Iowa Medical Records Retention Laws (2026 Guide)

Iowa physicians must retain medical records for at least 7 years from the last date of service under Iowa Administrative Code 481-655.5(8), the rule formerly numbered 653-13.7(8). For minor patients, that same rule sets the retention floor by cross-reference to Iowa Code 614.8, which runs to one year past the age of majority. How long a malpractice claim can still be filed is a separate question, governed by Iowa Code 614.1(9). Hospitals retain records according to the statute of limitations in Iowa Code Chapter 614.

Iowa law sets specific timeframes for how long physicians and hospitals must keep patient medical records. The primary rule for physicians is Iowa Administrative Code 481-655.5(8), which requires a minimum 7-year retention period from the last date of service. Hospital requirements are governed by Iowa Administrative Code 481-51.10(1), which ties retention to the statute of limitations found in Iowa Code Chapter 614.

A note on the rule number. The physician retention rule was previously numbered Iowa Administrative Code 653-13.7(8). The Iowa Board of Medicine standards of practice were renumbered into 481, Chapter 655 (ARC 9115C, effective May 21, 2025), and the retention language carried over word for word. Older guidance citing 653-13.7 describes the same requirement; the current citation is 481-655.5(8).

Understanding these rules is important whether you are a healthcare provider managing compliance, a patient trying to access old records, or an administrator handling practice transitions. This guide covers every major retention requirement in Iowa, including federal rules that overlap with state law.

Physician Medical Records Retention in Iowa

Iowa Administrative Code 481-655.5(8)(a) establishes the baseline retention requirement for physicians licensed by the Iowa Board of Medicine. Under this rule, a physician must retain all medical records for at least 7 years from the last date of service for each patient, except as otherwise required by law.

This rule applies to all patient records that have not been appropriately transferred to another physician or healthcare entity. The 7-year period begins on the date of the patient's most recent visit or treatment, not the date the record was first created.

What Records Must Be Retained

The retention requirement covers all documentation generated during the course of patient care. This includes:

• Patient history and physical examination notes
• Diagnostic test results and lab reports
• Treatment plans and progress notes
• Prescription records and medication logs
• Referral letters and consultation reports
• Imaging studies and radiology reports
• Surgical and procedural records
• Informed consent forms
• Correspondence related to patient care

Physicians are expected to maintain these records in a manner that allows timely retrieval when needed for continuity of care, legal proceedings, or patient requests.

Records for Minor Patients

The same rule that sets the 7-year floor addresses minors directly, and it does so by cross-reference. Under Iowa Admin. Code 481-655.5(8)(b), a physician "must retain all medical records of minor patients, not appropriately transferred to another physician or entity, for a period consistent with that established by Iowa Code section 614.8."

Iowa Code 614.8(2) extends the limitation periods in favor of minors so that they have one year from and after attainment of majority in which to commence an action. The age of majority in Iowa is 18 under Iowa Code 599.1. The retention floor for a pediatric record therefore runs through the patient's 19th birthday.

In practice, a physician should keep a minor's record until the later of 7 years from the last date of service or the patient's 19th birthday. For a child last treated at age 3, that means holding the record for roughly 16 years, well past the general 7-year floor.

Malpractice Exposure Is a Separate Clock

The retention duty and the window for filing a malpractice claim are two different things, and Iowa keeps them apart.

Iowa Code 614.8(2) opens with the phrase "Except as provided in section 614.1, subsection 9," so its one-year-past-majority extension does not lengthen the deadline for a medical malpractice claim. Under Iowa Code 614.1(9)(b), a minor who was under age 8 when the act or omission occurred must bring the claim no later than the 10th birthday, or under the standard rule in paragraph "a" if that period runs later. A minor who was 8 or older gets no separate minority-based extension; the standard 2-year-discovery, 6-year-repose rule applies.

This affects records planning in one direction only. A shorter liability window does not shorten the retention duty, because the regulation keys retention to Iowa Code 614.8 regardless of how 614.1(9) treats the claim. A physician who purges a pediatric record at the 7-year mark on the theory that the malpractice window has closed has still fallen short of 481-655.5(8)(b) if the patient has not yet turned 19.

Hospital Medical Records Retention in Iowa

Iowa hospitals are regulated under Iowa Administrative Code 481, Chapter 51, which sets licensing standards administered by the Iowa Department of Inspections, Appeals, and Licensing.

Under Iowa Admin. Code 481-51.10(1), hospital medical records must be filed and stored in an accessible manner and in accordance with the statute of limitations specified in Iowa Code Chapter 614. This is a different mechanism from the physician rule: hospitals are pointed at Chapter 614 as a whole rather than at Iowa Code 614.8 specifically.

How the Statute of Limitations Affects Hospital Retention

Iowa Code Chapter 614 contains several provisions that directly affect how long hospitals should keep records:

Because malpractice claims can be filed up to 6 years after the incident (statute of repose), and the discovery rule may delay the start of the 2-year limitation period, most Iowa hospitals retain adult patient records for at least 7 to 10 years to account for the full range of potential legal exposure.

For patients treated as minors, hospital retention is keyed to Chapter 614 as a whole, which includes both the malpractice rule in 614.1(9) and the general minors extension in 614.8. For a malpractice claim, a patient treated under age 8 has until the 10th birthday, or longer if the standard 6-year repose period runs past that date, and a patient treated at age 8 or older is subject to the standard adult rule. But because 614.8 still extends non-malpractice claims to one year past majority, the conservative floor for a pediatric hospital record is the patient's 19th birthday, the same practical endpoint the physician rule requires.

Hospital vs. Physician Requirements: Key Differences

While both hospitals and physicians must retain records, their governing rules differ:

• Physicians have a fixed floor: 7 years from the last date of service, extended for minor patients to one year past the age of majority (Iowa Admin. Code 481-655.5(8))
• Hospitals must retain records in accordance with the statute of limitations (Iowa Admin. Code 481-51.10(1)), which creates a variable period depending on the type of claim and the patient's age at the time of treatment
• Hospitals face additional federal requirements through Medicare Conditions of Participation that physicians in private practice may not

Federal Requirements That Apply in Iowa

Iowa healthcare providers must comply with both state and federal records retention requirements. When federal and state rules overlap, the longer retention period applies.

HIPAA Documentation Requirements

The HIPAA Privacy Rule does not require covered entities to retain medical records for any specific period of time. The U.S. Department of Health and Human Services (HHS) has stated this directly.

However, HIPAA does require covered entities to retain HIPAA-related documentation for 6 years. Under 45 CFR 164.530(j), covered entities must keep the following for 6 years from the date of creation or the date when last in effect, whichever is later:

• Privacy policies and procedures
• Patient authorization forms for disclosure of protected health information (PHI)
• Notice of Privacy Practices
• Accounting of disclosures logs
• Business Associate Agreements
• Training records for workforce members
• Complaint and resolution documentation

This 6-year HIPAA documentation requirement is separate from and runs parallel to Iowa's state medical records retention rules. Providers must satisfy both.

CMS and Medicare Conditions of Participation

Hospitals that participate in Medicare must comply with the Conditions of Participation under 42 CFR 482.24. These federal regulations require that:

• Medical records be retained in their original or legally reproduced form for at least 5 years
• Records be accurately written, promptly completed, properly filed, and accessible
• The hospital maintain confidentiality procedures for all patient records
• Original records only be released pursuant to federal or state law, court orders, or subpoenas

Because Iowa's state retention requirements (7 years for physicians, statute-of-limitations-based for hospitals) generally exceed the CMS 5-year minimum, Iowa providers who follow state law will typically satisfy the CMS requirement as well. However, providers should be aware of both standards and apply the longer period.

Patient Access to Medical Records in Iowa

Iowa patients have a legal right to access and obtain copies of their medical records. This right is established under both state and federal law.

State Law: Iowa Code 622.10

Under Iowa Code 622.10(6), a provider must give copies of the requested records or images to the requester within thirty days of receiving a written request. The request must be accompanied by a legally sufficient patient's waiver unless it comes from the patient or the patient's legal representative or attorney.

A provider may require payment in advance if it delivers an itemized statement demanding payment within 15 days of the request. When it does, the deadline extends to the later of 30 days from the original request or 10 days after the payment is received.

Iowa Code 622.10(6) also governs the fees providers may charge for copies:

Section 622.10 does not give providers a general "harm to the patient" ground for refusing to release records. Its only withholding provision, 622.10(6)(d), is procedural: if a provider does not produce all of the records the request covers, or does not let a patient examine all of the records the patient asked to see, the provider must give the requester or the patient written notice that producing the records would be a violation of HIPAA.

Federal Law: HIPAA Right of Access

Under 45 CFR 164.524, patients have the right to access and obtain a copy of their protected health information held by covered entities. HIPAA requires that providers respond to access requests within 30 days, with one 30-day extension permitted if the provider notifies the patient in writing.

The safety-based ground providers sometimes invoke to withhold records comes from federal law, not from Iowa's statute. Under 45 CFR 164.524(a)(3)(i), a covered entity may deny access where a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person. That is a reviewable denial: under 45 CFR 164.524(a)(4), the patient may have it reviewed by a different licensed health care professional designated by the covered entity who did not take part in the original decision.

HIPAA also limits the fees a provider may charge to a reasonable, cost-based amount. Where Iowa's fee framework under Code section 622.10 is more protective, those state provisions control as the more protective standard.

Authorization Requirements

A valid authorization to release medical records in Iowa must include:

• The patient's name, address, and date of birth
• A description of the specific records to be released
• The name of the person or entity authorized to receive the records
• An expiration date or event for the authorization
• The patient's signature (or that of a legally authorized representative)

Providers should retain copies of all authorizations as part of their HIPAA documentation.

Medical Records Destruction in Iowa

Once the applicable retention period has expired, Iowa healthcare providers may destroy medical records. However, destruction must be carried out in a manner that protects patient privacy.

HIPAA Destruction Standards

The HIPAA Privacy Rule requires that covered entities apply appropriate safeguards when disposing of protected health information. PHI must be rendered essentially unreadable, indecipherable, and unable to be reconstructed.

Acceptable methods for destroying paper records include:

• Cross-cut shredding
• Burning or incineration
• Pulping or pulverizing

For electronic records, acceptable destruction methods include:

• Clearing (overwriting data on the media)
• Purging (degaussing or using cryptographic erasure)
• Physical destruction of the storage media (pulverizing, melting, or incinerating)

Best Practices for Iowa Providers

Iowa does not have a state-specific statute that goes beyond HIPAA for records destruction. However, providers should follow these practices:

• Document all destruction activities. Maintain a log that includes the date of destruction, a description of the records destroyed, the method used, and the name of the person who performed or supervised the destruction.
• Use a certified vendor when outsourcing. If using a third-party shredding or destruction service, execute a Business Associate Agreement (BAA) and obtain a Certificate of Destruction (COD) for your compliance files.
• Never dispose of records in regular trash or recycling. Intact paper records placed in unsecured disposal containers violate HIPAA.
• Retain destruction logs indefinitely. Even after the records themselves are destroyed, the documentation of their destruction should be kept as proof of compliance.

Practice Closure, Retirement, and Physician Death

Iowa has specific rules governing what happens to medical records when a physician closes a practice, retires, or dies. These rules are found at paragraphs (c) and (d) of Iowa Administrative Code 481-655.5(8), the same subrule that sets the retention periods.

Designating a Successor

Since July 1, 2023, every Iowa-licensed physician must appoint another Iowa-licensed physician or a qualified representative to serve as the custodian of medical records in the event of the physician's death or incapacitation. The appointed successor must meet the same standards of confidentiality as the physician.

The Iowa Board of Medicine may request proof of this appointment at any time. Physicians who fail to designate a successor may face disciplinary action.

Transfer Requirements

When a physician retires, sells a practice, or otherwise ceases practicing, the following requirements apply:

1. All medical records must be transferred to another physician or entity that agrees to serve as custodian and is held to the same confidentiality standards.
2. All active patients must be notified that their records are being transferred and told the identity of the new custodian.
3. Patients must be given the option to have their records sent to a different physician of their choosing.
4. The transferring physician or representative must ensure records remain accessible and confidential throughout the transition.

What Happens When a Physician Dies Without a Plan

Patients and families are sometimes unable to locate records after a physician dies unexpectedly or abandons a practice. In these situations, patients may contact the Iowa Board of Medicine for guidance on locating their records.

The 2023 successor designation requirement was created specifically to address this problem. Patients who cannot find their records should also check with local hospitals, health systems, or other providers who may have received transferred records.

Iowa Medical Records Retention at a Glance

The following table summarizes the key retention periods that apply to Iowa healthcare providers: