Ohio Medical Records Retention Laws (2026 Guide)

Ohio licensed health care facilities must retain patient medical records for at least six years from the date of discharge under OAC 3701-83-11. Nursing homes must keep records for seven years. Ohio has no single statute setting a retention period for private physician offices, though the Ohio State Medical Board recommends six years.

Ohio medical records retention laws establish how long hospitals, physicians, and other healthcare providers must preserve patient health information. The primary state regulation, OAC 3701-83-11, requires licensed health care facilities to maintain medical records for at least six years from the date of patient discharge.

Understanding these rules is important for both providers and patients. Providers who destroy records too early face potential disciplinary action, criminal liability, and malpractice exposure. Patients who need old medical records should know how long their provider is required to keep them and what rights they have to access their files.

This guide covers all Ohio-specific retention requirements for hospitals and physicians, rules for minor and deceased patient records, federal requirements under HIPAA and CMS, patient access rights, proper destruction procedures, and what happens when a medical practice closes.

Ohio Hospital Medical Records Retention Requirements

Ohio law sets clear retention requirements for hospitals and other licensed health care facilities. The Ohio Department of Health administers these rules under the Ohio Administrative Code (OAC) Chapter 3701-83.

The Six-Year Hospital Retention Rule

OAC 3701-83-11 establishes the general medical records requirements for all licensed health care facilities (HCFs) in Ohio. Under this rule, each HCF must maintain medical records as necessary to verify the information and reports required by statute or regulation for at least six years from the date of discharge.

This six-year minimum applies to all facility types licensed under OAC Chapter 3701-83, including hospitals, ambulatory surgical facilities, freestanding dialysis centers, freestanding birthing centers, freestanding radiation therapy centers, and freestanding or mobile diagnostic imaging centers.

The six-year clock begins on the date of patient discharge, not the date of the last entry in the record. This distinction matters for patients with extended hospital stays or those who receive ongoing care at the same facility.

What Hospital Records Must Include

Under OAC 3701-83-11, each health care facility must maintain a medical record for each patient that documents the patient's needs, assessments, and services rendered. Records must be legible and accessible to staff involved in patient care.

At a minimum, hospital medical records should contain:

• Patient identification and demographic information
• Admission and discharge dates
• History and physical examination findings
• Physician orders and progress notes
• Operative reports and pathology findings
• Nursing notes and medication administration records
• Diagnostic test results and laboratory reports
• Discharge summary with follow-up instructions

Facilities must also maintain an adequate medical record keeping system and take appropriate measures to protect medical records against theft, loss, destruction, and unauthorized use. Policies and procedures must be in place to ensure the confidentiality of patient medical records.

Additional Facility-Specific Requirements

Some facility types in Ohio have additional or overlapping medical records rules:

Ohio nursing homes must retain all records and reports required by OAC rules 3701-17-01 through 3701-17-26 for seven years. If the resident is a minor, OAC 3701-17-19 requires the records be maintained for three years past the age of majority, but not less than seven years. Upon closure of a nursing home, the operator must provide for the retention of records in a secured manner for not less than seven years and notify the director of the Ohio Department of Health of the location where records will be stored.

Nursing home residents and former residents, or their legal representatives, have the right to access their medical and financial records within 24 hours of request (excluding holidays and weekends). Photocopies must be provided within two working days of advance notice at a cost not exceeding the community standard for photocopying, unless otherwise specified by law.

Physician and Private Practice Retention Requirements

Ohio does not have a single statute that mandates how long private physicians must retain patient medical records. This distinguishes Ohio from some states that set explicit retention periods for all provider types.

The Six-Year Best Practice Standard

Although no Ohio statute directly mandates a specific retention period for private physician offices, the Ohio State Medical Board recommends that physicians retain their records for at least six years. This recommendation is grounded in several overlapping requirements.

ORC 2913.40(D) mandates that any person who has submitted a claim for or provided goods or services under the Medicaid program must retain all records dealing with the treatment of a Medicaid patient for a period of at least six years after reimbursement is received. This includes medical, professional, financial, and business records relating to treatment, care, or goods and services provided to Medicaid recipients.

As a condition of participation in the federal Medicare program, healthcare providers agree to retain all records dealing with the treatment of a Medicare patient for a period of at least five years. Most practices serve both Medicaid and Medicare patients, making the six-year standard the practical minimum.

AMA Ethical Standards and Medical Board Enforcement

Under ORC 4731.22(B)(18), physicians licensed in Ohio can be disciplined by the Ohio State Medical Board for violating any of the American Medical Association's ethical rules. AMA Opinion 7.05 specifically addresses medical record retention and states that medical considerations are the primary basis for deciding how long to retain medical records.

The AMA recommends that physicians retain medical records for at least 10 years from the date of last treatment when possible. The AMA also states that immunization records should be kept indefinitely and that records of minor patients should be retained for longer periods.

Because the Medical Board can discipline physicians for violating AMA ethical guidelines, Ohio physicians who destroy records prematurely face potential regulatory consequences beyond the six-year Medicaid retention floor.

Why Physicians Should Consider Longer Retention

Even without a single mandatory retention statute, Ohio physicians who destroy records before the six-year mark face several risks:

• Criminal liability under ORC 2913.40 for destroying Medicaid patient records
• Inability to defend against a malpractice claim filed within the statute of limitations
• Medical Board discipline for violating AMA ethical standards
• Loss of documentation needed for Medicare or Medicaid billing audits
• Potential liability if a patient suffers harm due to a provider not having access to prior treatment history

The Ohio Health Information Management Association (OHIMA) and the Ohio State Medical Association both recommend that physicians retain medical records indefinitely when feasible.

Records of Minor Patients

Ohio applies special retention considerations for the medical records of children. These extended retention periods reflect the tolling of the statute of limitations during a patient's minority.

Statute of Limitations Tolling for Minors

Under ORC 2305.16, if a person entitled to bring any action is within the age of minority at the time the cause of action accrues, the person may bring the action within the respective time limits after the disability is removed. In practical terms, the statute of limitations clock does not begin running until the minor reaches 18 years of age.

Under ORC 2305.113, an action for medical malpractice generally must be commenced within one year after the cause of action accrues, with an absolute outer limit of four years from the occurrence of the act or omission constituting the alleged basis of the claim. That four-year outer limit, however, expressly excepts persons within the age of minority under ORC 2305.16. For a minor, the four-year repose period does not apply at all; instead, the tolling provision suspends the malpractice clock entirely during minority, and the statute's time limits do not begin running until the minor turns 18.

Recommended Retention Period for Minor Records

Based on the tolling provisions, Ohio healthcare providers should retain medical records of minor patients for at least six years beyond the child's 18th birthday (until age 24). This conservative buffer applies the same six-year retention floor used elsewhere in Ohio's rules, measured from the point where the tolling ends and the malpractice filing period under ORC 2305.113 begins to run.

For hospitals, the standard six-year post-discharge rule in OAC 3701-83-11 still applies. If a child is treated at age 5 and discharged, the hospital must keep the record for at least six years (until the child is 11). However, best practice dictates retaining the record until the child turns 24 to cover the tolled malpractice period.

Providers should always apply the longer retention period when state rules and best practice recommendations conflict.

Practical Example

Consider a child born in 2020 who receives treatment at an Ohio hospital in 2023 (age 3) and is discharged:

• The hospital's six-year retention rule requires keeping the record until 2029
• The statute of limitations tolling means the child cannot file a malpractice claim until after turning 18 in 2038
• ORC 2305.113(C)'s four-year statute of repose expressly excepts minors, so it does not add four more years after age 18; the malpractice filing period instead begins running once the tolling ends in 2038
• Best practice: retain the record until at least 2044 (age 24) as a conservative buffer beyond the 2038 tolling cutoff

This extended timeline shows why pediatric providers and children's hospitals often retain records far beyond the standard six-year period.

Federal Requirements: HIPAA and CMS

Ohio providers must comply with both state and federal medical records requirements. When state and federal rules conflict, the stricter standard applies.

HIPAA Documentation Requirements

One of the most common misconceptions is that HIPAA requires providers to keep patient medical records for a specific number of years. It does not.

HIPAA requires covered entities to retain HIPAA-related administrative documentation for six years from the date of creation or the date when the document was last in effect, whichever is later, under 45 CFR 164.530(j). This six-year requirement covers:

• Privacy and security policies and procedures
• Business associate agreements
• Patient authorization forms
• Training records
• Complaint and resolution documentation
• Risk assessments and audit logs

The six-year rule applies to compliance paperwork only, not to patient treatment records. How long actual patient medical records must be kept is determined by state law.

HIPAA Privacy and Security Protections

While HIPAA does not dictate retention periods for medical records, it does require that all protected health information (PHI) be safeguarded for as long as it exists. This means that even after a record has passed the minimum retention period, if it has not been destroyed, it must continue to be protected under HIPAA privacy and security standards.

Any disclosure of patient medical records must be permitted under HIPAA and applicable Ohio law. Ohio providers may not disclose individual medical records except as provided by state and federal laws and regulations, per OAC 3701-83-11.

CMS and Medicare Requirements

CMS Conditions of Participation establish separate federal minimums for providers participating in Medicare or Medicaid:

For Ohio hospitals that participate in Medicare, the state's six-year requirement exceeds the federal five-year minimum. Ohio's stricter standard controls, meaning these hospitals must retain records for six years.

For Ohio physician offices that accept Medicare, the federal seven-year requirement exceeds Ohio's six-year recommendation for private practices. This means Medicare-participating Ohio physicians must retain records for at least seven years from the date of service.

Ohio providers participating in Medicaid must retain records for at least six years after reimbursement is received, per ORC 2913.40(D). When combined with the CMS Medicare requirement, physicians treating both Medicare and Medicaid patients should retain records for at least seven years.

Patient Access to Medical Records in Ohio

Ohio law and federal law both guarantee patients the right to access their medical records.

State Law: ORC 3701.74

Under ORC 3701.74, a health care provider that has a patient's medical records must permit the patient to examine the record during regular business hours without charge or provide a copy of the record upon request. To exercise this right, the patient or authorized representative must submit a written request that is:

• Signed and dated not more than one year before submission
• Specifying whether the copy should be sent to the requestor, sent to a physician or other provider, or held at the health care provider's office

If a treating physician determines for clearly stated treatment reasons that disclosure would likely have an adverse effect on the patient, the provider may furnish the record to a physician or other qualified professional instead of directly to the patient.

If a health care provider fails to furnish a medical record as required by ORC 3701.74, the patient, personal representative, or authorized person may bring a civil action to enforce the patient's right of access.

Fee Limits Under ORC 3701.741

Under ORC 3701.741, Ohio law limits the fees that providers can charge for copies of medical records. The limits work differently depending on who is asking.

Requests by the patient or the patient's representative. Under ORC 3701.741(B)(1)(a), where the request comes from the patient, the patient's personal representative, or an individual authorized through a valid power of attorney, the total cost for copies and all related services must be a reasonable, cost-based amount permitted to be charged to the patient under federal law, and any per-page charge may not exceed the sum of the per-page charges authorized in divisions (B)(2)(b) and (B)(2)(c). Ohio sets no separate per-page schedule for patient requests. The federal cost-based standard governs, and the statutory per-page figures operate only as an outer ceiling.

Electronic access or electronic transmission. Under ORC 3701.741(B)(1)(b), where the patient requests access to digital records or asks that records be transmitted electronically, the total cost for that access or transmission and all related services may not exceed fifty dollars.

Requests by anyone else. ORC 3701.741(B)(2) sets a schedule that applies when the request is made by anyone other than the patient or the patient's representative. The amounts written into the statute are base figures:

Those base amounts are adjusted every year for inflation. Under ORC 3701.742, the director of health adjusts them by the average change in the Consumer Price Index for all urban consumers and must make the list of adjusted amounts available to the public on the Ohio Department of Health website. The figure a provider may actually charge is the current adjusted amount, not the base amount printed in the statute, so check the department's published list before relying on any number.

When a copy must be provided free of charge. ORC 3701.741(C)(1) requires one free copy of the record, plus one copy of records for treatment performed after the original request, only for a short list of requesters: the Bureau of Workers' Compensation, the Industrial Commission, the Department of Medicaid or a county department of job and family services, the Attorney General, and a patient or the patient's representative where the medical record is necessary to support a claim under Title II or Title XVI of the Social Security Act and the request is accompanied by documentation that a claim has been filed. Division (C)(2) adds that nothing in (C)(1) requires a provider or medical records company to furnish a free copy to anyone not on that list. A patient who is not supporting a filed Social Security claim has no general right to a free copy under Ohio law, though ORC 3701.74 still allows the patient to examine the record in person without charge.

Federal Law: HIPAA Right of Access

Under the HIPAA Privacy Rule, patients have the right to inspect and obtain copies of their protected health information. Key provisions include:

• Providers must respond to a records request within 30 calendar days
• An additional 30-day extension is permitted with written notice explaining the delay
• For electronic copies of electronically maintained records, providers may charge a flat fee of $6.50 or less
• Providers cannot deny access because of unpaid bills, old records, or inconvenience
• Limited exceptions exist for psychotherapy notes, information compiled for legal proceedings, and certain lab results

The 21st Century Cures Act further strengthened patient access by prohibiting information blocking. Penalties for information blocking can reach up to $1 million per violation for health IT developers.

Proper Destruction of Medical Records

Once medical records have been retained for the required period, Ohio healthcare providers may destroy them. However, destruction must follow specific procedures to protect patient privacy.

HIPAA Destruction Standards

HIPAA requires that destroyed records be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed." Approved methods include:

Paper records: Shredding, burning, pulping, or pulverizing. Cross-cut shredding is preferred over strip-cut shredding because strip-cut documents can potentially be reassembled.

Electronic records: Clearing (overwriting with non-sensitive data), purging or degaussing (using a strong magnetic field to erase data), or physical destruction of the storage media such as hard drives, disks, or tapes.

Records may never be placed in dumpsters, recycling bins, or other publicly accessible containers. Providers who use a third-party destruction service must have a HIPAA business associate agreement in place with that vendor.

Ohio-Specific Destruction Considerations

Ohio does not have a specific state statute requiring patient notification before destroying medical records that have exceeded the retention period. However, the Ohio State Medical Association and AMA ethical guidelines recommend that physicians:

• Make an attempt to contact the patient and give the patient a reasonable opportunity to claim the records or have them sent to another physician
• Document the date and method of destruction
• Maintain a log of destroyed records (patient name, record dates, destruction date, destruction method)
• Keep the destruction log indefinitely for compliance verification
• Verify that all copies of the record, including backup tapes and off-site storage, are destroyed

All documentation containing protected health information must be destroyed in a manner that prevents reconstruction. If destruction services are contracted, the contract must meet the requirements of the HIPAA privacy and security rules, and a business associate agreement must be executed with the contractor.

Penalties for Improper Destruction

HIPAA civil penalties for improper disposal of protected health information are adjusted annually for inflation under 45 CFR 160.404. As of the January 2026 inflation adjustment, per-violation penalties range from $145 (lowest culpability tier) up to $73,011 per violation (any tier), with a calendar-year cap of $2,190,294 for identical violations. Criminal penalties for knowing violations can reach $250,000 and 10 years of imprisonment.

Under ORC 2913.40, knowingly altering, falsifying, destroying, concealing, or removing Medicaid records within the six-year retention period is a criminal offense. Violations constitute Medicaid fraud and carry penalties based on the amount of the resulting overpayment.

What Happens When an Ohio Practice Closes

When an Ohio physician retires, relocates, or closes a practice, the provider must still ensure patient records are preserved for the remaining retention period. Ohio has specific rules governing the notification process.

OAC 4731-27-03: Patient Notification Requirements

Under OAC 4731-27-03, when a physician leaves a practice, sells a practice, or retires from the practice of medicine, the physician must notify all patients who received services within the two years immediately preceding the physician's last date for seeing patients.

The notice must be sent no later than 30 days prior to the last date the physician will see patients, or upon actual knowledge that the physician will be leaving. If acute illness or unforeseen emergency prevents advance notice, the physician must provide notice no later than 30 days after it is determined that the physician will not return.

Methods and Content of Notice

Notice may be provided using one of two methods:

• A letter sent via regular mail to the last address for the patient on record, with the date of mailing documented in the patient file
• An electronic message sent through a HIPAA-compliant electronic medical record or electronic health record system

The notice must include a statement that the physician will no longer practice at the location, the date services will cease, new contact information if practicing elsewhere, contact information for alternative physicians who can provide care, and information about how the patient can obtain their medical records.

ORC 4731.228: Employed Physician Notification

Under ORC 4731.228, when a physician's employment with a health care entity is terminated, the health care entity must send notice to each patient who received physician services from the departing physician within the two-year period before the termination date.

The notice must be provided no later than the date of termination or 30 days after the health care entity has actual knowledge of the termination or resignation, whichever is later. The notice must include the physician's name, new contact information (when available), the date the physician ceased or will cease practicing at the entity, and contact information for alternative providers.

Consequences for Failure to Notify

A physician's failure to provide notice in accordance with OAC 4731-27-03 constitutes "a departure from, or failure to conform to, minimal standards of care of similar practitioners under the same or similar circumstances." This can form the basis for Medical Board discipline under ORC 4731.22.

Recommended Steps for Practice Closure

When closing an Ohio medical practice, providers should:

1. Notify patients in writing. Send a letter to all patients seen within the past two years informing them of the closure date and explaining how they can obtain their records or have them transferred to another provider.

2. Provide adequate notice. Give patients at least 30 days of notice before the practice closes or the physician's last day.

3. Offer records transfer. Include a consent form authorizing the transfer of records to a new provider of the patient's choice.

4. Arrange for a records custodian. If records must be retained beyond the closure date, arrange for a custodian (another provider, a medical records storage company, or a local hospital) to maintain the records for the remaining retention period.

5. Notify the Ohio State Medical Board. The Ohio State Medical Board should be informed of the closure and the arrangements made for record storage.

6. Continue HIPAA protections. All records, whether retained by a custodian or transferred to patients, must continue to be protected under HIPAA privacy and security standards.

Records of Patients Who Cannot Be Reached

For patients who do not respond to the closure notification, the provider must still arrange for proper storage of their records for the full retention period. Records cannot be destroyed simply because the patient did not respond.

Ohio Medical Records Retention Summary Table

The following table summarizes the key retention requirements for Ohio healthcare providers: