two important legal realities. First, minors cannot bring legal actions on their own behalf. Second, Indiana's medical malpractice statute of limitations under IC 34-18-7-1 allows minors under the age of six to file claims until their eighth birthday. Retaining records through at least age 21 ensures documentation remains available through the period when a former minor patient could potentially bring a claim.

Practical Examples:

• A child seen at age 2 in 2026 would have records retained until at least 2045 (age 21)
• A child seen at age 16 in 2026 would have records retained until at least 2033 (7 years after service, since that extends past age 21)
• A child seen at age 10 in 2026 would have records retained until at least 2037 (age 21, since that is longer than 7 years from service)

Healthcare providers who treat pediatric patients should implement tracking systems to manage these variable retention deadlines. Many facilities use EHR systems that automatically flag records approaching their retention expiration dates.

X-Ray, Mammogram, and Imaging Record Retention

Indiana Code 16-39-7-2 establishes retention requirements for x-ray images. Original mammograms are addressed separately, under IC 16-39-7-3, which IC 16-39-7-2 expressly excludes from its own scope.

X-Ray Films

Providers must retain a patient's x-ray image for at least five years under IC 16-39-7-2(c). "X-ray image" is defined in IC 16-39-7-2(b) to include a microfilm copy of an x-ray film and a digital image of an x-ray.

At the time the x-ray image is taken, IC 16-39-7-2(d) requires the provider to do one of two things, not both. The provider may inform the patient in writing that the image will be kept on file for at least five years and that the patient may request a copy during that period at no cost, as provided in IC 16-39-1-2. Alternatively, the provider may have a sign posted conspicuously in the x-ray examination area telling patients the same two things. A conspicuously posted sign satisfies the requirement on its own, so a provider that posts one is not additionally obligated to give each patient written notice.

Mammogram Films

Mammogram retention is governed separately from x-ray retention. IC 16-39-7-2 states in its opening subsection that it does not apply to original mammograms, which are governed by IC 16-39-7-3 instead.

Under IC 16-39-7-3(a), a provider must maintain a patient's original mammogram films, and the reports concerning those films, in the patient's permanent medical record for not less than five (5) years after the date the original films were taken. That minimum rises to not less than ten (10) years if the provider performs no additional mammograms of the patient.

IC 16-39-7-3(b) also requires a provider, on request by or on behalf of the patient, to transfer the original films and copies of any reports to a medical institution, to a physician or other health care provider of the patient, or to the patient. Any fee charged for that transfer may not exceed the provider's actual cost under IC 16-39-7-3(c). Under IC 16-39-7-3(d), the provider must inform the patient in writing, at the time the mammogram is taken, how long the original films will be maintained and how to obtain them.

Historical mammograms remain valuable for comparison in breast cancer screening, so many providers retain them well beyond these statutory minimums.

Digital Imaging

Modern healthcare facilities increasingly store imaging records in digital formats such as DICOM files in Picture Archiving and Communication Systems (PACS). Indiana law permits digital storage as long as the system can produce accurate and complete reproductions of the original records. The same minimum retention periods apply regardless of storage format.

Federal Requirements: HIPAA and CMS

Indiana providers must comply with federal requirements in addition to state law. When federal and state requirements differ, the stricter standard applies.

HIPAA Documentation Requirements

Contrary to a common misconception, HIPAA does not mandate specific retention periods for medical records. According to the U.S. Department of Health and Human Services, the HIPAA Privacy Rule defers to state law on how long medical records must be retained.

However, HIPAA does require covered entities to retain HIPAA-related documentation for six years. Under 45 CFR 164.530(j), this includes privacy policies, procedures, patient authorizations, training records, complaints, and breach notifications. This is a documentation retention requirement, not a medical record retention requirement.

Because Indiana's seven-year requirement exceeds HIPAA's six-year documentation standard, Indiana providers who follow state law will automatically satisfy the HIPAA documentation timeline as well.

CMS and Medicare Requirements

Providers who participate in Medicare or Medicaid face additional federal requirements. Under 42 CFR 424.516(f), Medicare providers must maintain medical records for seven years from the date of service.

For hospitals, CMS Conditions of Participation (42 CFR 482.24) require maintaining a complete medical record for every inpatient and outpatient. Records must be accurately written, promptly completed, properly filed and retained, and accessible for authorized use.

Failure to maintain adequate medical records can result in revocation of Medicare enrollment under 42 CFR 424.535(a)(10), which would prevent the provider from billing Medicare for any services.

Indiana Medicaid similarly requires providers to maintain records for at least seven years from the date of service under 405 IAC 1-1.4-2. These records must fully describe the scope and extent of treatment provided.

Patient Access to Medical Records in Indiana

Indiana Code 16-39-1-1 grants patients the right to access their own medical records. Upon written request and reasonable notice, a provider must supply the patient with their health records.

Providers must fulfill the request within 30 days of receiving it. If the provider needs additional time, they may seek an extension of up to 30 additional days, but must notify the patient of the extension within the initial 30-day window.

Patients may request either their complete health record or only the portions relating to a specific condition. The provider must accommodate the patient's preference.

For records of minor patients, IC 16-39-1-7 grants both custodial and noncustodial parents equal access to a child's medical records, unless a court order restricts that access.

Under HIPAA's Right of Access provision (45 CFR 164.524), patients also have the right to obtain copies of their protected health information in electronic format when records are maintained electronically. Providers who deny access without a valid legal reason may face enforcement action from the HHS Office for Civil Rights.

Copying Fees for Medical Records

Indiana Code 16-39-9 governs what a provider or medical records company may charge for copies of medical records. The chapter no longer carries its own dollar figures. The per-page schedule that used to sit at IC 16-39-9-3 was repealed by P.L.173-2007, SEC.47, so any fee table presented as the Indiana Code schedule is quoting a section that has not been law since 2007. What the chapter does now is set two separate rules, one for electronic copies and one for paper.

Electronic Copies Are Free

Under IC 16-39-9-2(1), as amended by P.L.215-2025, SEC.27, a provider may not charge a person for providing a digital copy, or digital access through an interoperability platform, of an individual's electronic health record.

IC 16-39-9-1.5, added by P.L.215-2025, SEC.26, defines an electronic health record as a record of an individual's medical history that is created, generated, sent, communicated, received, or stored by electronic means, and states that the term includes billing statements and other administrative records that may be provided through electronic means.

The practical effect for patients is direct. If your provider keeps your records electronically and you ask for them in electronic form, or through an interoperability platform, the copy is free. A per-page charge for that request is not permitted.

Paper Copies Are Capped by Rule, Not by Statute

IC 16-39-9-2(2) provides that a provider may not charge for making and providing paper copies of medical records at an amount greater than the amount set in rules adopted by the department of insurance under IC 16-39-9-4.

That means the current maximum paper-copy charges live in the Indiana Department of Insurance rule at 760 IAC 1-71, not in the Indiana Code, and the Department may revise them. IC 16-39-9-4(c) directs the Department to weigh labor costs for verifying, logging, retrieving, copying, and refiling requests, along with software, copying, capital, billing, and space costs, when it sets those amounts. Anyone who needs the figures currently in force should read the Department of Insurance rule itself rather than rely on a schedule published elsewhere, because a secondhand table can go stale the moment the rule is amended.

IC 16-39-9-1 also exempts x-rays covered by IC 16-39-1-2 or IC 16-39-7-2 from this chapter entirely. A patient copy of an x-ray image is handled under those sections, at no cost to the patient.

These limits apply to patient requests. Providers responding to subpoenas, insurance company requests, or attorney requests may be subject to different fee structures depending on the context.

Proper Destruction of Medical Records

Once records reach the end of their required retention period, Indiana providers must still follow specific protocols for destruction to protect patient privacy.

HIPAA requires that all protected health information (PHI) be destroyed in a manner that renders it unreadable, indecipherable, and impossible to reconstruct. The HHS Office for Civil Rights recommends the following destruction methods:

For Paper Records:

• Shredding using cross-cut or micro-cut shredders
• Burning in a controlled environment
• Pulping or pulverizing

For Electronic Records:

• Clearing (overwriting data on the media)
• Purging (degaussing or using secure erase commands)
• Physical destruction (pulverizing, melting, or incinerating storage media)

Providers who use third-party destruction services must execute a HIPAA Business Associate Agreement (BAA) with the vendor before handing over any records containing PHI. The vendor must certify that destruction was completed in compliance with HIPAA standards.

Indiana providers should maintain a destruction log documenting the date of destruction, the method used, the types of records destroyed, and the name of the person or company that performed the destruction. While Indiana law does not explicitly require such a log, it serves as important evidence of compliance during any regulatory audit.

Practice Closure and Record Transfer Requirements

When a physician retires, relocates, or otherwise closes a practice, 844 IAC 5-2-16 imposes specific obligations to protect patients' access to their records.

Patient Notification

Physicians must notify all active patients of the practice closure. The regulation defines an "active patient" as someone the physician examined, treated, cared for, or consulted with during the two years before the discontinuation.

Notification must occur through one of two methods:

• Direct written notice to each active patient, or
• Publication once a week for three consecutive weeks in a newspaper of general circulation in the area where the practice is located

The notification must encourage patients to seek care from another provider and explain how patients can obtain or transfer their records.

Record Transfer Restrictions

Indiana law prohibits physicians from selling, conveying, or transferring patient records for valuable consideration. Records are not a commercial asset that can be monetized during a practice sale.

However, records may be transferred to another physician holding an unlimited license to practice medicine or osteopathic medicine who is assuming the practice. Written notice to patients must be provided when this type of transfer occurs.

Custodian Arrangements

When no successor practitioner is available, the closing physician must make reasonable arrangements for record storage and access. This often involves contracting with a medical records custodian company. Any custodian agreement must include:

• Compliance with HIPAA and state privacy and security laws
• A complete inventory of transferred records
• Description of safeguarding services and response procedures
• A term that satisfies Indiana's retention requirements
• An executed HIPAA Business Associate Agreement

Providers who fail to make adequate arrangements for patient records after closing a practice may face disciplinary action from the Indiana Medical Licensing Board and potential enforcement by the Indiana Attorney General.

Indiana's Abandoned Health Records Act

Indiana Code 4-6-14 gives the Indiana Attorney General authority to intervene when healthcare providers abandon medical records.

Under the statute, records are considered "abandoned" when a provider has voluntarily surrendered, relinquished, or disclaimed them with no intention of reclaiming possession. A 2017 amendment expanded the definition to include records that are recklessly or negligently treated such that an unauthorized person could gain access.

Attorney General's Powers

When the Attorney General determines that records have been abandoned, the AG may:

• Take possession of the abandoned records
• Store, maintain, transfer, and protect the records
• Deliver records to patients or individuals identified in them
• Destroy records after required retention periods have passed
• File a court action to recover costs from the provider who abandoned the records

The Attorney General must make reasonable efforts to notify patients whose records have been taken into state custody. The notice must explain how patients can obtain copies or have their records sent to a new treating provider.

Maintenance and Destruction Timeline

The Attorney General must maintain abandoned records for the shorter of three years from acquisition or the remaining balance of the applicable retention period under IC 16-39-7-1 (seven years for health records), IC 16-39-7-2 (five years for x-ray images), or IC 16-39-7-3 (five years for original mammogram films, or ten years if the provider performs no additional mammograms of the patient).

Financial Accountability

If a court finds that a provider intentionally or negligently abandoned records, the court may order the provider to reimburse the state for all costs incurred in securing, storing, and managing the abandoned records.

Penalties for Non-Compliance

Indiana law provides multiple enforcement mechanisms for providers who fail to maintain medical records as required.

Licensing Board Discipline: Under IC 16-39-7-1(c), a provider who violates the seven-year retention requirement commits an offense for which the applicable licensing board may impose disciplinary sanctions. These sanctions can range from a letter of reprimand to license suspension or revocation, depending on the severity and circumstances.

CMS Enrollment Revocation: Providers participating in Medicare may have their enrollment revoked under 42 CFR 424.535(a)(10) for failing to maintain required medical records. Loss of Medicare enrollment eliminates the provider's ability to bill for Medicare services.

HIPAA Enforcement: Improper destruction or disposal of records containing PHI can result in HIPAA enforcement action under 45 CFR Part 160. Under the current inflation-adjusted tiers at 45 CFR 160.404 (effective January 28, 2026), civil penalties range from $145 to $73,011 per violation depending on culpability, with a calendar-year cap of $2,190,294 per identical violation.

Attorney General Action: Under the Abandoned Health Records Act (IC 4-6-14), the Attorney General may take possession of abandoned records and pursue cost recovery against negligent providers.

Disaster Exception: Indiana law does provide one important exception. Under IC 16-39-7-1, a provider is immune from civil liability for destroying or failing to maintain a health record if the loss occurred in connection with a disaster emergency declared by the governor or another disaster, unless the loss resulted from the provider's own negligence.