New York Medical Records Retention Laws (2026 Guide)

New York requires physicians to retain patient records for at least 6 years under N.Y. Educ. Law 6530(32), which sets that floor without naming a start date, and hospitals to keep records for at least 6 years from discharge under 10 NYCRR 405.10. Minor patient records must be held longer, to age 19, 21, or 22 depending on the license and the setting.

New York has detailed rules governing how long physicians, hospitals, and other healthcare providers must retain patient medical records. These requirements come from multiple sources of law, including the New York Education Law, the Public Health Law, state regulations, and federal rules from HIPAA and CMS.

This guide covers every major retention requirement, explains how long hospitals keep medical records compared with physician offices, breaks down patient access rights and copy fees, and answers common questions about record destruction and practice closures.

How Long Must Physicians Keep Medical Records in New York?

Under New York Education Law 6530, subdivision 32, physicians licensed in New York must maintain a medical record for every patient that accurately reflects the evaluation and treatment provided. Failure to do so constitutes professional misconduct.

The statutory retention period itself is short and unqualified. In the words of the subdivision, "[u]nless otherwise provided by law, all patient records must be retained for at least six years."

What the statute does not do is fix a start date. Subdivision 32 names no trigger event, so it does not say on its face that the six years run from the patient's last visit, from the last treatment, or from the date of the entry. Measuring the clock from the date of the last visit or treatment is the standard practice guidance in New York and the conservative approach, but it is guidance rather than statutory language. Where another law sets a longer or more specific period, such as the hospital regulation or a profession-specific Rule of the Board of Regents discussed below, that rule controls.

This 6-year minimum applies to all types of physician records, including office visit notes, test results, imaging orders, referral documentation, and treatment plans.

Records of Minors and Obstetrical Records

The statute sets a separate floor for two categories of record:

"Obstetrical records and records of minor patients must be retained for at least six years, and until one year after the minor patient reaches the age of eighteen years." Education Law 6530(32)

In practice, this means a physician must hold a minor's records until the patient turns 19 at minimum.

For example, if a physician treats a 5-year-old patient and never sees that patient again, the record cannot be destroyed until the patient reaches age 19. That is 14 years of retention, well beyond the standard 6-year rule.

If a physician treats a 16-year-old, the 6-year rule (ending when the patient is 22) actually exceeds the minor rule (age 19), so the record must be kept for 6 years.

Watch out: New York's minor-record ages differ by license and setting, and they get mixed up constantly. Nineteen is the physician figure under Education Law 6530(32). Twenty-one is the hospital figure under 10 NYCRR 405.10(a)(4). Most other licensed health professions answer to a third figure, age 22, under Rule of the Board of Regents 8 NYCRR 29.2(a)(3), covered in the practice-closure section below. Guidance written for one of these does not transfer to the others.

Professional Misconduct Consequences

The New York State Board for Professional Medical Conduct enforces these requirements. A physician who fails to maintain adequate records or destroys records prematurely may face disciplinary action, including fines, license suspension, or revocation.

Hospital Medical Records Retention Requirements

Hospitals in New York operate under a separate and somewhat stricter set of retention rules. These come from 10 NYCRR 405.10, the state regulation governing hospital medical record services, issued under the authority of Public Health Law Article 28.

Under 10 NYCRR 405.10, hospitals must retain medical records in their original or legally reproduced form for at least 6 years from the date of discharge.

Hospital Records of Minors

The minor patient rule for hospitals is more generous than the physician rule. Hospitals must keep records of minor patients for at least 6 years after discharge or 3 years after the patient reaches the age of 18 (effectively until age 21), whichever is longer.

This means hospitals retain minor records for up to 3 years longer than private physician offices are required to, depending on the patient's age at the time of treatment.

Records After a Patient's Death

Hospitals must retain patient records for at least 6 years after the death of the patient. This applies regardless of whether the patient died at the hospital or elsewhere, as long as the hospital holds records for that individual.

Federal Requirements: HIPAA and CMS

HIPAA Does Not Set a Retention Period

A common misconception is that HIPAA requires providers to keep medical records for a specific number of years. According to the U.S. Department of Health and Human Services, the HIPAA Privacy Rule does not include medical record retention requirements. State laws generally govern how long medical records must be retained, though other federal programs impose their own periods, as the Medicare rules below do.

However, HIPAA does require covered entities to maintain their privacy policies, procedures, notices, and complaint records for at least 6 years from the date of creation or last effective date.

HIPAA also requires that when records are eventually destroyed, the disposal must render protected health information (PHI) essentially unreadable, indecipherable, and unable to be reconstructed.

CMS and Medicare Requirements

Providers who participate in Medicare face an additional federal rule from the Centers for Medicare and Medicaid Services (CMS), and its reach is narrower than it is usually described. 42 CFR 424.516(f) sits in the Medicare enrollment regulations, under "Requirements for Establishing and Maintaining Medicare Billing Privileges."

It binds two parties. A provider or supplier that furnishes covered ordered, certified, referred, or prescribed Part A or B services, items or drugs must keep the documentation for 7 years from the date of service and give CMS or a Medicare contractor access to it on request. The physician or other eligible professional who ordered, certified, referred, or prescribed those services carries the same 7-year duty.

What the 7 years covers is defined just as narrowly. The rule reaches "written and electronic documents ... relating to written orders, certifications, referrals, prescriptions, and requests for payments for Part A or B services, items or drugs." That is a documentation rule attached to ordered and referred items, not a blanket 7-year rule for every Medicare patient's complete medical record.

For hospitals specifically, the Medicare Conditions of Participation at 42 CFR 482.24 require hospitals to have a medical record service and to maintain a complete medical record for every individual evaluated or treated. That section also carries a federal retention floor of its own. Under 42 CFR 482.24(b)(1), "[m]edical records must be retained in their original or legally reproduced form for a period of at least 5 years."

So the frequent claim that no federal rule sets a retention period is only true of HIPAA. A Medicare-participating hospital has a 5-year federal minimum regardless of state law. In New York that floor is not the operative one, because 10 NYCRR 405.10(a)(4) requires six years from discharge and longer for minors and after death, and the longer period governs. The federal 5-year rule matters mainly as the backstop that survives if a state requirement is ever shorter or does not reach a particular record.

For the documentation 424.516(f) does cover, the 7-year federal period runs past New York's 6-year floor, so a New York provider billing Medicare should plan its retention schedule around the longer period.

Patient Access Rights and Copy Fees

Your Right to Access Records

New York Public Health Law Section 18 grants patients and their authorized representatives the right to access their medical records. When a patient submits a written request, the provider must give that patient an opportunity to inspect the records within 10 days.

"[S]ubject to the provisions of subdivision three of this section, upon the written request of any subject, a health care provider shall provide an opportunity, within ten days, for such subject to inspect any patient information..." Public Health Law 18(2)(a)

Read that wording closely. The statute says ten days. It does not say ten business days, and it attaches no business-day qualifier anywhere in the access provisions. A provider that treats the deadline as ten business days is taking roughly two extra calendar weeks the statute does not give it.

The duty is not unconditional, though. It opens by making itself subject to subdivision 3, which sets out the limited grounds on which a provider may withhold patient information and the review process a patient can use when access is denied.

Copies run on a different clock. Under section 18(2)(d), on the written request of a qualified person a provider "shall furnish to such person, within a reasonable time, a copy of any patient information requested." Inspection has the fixed ten-day deadline; copies have a reasonableness standard.

Cost is not a lawful reason to refuse. Public Health Law 18(2)(e) provides that "[a] qualified person shall not be denied access to patient information solely because of inability to pay," and Public Health Law 17 carries the same rule for records sent to a designated physician or hospital: "A release of records under this section shall not be denied solely because of inability to pay." Both sentences are about inability to pay the copying charge. Neither one speaks to an unpaid balance for prior treatment, which is a separate question the access statute does not address in those terms.

Copy Fee Limits

Public Health Law 18(2)(e) sets the ceiling. A provider "may impose a reasonable charge for all inspections and copies, not exceeding the costs incurred by such provider." Within that overall limit:

• Paper copies: No more than $0.75 per page. The statute ties the per-page cap specifically to paper: "the reasonable charge for paper copies shall not exceed seventy-five cents per page."
• Electronic copies: Section 18 sets no separate per-page rate and no separate dollar cap for electronic copies. The general limit still governs, so any charge may not exceed the provider's actual costs incurred.
• Original mammograms: A provider may not charge for copying an original mammogram where the original has already been furnished, and any charge for furnishing an original mammogram "shall not exceed the documented costs associated therewith."
• X-rays and other radiographic materials: No separate per-page rule applies. These fall under the same general reasonable-charge limit, capped at the provider's costs incurred.

Watch out: A "$100 maximum" for electronic copies of New York medical records circulates widely. That figure appears nowhere in Public Health Law 18. The enforceable limits are the 75 cents per page cap on paper copies and the overarching rule that a charge may not exceed the provider's actual costs incurred.

No-Fee Situations

Providers may not charge any fee for providing copies of medical records when the records are requested to support:

• An application for any government benefit or program
• A claim related to a government benefit
• An appeal of a government benefit decision

This includes applications for Social Security disability, Medicaid, veterans' benefits, and similar programs.

Where the provider keeps the record electronically, section 18(2)(e) requires it to "provide the copy in either electronic or paper form, as required by the government benefit or program, or at the patient's request."

Secure Destruction of Medical Records

Once the retention period expires, providers are not required to keep records indefinitely, but they must destroy them properly.

Under HIPAA disposal requirements, covered entities must ensure that PHI is rendered unreadable and cannot be reconstructed before disposal. Acceptable methods include:

• Paper records: Shredding, burning, pulping, or pulverizing
• Electronic media: Clearing (overwriting with non-sensitive data), purging (degaussing), or physical destruction (disintegration, melting, incinerating, or shredding the media)

Simply placing records in a dumpster or recycling bin without rendering them unreadable is a HIPAA violation, even if the retention period has expired.

The New York Department of State also advises all businesses handling personal information to implement secure destruction procedures.

Providers should maintain a destruction log documenting what was destroyed, when, how, and by whom. This creates a defensible record in case questions arise later.

What Happens When a Medical Practice Closes

When a physician retires or a medical practice closes in New York, the retention obligation does not close with the practice. Education Law 6530(32) attaches the six-year clock to the patient record itself, and the subdivision carries no exception for a practice that has shut its doors. Failing to maintain a record for each patient remains professional misconduct.

Public Health Law 17 gives patients a route to their records that survives the end of the treating relationship. On written request, "an examining, consulting or treating physician or hospital must release and deliver" copies of x-rays, medical records and test records "to any other designated physician or hospital." The duty runs to the physician or hospital that examined, consulted on, or treated the patient, so a practice winding down does not extinguish it.

In practice, a patient facing a closing practice can:

1. Request a copy of the record directly under Public Health Law 18
2. Have the record transferred to a new provider of the patient's choosing under Public Health Law 17
3. Ask where the records will be held, since the retention period keeps running after the practice closes

Watch out: New York does not use one minor-record figure for every licensed provider, and the New York State Education Department publishes closing-a-practice guidance profession by profession. Its guideline for physical therapist assistants, for example, says "obstetrical records and records of minor patients must be retained for at least six years and until one year after the minor patient reaches the age of 21 years," and it cites Regents Rule 29.2(a)(3). That rule, 8 NYCRR 29.2, is titled "General provisions for health professions" and reaches more than 30 licensed professions, so its endpoint of age 22 is neither specific to physical therapy nor borrowed from the hospital rule (which runs to age 21). Physicians and physician assistants are the exception to Rule 29.2: Education Law 6530 governs them, and it sets the floor at one year after the patient turns 18. Check the rule written for the specific license rather than applying another profession's figure.

For hospitals, the process is more formal. The New York State Department of Health publishes guidance on medical records from closed hospitals addressing how a closing facility handles the disposition of patient records and how former patients trace them afterward.

Finding Records from Closed Hospitals

If you need records from a hospital that has closed, the Department of Health maintains information about where those records were transferred. Its published guidance gives 1-800-663-6114 as the contact line. Confirm the current number on the Department's own website before relying on it, since agency contact lines change without notice.

Summary of New York Retention Periods