Oregon Medical Records Retention Laws (2026 Guide)

Oregon hospitals must retain patient medical records for at least 10 years after discharge under OAR 333-505-0050. The Oregon Medical Board recommends physicians keep records for at least 10 years from a patient's last contact. Certain hospital records, including master patient indexes and delivery registers, must be kept permanently.

Last verified: March 2026. This page reflects current Oregon Administrative Rules Chapter 333, Division 505, and Oregon Medical Board guidance, along with applicable federal regulations.

Table of Contents

• Overview of Oregon Medical Records Retention Laws
• Hospital Records Retention Requirements
• Physician Records Retention Requirements
• Permanent Records and Master Patient Index
• Medical Records for Minor Patients
• Federal Requirements: HIPAA and CMS
• Patient Access to Medical Records
• Proper Destruction of Medical Records
• Practice Closure and Records Transfer
• Hospital Closure and Ownership Changes
• Frequently Asked Questions
• Sources and References

Overview of Oregon Medical Records Retention Laws

Oregon regulates medical records retention through a combination of state administrative rules and medical board guidance. The primary regulation is OAR 333-505-0050, which governs hospital medical records under the Oregon Health Authority's Public Health Division. The Oregon Medical Board provides separate guidance for physicians, physician assistants, and acupuncturists licensed under OAR Chapter 847.

These state rules set minimum retention periods. Healthcare providers may always choose to retain records longer than required. Federal requirements from HIPAA and the Centers for Medicare and Medicaid Services (CMS) may also apply, and providers must follow whichever standard requires the longest retention period.

Oregon law permits medical records to be stored in their original paper form, microfilm, electronic format, or other media. The key requirement is that records remain legible, reproducible, and protected against unauthorized access, fire, water, and theft.

Quick Reference Table:

Hospital Records Retention Requirements

Under OAR 333-505-0050, hospitals in Oregon must maintain a medical record for every patient admitted for care. The general retention requirement is a minimum of 10 years after the date of patient discharge.

The 10-year clock starts on the date of discharge, not the date of admission or the date of the last entry in the record. For patients with multiple hospital stays, each admission and discharge creates a separate retention period for that particular set of records.

Hospital medical records must contain comprehensive documentation including admission data, chief complaint, medical history, physical examination findings, clinical notes, physician orders, laboratory reports, X-ray reports, consultation records, medication documentation, discharge summaries, and final diagnoses.

All entries in a patient's medical record must be dated, timed, and authenticated. Authentication requires a unique identifier, which may include a written signature, initials, code, password, or other computer or electronic means. Records must be completed and closed within four weeks of patient discharge by the attending qualified medical staff member.

Surgical Patient Records

Hospitals must maintain additional documentation for surgical patients, including preoperative history, anesthesia records, operative descriptions, postoperative notes, and pathology reports. These records follow the same 10-year retention period as general medical records.

Emergency Department and Outpatient Records

Emergency department and outpatient records must include patient identification, diagnoses, physical findings, laboratory and X-ray reports, treatment records, and attending physician authentication. While the records themselves follow the 10-year retention period, emergency room and outpatient registers must be kept for at least 7 years.

Obstetrical and Newborn Records

Obstetrical records require prenatal care documentation, labor and delivery records, and anesthesia documentation. Newborn and stillborn records must include birth vital statistics, mother identification, eye prophylaxis records, physical examinations, and newborn hearing screening test results.

Physician Records Retention Requirements

The Oregon Medical Board provides retention guidance for physicians, physician assistants, and acupuncturists (OMB licensees). The Board recommends that licensees retain patient records, including those of deceased patients, for a minimum of 10 years after the patient's last contact with the provider.

An important distinction: the Oregon Medical Board describes this as guidance rather than a mandatory regulatory requirement. However, the Board notes that following this guideline helps licensees meet the Oregon statute of limitations for medical malpractice under ORS 12.110.

Under ORS 12.110(4), medical malpractice claims in Oregon must be filed within two years from the date the injury is discovered, subject to an absolute five-year statute of repose from the date of treatment. Because a patient could potentially file a claim up to five years after treatment, and legal proceedings may take additional time, the 10-year retention recommendation provides a reasonable buffer beyond the maximum litigation window.

If space permits, the Board recommends indefinitely retaining records of all living patients. This practice supports continuity of care and ensures records remain available for any future medical or legal needs.

The physician retention period runs from the date of the patient's last contact with the licensee, not from a specific discharge date. This means the clock resets each time a patient visits the provider. For a patient who sees their primary care physician annually, the 10-year period only begins running from the most recent visit.

Permanent Records and Master Patient Index

Oregon's hospital regulations require certain categories of records to be maintained permanently. Under OAR 333-505-0050, the following must never be destroyed:

• Patient registers (master patient index)
• Master indices organized alphabetically with numerical cross-referencing
• Delivery registers (birth records)
• Death registers
• Operation registers

These permanent records serve as the institutional memory of the hospital. The master patient index must be organized by diagnosis, operation, and practitioner using standard nomenclature systems. Even when individual patient charts are destroyed after the 10-year retention period expires, these registers allow the hospital to confirm that a patient received care and provide basic information about the nature of that care.

Hospitals must also retain X-rays and diagnostic images with professional interpretations for at least 7 years. Blood banking registers carry a longer retention period of 20 years, reflecting the critical nature of blood transfusion records for tracking potential complications or disease transmission.

Medical Records for Minor Patients

Oregon does not have a specific statute that explicitly extends the general 10-year hospital retention period based on a patient's age at the time of treatment. However, several factors make longer retention periods advisable when treating minor patients.

Statute of Limitations Considerations

Under ORS 12.110(4), a medical malpractice claim must be filed within two years of discovering the injury, but the statute is explicit that, "notwithstanding the provisions of ORS 12.160," the claim is barred five years after the date of treatment no matter when the injury is discovered. The five-year outer limit is not extended by the minor-tolling rule in ORS 12.160: a minor's medical malpractice claim is subject to the same five-year deadline from the date of treatment as an adult's. The only statutory exception is fraud, deceit, or misleading representation that prevented a timely claim, which gives the patient two years from discovering the fraud to sue.

This means a child treated at age 5 generally cannot bring a malpractice claim tied to that treatment after age 10, five years later, even though ORS 12.160 pauses the ordinary limitations period for other kinds of claims involving minors. Because the five-year repose runs from the date of treatment rather than from the child's 18th birthday, records that hospitals keep for 10 years after discharge already extend well past the window in which a minor's malpractice claim over that treatment could be filed.

Best Practice for Minor Records

Even though Oregon's five-year malpractice repose period is not extended by minor tolling, providers may still choose to retain minor patients' records longer than the standard 10-year hospital rule as a general best practice. Industry guidance from the American Health Information Management Association (AHIMA) recommends retaining minors' records for a period tied to the age of majority plus an applicable statute of limitations period, which supports keeping records beyond the minimum hospital retention period as a safety margin for other types of claims minors may bring.

Oregon's dialysis facility regulations under OAR 333-700-0090 provide a useful reference point. That rule explicitly requires pediatric patient records to be kept for at least three years after the age of 18, or for a total of seven years, whichever is longer. While this rule applies specifically to dialysis facilities, it reflects the regulatory intent to provide additional protection for minor patients' records.

Healthcare providers treating children should weigh this dialysis-facility benchmark, along with continuity-of-care and insurance considerations, when deciding how long to retain minor patients' records beyond Oregon's standard hospital and physician minimums.

Federal Requirements: HIPAA and CMS

HIPAA Documentation Retention

The HIPAA Privacy Rule does not require covered entities to retain medical records for any specific period. According to the U.S. Department of Health and Human Services, state laws govern how long medical records must be kept.

However, HIPAA does require covered entities to retain certain compliance-related documentation for 6 years. Under 45 CFR 164.530(j), the following must be retained for 6 years from the date of creation or the date when last in effect, whichever is later:

• Privacy policies and procedures
• Privacy practices notices
• Disposition of complaints
• Required accounting of disclosures
• Training records
• Business associate agreements

This 6-year HIPAA requirement applies to administrative compliance documentation, not to patient medical records themselves.

HIPAA Security Requirements

While HIPAA does not dictate retention periods, it does require that all protected health information (PHI) be safeguarded throughout its lifecycle. Covered entities must implement administrative, technical, and physical safeguards to protect records from unauthorized access, alteration, or destruction for as long as those records exist.

CMS and Medicare Requirements

Healthcare providers that participate in Medicare must comply with additional federal retention requirements. Under 42 CFR 424.516(f), providers and suppliers must maintain documentation for 7 years from the date of service.

This documentation includes written and electronic records related to orders, certifications, referrals, prescriptions, and payment requests for Part A or Part B services. Failure to comply with this requirement can result in revocation of Medicare enrollment under 42 CFR 424.535(a)(10).

For hospitals participating in Medicare, the Conditions of Participation at 42 CFR 482.24 require that medical records be retained in their original or legally reproduced form for a period of at least 5 years. Since Oregon's 10-year hospital retention requirement is longer, the state rule controls.

Oregon's recommended physician retention period of 10 years also exceeds Medicare's 7-year requirement. However, because the Oregon Medical Board's 10-year period is a recommendation rather than a mandatory rule, physicians who participate in Medicare should treat the 7-year federal requirement as a binding minimum.

Patient Access to Medical Records

Under OAR 847-012-0000, Oregon Medical Board licensees must make protected health information in the medical record available to the patient or the patient's representative upon request. A summary may substitute for the actual record only if the patient agrees to the substitution.

Copying Fees

Oregon law establishes specific fee limits for copies of medical records:

• First 10 pages: Up to $30.00 total
• Pages 11 through 50: Up to $0.50 per page
• Pages 51 and above: Up to $0.25 per page
• Expedited delivery bonus: $5.00 if mailed within seven business days
• Postage: Actual cost
• Reproduction costs: Actual cost

A patient may not be denied copies of their medical records because of inability to pay or because of an outstanding bill for services.

Response Timeframe

Providers must comply with records access requests within a reasonable amount of time, not to exceed 30 days from the date the request is received. Written authorization for release of records is governed by ORS 192.558; ORS 192.566 supplies an optional model authorization form that providers may use to meet that requirement.

HIPAA Access Rights

In addition to Oregon state law, 45 CFR 164.524 grants individuals the right to inspect and obtain copies of their protected health information maintained in a designated record set. Covered entities must act on access requests within 30 days, with one 30-day extension permitted.

HIPAA requires that records be provided in the format requested by the individual if readily producible. If not readily producible, the covered entity must provide the records in a readable hard copy or another format agreed upon by both parties.

Parental Access to Minor Records

Parents or guardians generally have the right to access and request amendments to their minor child's medical records in Oregon. However, this right has exceptions. If a healthcare provider reasonably believes that a parent is abusing or neglecting a child, the provider is not required to grant the parent access to the child's records.

Proper Destruction of Medical Records

Once the applicable retention period has expired, Oregon healthcare providers may destroy medical records. However, destruction must be carried out in a manner that protects patient privacy and complies with both state and federal requirements.

HIPAA Destruction Standards

Under HIPAA, covered entities must ensure that protected health information cannot be recovered or reconstructed after destruction. The HHS guidance on disposal of PHI specifies acceptable methods:

• Paper records: Shredding, burning, pulping, or pulverizing so that PHI is rendered unreadable and cannot be reconstructed
• Electronic records: Clearing (overwriting with non-sensitive data), purging (degaussing or exposing media to a strong magnetic field), or physically destroying the storage media through disintegration, pulverization, melting, incineration, or shredding

Oregon-Specific Requirements

Oregon hospitals that wish to destroy medical records after the retention period must follow the procedures outlined in OAR 333-500-0060, which addresses hospital license return and closure procedures. The regulation requires proper Division and public notice before disposal of medical records.

Healthcare providers should maintain a destruction log documenting what records were destroyed, the date of destruction, the method used, and the name of the person who supervised the process. This log should be retained permanently, as it serves as proof that records were handled properly and in compliance with applicable regulations.

Records Under Legal Hold

Providers must not destroy any records that are subject to a litigation hold, a pending subpoena, or any other legal obligation to preserve documents. If a provider is aware of pending or anticipated litigation involving a patient, the records related to that patient must be preserved regardless of whether the standard retention period has expired.

Practice Closure and Records Transfer

When a physician or other Oregon Medical Board licensee closes a medical practice, they remain responsible for ensuring that patient records are properly maintained and accessible.

Notification Requirements

Under OAR 847-012-0000, licensees who retire, relocate, or whose license is revoked or subject to long-term suspension must notify each patient seen within the previous two years in writing via regular mail within 45 days of the change in status. The notice must explain how patients may access or obtain their medical records.

For short-term license suspensions (less than one year), the licensee must notify the Oregon Medical Board within 10 days about patient record access procedures.

Additional Best Practices

The Oregon Medical Board advises licensees ending their practice to:

• Inform patients of the location where their records will be stored
• Advise patients about procedures for accessing their records
• Notify the Oregon Medical Board of the records storage location
• Advise patients to seek alternative healthcare providers
• Forward records to new providers upon receipt of a signed release form

There is no central medical records storage facility in Oregon. Each provider is responsible for arranging appropriate storage or transfer of records when leaving practice.

Records Custodian

Physicians who close their practices should designate a custodian of records to manage patient files for the remainder of the retention period. The custodian may be another physician, a medical records storage company, or another appropriate entity. The Oregon Medical Board should be informed of the custodian's identity and contact information.

Hospital Closure and Ownership Changes

Oregon has specific rules governing what happens to medical records when hospitals change ownership or close permanently.

Change of Ownership

Under OAR 333-505-0050, when a hospital changes ownership, all medical records in original, electronic, or microfilm form must remain in the hospital. The new owner assumes full responsibility for protecting and maintaining these records for the remainder of the applicable retention periods.

Permanent Closure

When a hospital closes permanently, its medical records and required registers may be delivered and turned over to any other hospital in the vicinity that is willing to accept and retain them. The receiving hospital must maintain these records under the same standards that apply to its own patient records.

A hospital that closes permanently must follow the procedures outlined in OAR 333-500-0060 for Division and public notice regarding the disposal of medical records. This ensures that patients and the public are informed about where their records will be stored and how to access them.

Records May Not Leave the Hospital

Under normal circumstances, medical records in original, electronic, or microfilm form may not be removed from the hospital except where necessary for a judicial or administrative proceeding. When hospitals use off-site storage for medical records, arrangements must be made for delivery of those records to the hospital when needed for patient care or other hospital activities.

Sources and References

• OAR 333-505-0050 - Medical Records - Oregon Secretary of State, Oregon Administrative Rules Database
• Oregon Medical Board - Patient Records - Oregon Medical Board
• OAR 847-012-0000 - Patient's Access to Medical Records - Oregon Secretary of State
• ORS 12.110 - Statute of Limitations for Medical Malpractice - Oregon Legislature
• OAR 333-500-0060 - Return of Hospital License and Hospital Closure - Oregon Secretary of State, Oregon Administrative Rules Database
• OAR 333-700-0090 - Medical Records (Dialysis Facilities) - Oregon Secretary of State, Oregon Administrative Rules Database
• ORS 192.566 - Authorization Form (implementing ORS 192.558) - Oregon Legislature
• HIPAA Privacy Rule - Medical Record Retention FAQ - U.S. Department of Health and Human Services
• 45 CFR 164.530 - Administrative Requirements - Electronic Code of Federal Regulations
• 45 CFR 164.524 - Access of Individuals to PHI - U.S. Department of Health and Human Services
• 42 CFR 482.24 - Condition of Participation: Medical Record Services - Electronic Code of Federal Regulations
• 42 CFR 424.516 - Additional Provider and Supplier Requirements - Electronic Code of Federal Regulations
• Disposal of Protected Health Information FAQ - U.S. Department of Health and Human Services
• CMS Medical Record Maintenance and Access Requirements - Centers for Medicare and Medicaid Services