New Hampshire Medical Records Retention Laws (2026 Guide)

New Hampshire requires hospitals to retain patient records for 7 years after discharge under He-P 802.21, and physicians to keep records for 7 years under Med 501.02. Minor patient records must be kept until at least 1 year after the patient turns 18, but never fewer than 7 years. State law, not HIPAA, controls.

New Hampshire has specific laws governing how long hospitals, physicians, and other healthcare providers must retain patient medical records. These requirements come from a combination of state administrative rules, statutes, and federal regulations.

This guide covers every major retention rule that applies in the Granite State, including the differences between hospital and physician requirements, federal standards under HIPAA and Medicare, patient access rights, record destruction rules, and what happens when a practice closes.

Last verified: September 2026. This page reflects current New Hampshire Revised Statutes Annotated, Administrative Rules He-P 802 (Document #14081, effective September 25, 2024), and Board of Medicine Rules Med 501.

Hospital Medical Records Retention (He-P 802.21)

New Hampshire hospitals licensed by the Department of Health and Human Services must follow the retention rules in Administrative Rule He-P 802.21, Patient Records. This rule sets the baseline for how long patient records must be stored.

The retention rule was renumbered when the current hospital rules took effect on September 25, 2024. Retention now sits at He-P 802.21 (Patient Records), whose source note reads "formerly He-P 802.20"; He-P 802.20 is now the separate Patient Management rule. Some older guidance and secondary summaries still cite the 802.20 number.

Adult Patient Records

Hospitals must retain patient records for a minimum of 7 years after discharge. This applies to all inpatient and outpatient records created during the course of treatment at the facility.

The 7-year clock starts on the date of the patient's last discharge, not the date of admission or the date of a specific procedure.

Minor Patient Records

For patients who are minors at the time of treatment, He-P 802.21 requires hospitals to retain records until at least 1 year after the patient reaches age 18. However, in no case may the records be kept for fewer than 7 years after discharge.

This means a hospital must calculate both timelines and use whichever period is longer. For example, if a child is treated at age 10, the hospital would need to keep the records until the child turns 19 (1 year after age 18), which is 9 years. Since that exceeds the standard 7-year minimum, the 19th birthday controls.

If a child is treated at age 16, the hospital would keep the record until age 19 (3 years). Since that is shorter than the standard 7-year requirement, the hospital must keep the record for 7 years from discharge instead.

Electronic Records

He-P 802.21 requires that electronic medical records be maintained according to current HIPAA regulations. This includes maintaining appropriate access controls, audit trails, and backup systems to protect the integrity and availability of patient information.

Hospital Closure

If a hospital ceases operation, He-P 802.21 requires the licensee to arrange for the storage of and access to medical records for the full 7-year retention period. The hospital must identify a custodian or storage facility that will maintain the records and respond to patient requests during this time.

Physician Medical Records Retention (Med 501.02)

New Hampshire physicians are regulated by the Board of Medicine through the Office of Professional Licensure and Certification (OPLC). The Board's administrative rules establish separate retention requirements for physician practices.

Standard Retention Period

Under Board of Medicine Rule Med 501.02, licensed physicians must maintain complete and accurate medical records for all patients for 7 years. Records must contain a history, examination, diagnosis, treatment plan appropriate to the physician's specialty, and documentation of all drug prescriptions.

Response to Patient Requests

A physician must honor requests made by a patient or the patient's authorized agent for copies of the patient's medical record within 30 days of the request. A physician may require written authorization before releasing medical records.

Record Content Requirements

The Board of Medicine requires that physician records include, at minimum:

• Patient history and physical examination findings
• Diagnosis and treatment plan
• Documentation of all drug prescriptions
• Progress notes
• Test results and imaging reports
• Referral information
• Informed consent documentation

Federal Requirements That Apply in New Hampshire

New Hampshire's 7-year retention period interacts with several federal rules. When state and federal requirements conflict, the stricter standard applies.

HIPAA Does Not Set a Retention Period

A common misconception is that HIPAA requires providers to keep medical records for a specific number of years. It does not. The HIPAA Privacy Rule does not include medical record retention requirements.

HIPAA does require covered entities to retain administrative documentation (privacy policies, training records, complaint logs, and business associate agreements) for 6 years from the date of creation or last effective date under 45 CFR 164.530(j). This applies to compliance paperwork, not to patient medical records.

State law determines how long actual patient records must be kept. In New Hampshire, that means 7 years.

CMS Conditions of Participation

Hospitals that participate in Medicare or Medicaid must also comply with federal retention requirements set by the Centers for Medicare and Medicaid Services (CMS).

42 CFR 482.24(b)(1) states only that "medical records must be retained in their original or legally reproduced form for a period of at least 5 years." It names no triggering event, so it does not run from discharge. Since New Hampshire state law already requires 7 years measured from discharge, hospitals and physicians in the state will meet the CMS hospital minimum of 5 years by default. However, general Medicare providers must still track the 7-year-from-service-date requirement independently, as it may extend beyond the state discharge-based calculation in some cases.

Which Law Controls?

The stricter requirement always wins. For a New Hampshire hospital participating in Medicare, the federal 5-year floor is shorter than the state 7-year period, so the state rule controls and its discharge-based clock is the one to track. For physicians accepting Medicare, the federal 7-year-from-service-date rule and the state 7-year rule are roughly equivalent, though the starting points differ slightly.

Patient Access Rights Under RSA 332-I

New Hampshire RSA Chapter 332-I governs patient access to medical records. This statute establishes that patients own their medical information and have a right to obtain copies.

Who Can Request Records

Under RSA 332-I, any patient or the patient's authorized representative (called a "requestor") can request copies of medical records from any health care provider. The statute defines "health care provider" broadly to include any person, corporation, facility, or institution licensed by the state or otherwise lawfully providing health care services. This covers physicians, hospitals, clinics, dentists, nurses, pharmacists, mental health professionals, and others.

Copy Fees

RSA 332-I:1 sets the general maximum fees that health care providers may charge for record copies:

Providers must furnish records within the timeframe established under 45 CFR 164.524(b)(2), which is 30 days from the date of request, with one possible 30-day extension if the provider notifies the patient in writing.

A different cap applies at licensed facilities. For facilities licensed under RSA chapter 151, which includes hospitals, RSA 151:21, X provides that the charge for copying a patient's medical records "shall not exceed $15 for the first 30 pages or $.50 per page, whichever is greater," with filmed records such as x-rays and sonograms copied at a reasonable cost. Board of Medicine Rule Med 501.02(f)(1) routes record transfers by an employed licensee to the employer "pursuant to these rules and RSA 151:21, X." So the RSA 332-I:1 schedule above is the general provider rule, and a hospital or other RSA 151-licensed facility may bill under the RSA 151:21, X cap instead. Ask which schedule the provider is using before you agree to a per-page price.

Records of Deceased Patients

RSA 332-I:13 provides access to medical records for the surviving spouse or next of kin of a deceased patient, unless the deceased specifically indicated or a court ordered that those individuals should not have access.

Where there is no estate administration, the requestor must provide:

• A notarized affidavit confirming authorization to access the records
• A HIPAA-compliant authorization form
• A copy of the death certificate

Next of kin is defined in order of priority: surviving spouse first, then adult children (by blood or adoption), then parents. If two or more relatives in the same category qualify, each is considered a personal representative.

Patients' Bill of Rights (RSA 151:21)

RSA 151:21 establishes the Patients' Bill of Rights for individuals admitted to licensed health facilities. Among other protections, this statute guarantees patients the right to access their medical records and to receive copies upon request. Paragraph X of the statute also sets the copy charge at those facilities: not more than $15 for the first 30 pages or $.50 per page, whichever is greater.

Record Destruction Requirements

When the retention period expires, New Hampshire providers must follow proper destruction procedures to protect patient privacy.

HIPAA Destruction Standards

The HHS Office for Civil Rights requires that protected health information be disposed of in a manner that renders it unreadable and indecipherable. Acceptable destruction methods include:

For paper records:

• Cross-cut shredding
• Burning
• Pulping
• Pulverizing

For electronic records:

• Clearing (overwriting with non-sensitive data)
• Purging (degaussing or exposing media to a strong magnetic field)
• Physical destruction (disintegration, pulverization, melting, incinerating, or shredding of media)

Simply deleting files or placing paper records in a regular trash bin does not satisfy HIPAA requirements. Providers who improperly dispose of records face civil penalties that scale with the level of culpability. Under the HIPAA civil monetary penalty tiers at 45 CFR 160.404, as adjusted for inflation in the January 28, 2026 HHS notice, penalties range from $145 to $73,011 per violation depending on the tier, with the top tier (willful neglect, not corrected) reaching up to $2,190,294 per violation. Total penalties for identical violations are capped at $2,190,294 per calendar year.

Documentation of Destruction

Healthcare providers should maintain a permanent destruction log that includes:

• The date records were destroyed
• A description of the records
• The method of destruction used
• A certificate of destruction from the vendor (if using a third-party service)

These destruction logs help demonstrate compliance during audits and should be kept indefinitely.

Practice Closure and Record Custody

When a physician retires or a practice closes in New Hampshire, specific obligations apply to protect patient access to their records.

Physician Notification Requirements

The New Hampshire Board of Medicine expects physicians who are closing a practice to:

• Send written notice to all active patients at least 30 days before the closure date
• Inform patients of their right to obtain copies of their records or transfer them to another provider
• Provide the name and contact information of the custodian who will store records after closure
• Specify the date the practice will stop seeing patients

Appointing a Records Custodian

A physician who is closing a practice must arrange for a custodian to manage patient records for the remainder of the retention period. Options include:

• Another physician or practice that agrees to accept the records
• A hospital willing to store the records
• A commercial medical records storage company
• A professional records custodian service

The custodian must maintain the records securely, respond to patient requests for copies, and comply with all HIPAA privacy and security requirements.

Hospital Closure

As noted above, He-P 802.21 requires hospitals to arrange for 7 years of storage and access to records if the facility ceases operation. The New Hampshire Department of Health and Human Services oversees compliance with this requirement.

Retention Summary Table