Kentucky Medical Records Retention Laws (2026 Guide)

Kentucky requires licensed hospitals to retain medical records for at least six years from the date of discharge under 902 KAR 20:016. If the patient was a minor, the hospital must keep the record for six years from discharge or three years after the patient reaches the age of majority, whichever is longest. We did not locate an equivalent Kentucky retention period for private physician offices.

Kentucky imposes specific medical records retention requirements on hospitals and certain healthcare facilities through state administrative regulations. The primary regulation is 902 KAR 20:016, which addresses hospital operations and services, including how long patient records must be preserved after discharge.

Understanding these rules matters for healthcare providers, patients seeking access to their records, and administrators responsible for records management and compliance. This guide covers state and federal retention requirements, patient access rights, proper destruction methods, and what happens to records when a practice closes.

Hospital Medical Records Retention Under 902 KAR 20:016

Kentucky's primary retention requirement for hospital medical records appears in 902 KAR 20:016, titled "Hospitals; operations and services." The Cabinet for Health and Family Services promulgated the regulation through its Office of Inspector General under the authority of KRS 216B.042(1). That office, not the Department for Public Health, is the regulatory and licensing agency for Kentucky health care facilities.

Under Section 3(11)(b)2 of the regulation, hospitals licensed in Kentucky must retain medical records for at least six years from the date of discharge. The regulation states this as a minimum, so a hospital may keep records longer under its own policy or under a litigation hold.

"Medical records shall be retained for at least: a. Six (6) years from date of discharge; or b. If a minor, three (3) years after the patient reaches the age of majority under state law, whichever is the longest." Source: 902 KAR 20:016, Section 3(11)(b)2

The obligation reaches every patient the hospital treats. Section 3(11)(b) requires a medical record maintained in accordance with accepted professional principles "for every patient admitted to the hospital or receiving outpatient services," so outpatient encounters carry the same retention period as inpatient stays.

What Hospital Records Must Include

Section 3(11) also requires a system of identification and filing that assures prompt location of a patient's medical record, and Section 3(11)(f) sets out the required contents in detail. The record generally includes:

• Patient identification and demographic data
• Admission information
• Medical history and physical examination findings
• Diagnoses
• Diagnostic and therapeutic orders
• Clinical observations, progress notes, and nursing notes
• Reports of procedures, tests, and their results
• Discharge summaries

That list summarizes the categories rather than reproducing the regulation in full. Consult Section 3(11)(f) directly before building a records checklist against it.

Retention Requirements for Minor Patients

Kentucky applies a different calculation when the patient was a minor at the time of treatment. Under Section 3(11)(b)2, the hospital compares two periods and keeps the record for whichever runs longest: six years from the date of discharge, or three years after the patient reaches the age of majority under state law.

The age of majority in Kentucky is 18 for most purposes under KRS 2.015, so the second prong ordinarily runs to the patient's 21st birthday. KRS 2.015 sets one exception that matters here: for purposes of care and treatment of children with disabilities, the age of majority is 21, so for those patients the second prong can run to the 24th birthday. Because 902 KAR 20:016 defers to the age of majority "under state law" without defining minor, confirm which age applies before scheduling destruction of a disabled pediatric patient's record.

Because the rule is a comparison, which prong controls depends on how old the child was at discharge:

• A child discharged at age 10. Six years from discharge ends at age 16, but the age-of-majority prong runs to 21. The hospital keeps the record for 11 years.
• A patient discharged at age 17. The age-of-majority prong ends at 21, but six years from discharge runs to age 23. The six-year prong controls.

Watch out: For teenagers, the six-year prong routinely outlasts the age-21 prong. Treating "keep it until 21" as the entire rule can destroy a record a year or more early, which is a compliance failure and can leave a patient without records they later need.

This extended retention matters particularly for:

• Young adults who need childhood medical history for ongoing care
• Legal proceedings that arise after the patient reaches adulthood
• Insurance claims that reference childhood medical events
• Disability determinations requiring early medical documentation

Physician Office and Private Practice Retention

902 KAR 20:016 applies to licensed hospitals. We did not locate a Kentucky statute or administrative regulation setting an equivalent minimum retention period for records held by a private physician office or an outpatient clinic outside the hospital setting.

Treat that as an absence we could not fill rather than a guarantee that nothing applies. Before setting a destruction schedule, confirm current requirements with the Kentucky Board of Medical Licensure, because a professional licensing standard can govern where no retention statute does.

Several other requirements set the practical floor in any event.

Federal Requirements That Apply

A practice that bills Medicare or Medicaid is subject to federal recordkeeping rules. Under 42 CFR 424.516(f)(1)(i)(A), a provider or supplier that furnishes covered ordered, certified, referred, or prescribed Part A or Part B services, items, or drugs must maintain documentation for seven years from the date of service. Paragraph (f)(2)(i)(A) applies the same seven-year period to physicians and eligible professionals. CMS restates that period in its Medical Record Maintenance and Access Requirements guidance.

Kentucky Medicaid sets its participation conditions in 907 KAR 1:671, which requires a provider to make administrative and medical records available for audit or investigation but does not itself state a retention period. The duration sits in service-specific regulations instead. The vision program rule at 907 KAR 1:632, Section 7(1)(a), is a representative example: it requires a provider to keep records of a service for the period currently required by the U.S. Health and Human Services Secretary, in accordance with 42 CFR 431.17, unless the department requires a longer period under 907 KAR 1:671.

Check the regulation that governs your own service type. 907 KAR 1:632 is Kentucky's vision benefit rule, not a general Medicaid retention regulation, and it is cited here only to show how the retention duty is structured.

Professional Best Practices

Because we located no Kentucky retention schedule for private practices, the working benchmark is the longest period any applicable rule imposes. For a practice that bills Medicare, that is the seven-year period at 42 CFR 424.516(f) for documentation of ordered, certified, referred, or prescribed services.

Malpractice exposure is the other consideration. A destroyed record cannot support a defense, so practices commonly align retention with the statute of limitations for claims they could face, and hold pediatric records longer because a minor's limitations period is generally tolled. Confirm the current limitations periods that apply to your practice before you fix a schedule, and do not treat a rule of thumb as the deadline.

HIPAA Requirements and Medical Records

A common misconception is that the federal Health Insurance Portability and Accountability Act (HIPAA) sets a retention period for medical records. It does not.

According to the U.S. Department of Health and Human Services, the HIPAA Privacy Rule contains no medical record retention requirement. State law governs how long clinical records must be kept, which is why 902 KAR 20:016 does the work in Kentucky.

HIPAA does impose a six-year retention requirement on compliance documentation. Under 45 CFR 164.530(j)(2), a covered entity must retain the documentation required by paragraph (j)(1), including written policies and procedures, required written communications, and records of required actions or designations, for six years from the date of its creation or the date when it last was in effect, whichever is later.

So HIPAA does not dictate how long you keep a patient's chart. It requires you to keep the policies and documentation that govern how you handle that chart.

What HIPAA Does Require for Records

While HIPAA sets no retention period for the clinical record itself, it does require covered entities to:

• Apply administrative, technical, and physical safeguards to protect records they retain
• Ensure proper disposal of protected health information (PHI) when records are destroyed
• Provide patients access to their records for as long as those records are maintained
• Maintain documentation of certain disclosures of PHI for six years

CMS and Medicare Conditions of Participation

Hospitals participating in Medicare must comply with the Conditions of Participation at 42 CFR 482.24. These federal requirements sit alongside Kentucky's regulation, and a Kentucky hospital must satisfy both.

Paragraph (b)(1) provides that medical records "must be retained in their original or legally reproduced form for a period of at least 5 years."

Kentucky's six-year rule exceeds that federal floor rather than matching it. The practical consequence runs one way only. A hospital that complies with 902 KAR 20:016 also satisfies the CMS condition, but a hospital that retained records for the federal five years alone would fall a full year short of Kentucky law.

For other Medicare providers and suppliers, including physician offices, the seven-year period at 42 CFR 424.516(f) applies instead of the hospital condition. It covers documentation of covered ordered, certified, referred, or prescribed services, items, or drugs rather than the whole chart.

Patient Access to Medical Records in Kentucky

Kentucky gives patients a statutory right to obtain copies of their records. Under KRS 422.317(1), a hospital licensed under KRS Chapter 216B, or a health care provider, must supply a patient with a copy of the patient's medical record on the patient's written request.

The General Assembly created the statute in 1994 Ky. Acts ch. 512, Part 16, sec. 117, and amended it by 1996 Ky. Acts ch. 334, sec. 6, effective July 15, 1996.

KRS 422.317(2) excludes the Department of Corrections from the definition of a health care provider for this section, although the department may make an individual inmate's records available to that inmate unless it determines the record is subject to KRS 197.025.

Copying Fees

Kentucky's fee rule is more favorable to patients than many summaries suggest. The statute makes the first copy free.

"Upon a patient's written request, a hospital licensed under KRS Chapter 216B or a health care provider shall provide, without charge to the patient, a copy of the patient's medical record. A copying fee, not to exceed one dollar ($1) per page, may be charged by the health care provider for furnishing a second copy of the patient's medical record upon request either by the patient or the patient's attorney or the patient's authorized representative." Source: KRS 422.317(1)

The statute therefore sets two rules:

• First copy: no charge to the patient, on written request.
• Second copy: up to $1 per page, whether the request comes from the patient, the patient's attorney, or an authorized representative.

KRS 422.317 sets no flat search fee, no per-request minimum, and no separate mailing charge. If a Kentucky provider bills a patient for a first copy of their own record, that is worth raising against the statutory text in writing.

A patient denied access can file a HIPAA right-of-access complaint with the HHS Office for Civil Rights, which has enforced that right in multiple settlements. For a licensed Kentucky facility, the Cabinet for Health and Family Services' Office of Inspector General is the state licensing authority.

Access to Minor Patient Records

Kentucky enacted KRS 422.355 in 2024 Ky. Acts ch. 164, sec. 1, effective July 15, 2024. Under subsection (2), the parent of a patient under 18, or the patient's personal representative acting on the patient's behalf, has the right to access the patient's health information maintained by a health care provider in a medical record, unless access is prohibited under HIPAA or any other federal or state law. Subsection (1) defines a personal representative as an individual who has authority under state law to make health care decisions for a patient.

The statute does not list categories of care that are carved out. It states the exception by cross-reference, so whether a parent can reach a particular part of a minor's record turns on HIPAA and on any other federal or state law governing that care. Providers apply that analysis case by case, and a parent who is refused access should ask the provider in writing which law it relies on.

HIPAA Right of Access

Separately from state law, the HIPAA Privacy Rule at 45 CFR 164.524 gives patients the right to inspect and obtain copies of protected health information in a designated record set.

Under paragraph (b)(2)(i), a covered entity must act on an access request no later than 30 days after receiving it. Paragraph (b)(2)(ii) permits one extension of no more than 30 additional days, and only if the entity gives the individual written notice of the reason for the delay and the date it will complete the request.

Proper Destruction of Medical Records

Once the applicable retention period expires, Kentucky healthcare providers may destroy medical records. Destruction must still comply with HIPAA requirements protecting patient privacy.

The HHS Office for Civil Rights directs covered entities to use methods that render protected health information unreadable, indecipherable, and impossible to reconstruct.

Acceptable Destruction Methods for Paper Records

• Shredding using cross-cut shredders
• Burning in a controlled environment
• Pulping through a professional document destruction service
• Pulverizing to render content unrecoverable

Acceptable Destruction Methods for Electronic Records

• Clearing by overwriting storage media with non-sensitive data
• Purging through degaussing or cryptographic erasure
• Physical destruction by pulverizing, melting, incinerating, or shredding storage media

What Is Not Acceptable

Providers may not dispose of records containing PHI in:

• Public dumpsters or recycling bins
• Regular trash receptacles accessible to unauthorized persons
• Unsecured recycling containers

Kentucky providers should keep a destruction log recording the destruction date, the method used, the records destroyed by type rather than by patient name, and the individual or vendor that performed the destruction. Retain that log as HIPAA compliance documentation for the six years required by 45 CFR 164.530(j)(2).

What Happens When a Practice Closes

When a Kentucky physician's practice closes, the provider remains responsible for keeping medical records maintained and accessible for the full retention period. Kentucky has no statute detailing practice closure procedures, so the Kentucky Board of Medical Licensure is the authority to consult on professional expectations.

Recommended Steps for Practice Closure

1. Notify patients in advance. Written notice well before the closure date should state when the practice closes, how patients can obtain copies of their records, and the name of any physician taking over the practice.

2. Arrange records transfer or custodianship. Transfer records to another provider who agrees to accept them, or engage a medical records custodian to hold them for the remainder of the retention period.

3. Notify the Kentucky Board of Medical Licensure. Physicians closing a practice should inform the KBML and update their license status.

4. Notify insurance companies and payers. Inform all relevant carriers and billing entities of the closure.

5. Maintain access. Patients keep their right of access under KRS 422.317 and HIPAA after closure. The closing physician or designated custodian must continue to honor record requests, including the free first copy.

Hospital Closures

When a Kentucky hospital closes, the six-year obligation under 902 KAR 20:016 still runs for its full term; closing does not shorten it. Administrators should coordinate with the Cabinet for Health and Family Services' Office of Inspector General, which licenses Kentucky hospitals, on continued storage and patient access.

Kentucky Retention Rules at a Glance