Oklahoma Medical Records Retention Laws (2026 Guide)

Oklahoma hospitals must keep patient records in their permanent files for at least 7 years under Okla. Stat. tit. 63, Section 1-739. The Oklahoma State Department of Health hospital rule, OAC 310:667-19-14, sets a shorter 5-year minimum (or 3 years after the patient's death), so the statute is the controlling floor. Records for minors must be kept until at least age 21. Oklahoma Medicaid providers face a 6-year minimum under OAC 317:30-3-15.

Last verified: September 2026. This page reflects current Oklahoma Statutes Titles 63 and 76 and Oklahoma Administrative Code Title 310, Chapter 667.

Overview of Oklahoma Medical Records Retention Laws

Oklahoma sets hospital record retention in two places, and the two do not match. Okla. Stat. tit. 63, Section 1-739 requires that hospital patient records be maintained in the permanent files of the hospital for a period of not less than seven (7) years. The Oklahoma State Department of Health's hospital licensing rule, OAC 310:667-19-14, sets a shorter 5-year period and falls under the Hospital Standards chapter of Title 310. A statute outranks a conflicting agency rule, so the 7-year period is the floor a hospital should work from.

This regulation applies to all hospitals licensed by the Oklahoma State Department of Health, including general hospitals, critical access hospitals, and emergency hospitals. Physicians in private practice, nursing facilities, and other healthcare providers may also be subject to additional retention requirements depending on their participation in federal programs.

Understanding these retention timelines is essential for both healthcare providers and patients. Providers need to maintain compliance with state and federal regulations. Patients need to know how long their records will be available when they need them for ongoing care, legal matters, or insurance claims.

Hospital Medical Records Retention

General Hospitals

The statutory floor is Okla. Stat. tit. 63, Section 1-739. It requires all hospitals to keep patient records, including admission and discharge notes, histories, results of tests and examinations, nurses worksheets, social service records, and progress notes, and provides that those records shall be maintained in the permanent files of the hospital for a period of not less than seven (7) years.

Under OAC 310:667-19-14, the Health Department's hospital rule sets a shorter period: a minimum of 5 years beyond the date the patient was last seen, or at least 3 years beyond the date of the patient's death. Because a statute controls over a conflicting agency rule, a hospital that destroyed records at year 5 in reliance on the rule alone would still fall short of the seven-year statutory period.

One caveat on how Section 1-739 is codified: it was added by a 1978 act regulating abortion (Laws 1978, c. 207, Section 11), and its middle sentence deals with abortion-specific certifications and reports. Its first and last sentences, however, read on all hospitals and all patient records, and the section remains in force; a conditional repeal enacted in 2021 was itself repealed in 2022. A facility with questions about how the section applies to it should ask its own counsel rather than assume the seven-year period reaches only abortion records.

These timelines are minimum requirements. Hospitals may choose to keep records for longer periods based on their own policies, insurance requirements, or legal counsel recommendations.

Critical Access Hospitals

Critical access hospitals in Oklahoma follow the same retention timelines as general hospitals. Under OAC 310:667-39-11, medical records at critical access hospitals must be retained at least 5 years after the date the patient was last seen or at least 3 years after the date of the patient's death. The seven-year period in 63 O.S. Section 1-739 reads on all hospitals, so it applies to critical access hospitals too and is the longer of the two.

Critical access hospitals must also maintain a medical record for every patient evaluated or treated in the facility. These records must be appropriate to the scope and complexity of services performed and must allow prompt completion, filing, and retrieval.

Emergency Hospitals

Emergency hospitals in Oklahoma are governed by OAC 310:667-40-11, which establishes the same minimum retention period. The rule requires records to be kept for at least 5 years after the patient's last visit or 3 years after the patient's death, and here too the seven-year statutory period in 63 O.S. Section 1-739 is the higher floor.

Physician and Private Practice Retention

Oklahoma does not have a separate statute that sets a specific medical records retention period for physicians in private practice outside of the hospital setting. However, several rules apply in practice.

The Oklahoma State Board of Medical Licensure and Supervision expects physicians to maintain adequate medical records as part of their professional responsibilities. Physicians who fail to maintain proper records may face disciplinary action.

As a practical matter, most Oklahoma physicians look to the hospital retention rules as a benchmark. Many retain records for 7 to 10 years as a safeguard against potential malpractice claims, since Oklahoma's statute of limitations for medical negligence allows lawsuits to be filed within 2 years of discovering the injury.

Physicians participating in Oklahoma Medicaid must retain records for 6 years under OAC 317:30-3-15. This applies to any records necessary to disclose the extent of services furnished to recipients.

Minor Records Retention in Oklahoma

Oklahoma law provides extended protection for the medical records of minors. Under OAC 310:667-19-14, records of newborns or minors must be retained for 3 years past the age of majority.

The age of majority in Oklahoma is 18 years old, as defined in Oklahoma Statutes Title 15, Section 13. This means hospitals and healthcare facilities must keep a minor's medical records until the patient reaches age 21 at a minimum.

In practice, the calculation works as follows:

• A child born today would have records retained until at least age 21
• A 10-year-old patient's records would be retained until at least age 21
• A 16-year-old patient's records would be retained until at least age 21

Where more than one period applies, the facility must keep the records until the latest of them expires: the minor retention rule (age 21), the standard adult period in the Health Department rule, and the seven-year statutory period in 63 O.S. Section 1-739.

For newborns, this extended retention is particularly important because birth records, neonatal care documentation, and early childhood medical information may be needed decades later for medical, legal, or insurance purposes.

Federal Requirements That Affect Oklahoma Providers

HIPAA Documentation Retention

A common misconception is that HIPAA sets a federal retention period for patient medical records. It does not. HIPAA does not tell providers how long to keep patient charts or clinical records.

What HIPAA does require is that covered entities retain their compliance documentation for a minimum of 6 years. Under 45 CFR 164.316(b)(2)(i), this includes:

• Privacy and security policies and procedures
• Business Associate Agreements
• Risk assessments and risk management plans
• Breach notification records
• Employee training records
• Security incident logs
• Notices of Privacy Practices and patient acknowledgments

This 6-year rule applies to the documents that prove a provider followed HIPAA rules. It does not apply to the actual patient medical records.

CMS and Medicare Requirements

Providers who participate in Medicare have additional federal retention obligations. Under CMS Conditions of Participation (42 CFR 482.24), hospitals must maintain medical records in accordance with accepted professional practices.

Key CMS retention rules include:

• Standard Medicare providers: Records related to program reimbursement must be kept for at least 5 years after the closure of the cost report
• Medicare Advantage providers: Records must be retained for 10 years from the date of service
• Oklahoma Medicaid providers: Records must be retained for 6 years under OAC 317:30-3-15

Because federal requirements can exceed Oklahoma's state minimums, providers who accept Medicare or Medicaid should follow whichever timeline runs longest.

Patient Access to Medical Records in Oklahoma

Oklahoma law gives patients a clear right to access their own medical records. Under Oklahoma Statutes Title 76, Section 19, any person who is or has been a patient of a doctor, hospital, or other medical institution is entitled to obtain access to the information contained in their medical records.

This right extends to:

• All information in the patient's medical record
• X-rays and other photographs or images
• Pathology slides
• Medical bills associated with care

Fees for Records Copies

Oklahoma law sets specific limits on what providers can charge for medical records copies:

• Patient requests: $0.50 per page
• Attorney, insurance company, or subpoena requests: $20.00 base fee plus $0.50 per page, plus postage or delivery fees

Records of Deceased Patients

Access to a deceased patient's records requires either a court order or a written release from an executor, administrator, personal representative, or surviving spouse. If none of those exist, a responsible family member (parent, adult child, adult sibling, or other adult relative who was actively involved in the patient's care) may authorize the release.

Mental Health Records Exception

Oklahoma law carves out an exception for psychological, psychiatric, mental health, and substance abuse treatment records. Access to these records is governed separately under Title 43A, Section 1-109 of the Oklahoma Statutes rather than the general medical records access law.

Response Timeline

Title 76, Section 19 gives patients the right of access and caps what a provider may charge, but it does not set a deadline for responding to a request. The 30-day window comes from federal law instead. Under 45 CFR 164.524(b)(2), a HIPAA covered entity must act on a request for access no later than 30 days after receiving it, and it may take a single extension of up to 30 more days if it tells the patient in writing why and when the request will be completed.

Record Storage and Preservation Methods

Oklahoma law recognizes that hospitals may need to use technology to preserve records while conserving physical storage space. Under OAC 310:667-19-14, hospitals may:

• Microfilm records
• Transfer records to optical disk
• Use similar recording technology

Once records are converted to these formats, hospitals may destroy the original paper records. The regulation specifies that records reconstituted from technology employed to conserve space are considered the same as the original. Retaining the digitally preserved record satisfies all preservation requirements.

Most modern Oklahoma healthcare facilities now maintain electronic health records (EHR) systems, which satisfy the storage requirements as long as the records remain accessible and retrievable throughout the required retention period.

Proper Destruction of Medical Records

When the retention period has expired, Oklahoma healthcare providers must still follow proper procedures when destroying medical records. While Oklahoma law does not specify exact destruction methods, federal HIPAA requirements under the HHS disposal guidance apply to all covered entities.

Paper Records

The U.S. Department of Health and Human Services recommends these methods for destroying paper records containing protected health information:

• Shredding (cross-cut shredders recommended)
• Burning
• Pulping
• Pulverizing

Records must be rendered unreadable, indecipherable, and unable to be reconstructed.

Electronic Records

For electronic records, HHS recommends:

• Clearing: Overwriting media with non-sensitive data
• Purging: Degaussing or exposing media to a strong magnetic field
• Destroying: Disintegration, pulverization, melting, incinerating, or shredding the physical media

Providers should obtain a Certificate of Destruction from any third-party destruction service to document compliance. Any third party that handles protected health information during the destruction process must sign a Business Associate Agreement.

What Happens When a Practice Closes in Oklahoma

When a hospital closes in Oklahoma, OAC 310:667-19-14 requires the facility to inform the Oklahoma State Department of Health about the disposition of its records. The disposition must protect the integrity of the information contained in the medical records.

Records from closed facilities must still be retained and disposed of in a manner consistent with the statute of limitations. This means the retention periods, including the seven-year statutory minimum and the longer periods for minors and federal program participants, continue to apply even after the facility ceases operations.

For physicians closing a private practice, the Oklahoma Board of Medical Licensure and Supervision provides guidance that includes:

• Notifying patients with adequate advance notice
• Arranging for transfer or storage of records with a qualified custodian
• Ensuring patients can access their records during the transition
• For deceased physicians in solo practice, original records of patients not seen in the past 7 years may be given directly to the patient

Oklahoma does not have a specific statute requiring a set notice period before practice closure, but the Board expects physicians to provide reasonable advance notice to allow patients to arrange for records transfer and continuity of care.