Rhode Island Medical Records Retention Laws (2026 Guide)

Rhode Island requires physicians to retain patient medical records for at least 7 years from the last encounter under 216-RICR-40-05-1, while hospitals must keep records for at least 5 years after discharge under 216-RICR-40-10-4. Hospital records for minor patients must be retained until the patient turns 23; the physician regulation sets no separate minor-patient retention period.

Understanding how long healthcare providers must keep your medical records in Rhode Island is important for patients, physicians, and hospital administrators alike. Rhode Island law establishes different retention periods depending on the type of provider, with physicians required to keep records longer than hospitals. Federal rules under HIPAA and CMS add additional layers that every provider must follow.

This guide covers Rhode Island's specific retention requirements for hospitals and physicians, rules for minor patients, federal requirements, patient access rights, record destruction standards, practice closure obligations, and answers to common questions.

Rhode Island Medical Records Retention Periods

Rhode Island sets different minimum retention periods for hospitals and physician offices. These requirements come from state regulations administered by the Rhode Island Department of Health and the Board of Medical Licensure and Discipline.

Physician Office Records: 7 Years

Rhode Island regulation 216-RICR-40-05-1 requires licensed physicians to maintain patient medical records for a minimum of seven years unless otherwise mandated by law or regulation. This 7-year period runs from the date of the last patient encounter, not from the date the record was created.

The regulation applies to all physicians licensed by the Rhode Island Board of Medical Licensure and Discipline. Records must be legible and include the identity of the treating physician by name and title, information sufficient to justify the treatment course, active problem and medication lists, patient histories and examination results, test results, drug records, and consultation and hospitalization reports.

Failure to maintain completed records in accordance with this regulation constitutes unprofessional conduct and may result in disciplinary action by the Board.

Hospital Records: 5 Years

Rhode Island hospitals must be licensed by the Department of Health under R.I. Gen. Laws 23-17-4, and the hospital licensing regulation adopted under that chapter requires them to retain medical records for a minimum of five years after patient discharge. This period matches the federal CMS Conditions of Participation minimum for Medicare-participating hospitals.

Hospital licensing regulations under 216-RICR-40-10-4 incorporate Joint Commission standards for medical records management and require hospitals to maintain systems for recording and transmitting patient-specific information to other healthcare providers for continuity of care purposes.

Records may be kept in their original form or as accurate reproductions, including microfilm, microfiche, or electronic formats, as long as the reproduction is a true and accurate copy of the original.

Comparison: Hospital vs. Physician Retention

The difference between hospital and physician retention periods means that a patient who sees both a hospital and a private physician for the same condition may find that the hospital destroys its records two years before the physician's office does. Patients should be aware of this when planning to request older records.

Records of Minor Patients

Rhode Island's hospital licensing regulation, 216-RICR-40-10-4, Section 4.6.10(J)(1), requires records of minor patients to be retained for at least five years after the minor reaches the age of 18. This effectively means that a hospital record created for a newborn must be kept until the patient turns 23.

This extended retention period applies specifically to hospital-maintained records. Rhode Island's physician licensing regulation, 216-RICR-40-05-1, does not include a separate minor-patient provision, so a private physician's record for a minor patient follows the standard seven-year period from the last encounter instead. The purpose of the hospital rule is to ensure that individuals have access to their childhood medical history when they reach adulthood and can make their own healthcare decisions.

For a child born today and treated at a hospital, this means the hospital record must be retained for a minimum of 23 years. For a hospital patient who turns 18 next year, the record must be kept until they are at least 23 years old.

Hospital Minor-Patient Records Retention Examples

This age-23 schedule applies to hospital-maintained records under 216-RICR-40-10-4, Section 4.6.10(J)(1). Because it can exceed the standard adult retention period, hospitals must track the patient's date of birth and calculate the appropriate retention deadline for each minor patient record. Rhode Island's physician regulation, 216-RICR-40-05-1, contains no separate minor-patient provision, so a private physician's record for a minor patient follows the standard seven-year rule instead.

Federal Requirements That Apply in Rhode Island

Rhode Island providers must comply with both state and federal medical records requirements. When state and federal rules conflict, the stricter requirement controls.

HIPAA: No Medical Records Retention Period

The HIPAA Privacy Rule does not require covered entities to retain patient medical records for any specific period of time. This is one of the most common misconceptions in healthcare compliance.

What HIPAA does require is that covered entities retain HIPAA-related administrative documentation for six years from the date of creation or last effective date. This includes privacy policies, procedures, privacy practices notices, complaint disposition records, and business associate agreements, as specified in 45 CFR 164.530(j).

HIPAA also requires that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for whatever period the information is maintained, including through the disposal process.

CMS Conditions of Participation: 5-Year Minimum for Hospitals

Hospitals participating in Medicare must retain medical records in their original or legally reproduced form for at least five years, as required by 42 CFR 482.24(b)(1). This federal minimum matches Rhode Island's state requirement for hospitals.

For general Medicare providers (not just hospitals), CMS guidelines recommend retaining records for at least seven years from the date of service. This aligns with Rhode Island's physician retention requirement.

Which Rule Controls?

The stricter requirement always applies. Here is how that works in practice for Rhode Island providers:

In Rhode Island, the state and federal requirements are closely aligned for most provider types. The most significant difference arises with hospital minor-patient records, where the state requirement to retain records until age 23 exceeds the federal minimum.

Patient Access to Medical Records in Rhode Island

Rhode Island law and federal HIPAA regulations give patients the right to access and obtain copies of their medical records.

Response Time

The general 30-day deadline for a physician office comes from regulation, not statute. 216-RICR-40-05-1, Section 1.5.12(B), provides that requested records "must be provided within thirty (30) days of the receipt of the written request or signed authorization for records."

A separate 30-day furnishing duty appears in paragraph (16) of R.I. Gen. Laws 23-17-19.1, but it is narrower in two ways. The statute binds only healthcare facilities licensed under chapter 23-17, and the 30-day clock sits inside a paragraph that deals with records requested to support an appeal under the Social Security Act, a claim under the Workers' Compensation Act, or a veteran's application for benefits. For those requests the statute defines "provider" to include any out-of-state entity that handles medical records for in-state providers. It is not a universal state-law deadline for every written record request.

Fees for Copies

Rhode Island law under R.I. Gen. Laws 23-1-48 establishes specific fee limits for medical record copies:

Key Patient Protections

Rhode Island law provides several important protections for patients requesting their records:

No prepayment for continuity-of-care requests. Under 216-RICR-40-05-1, Section 1.5.12(B), a physician may not require prepayment of charges for duplicating or retrieving records as a condition of filling a patient's request when the request is made for the purpose of continuity of care.

No charge for certain records. The same regulation bars any charge when the record requested is an immunization record required for school admission, or when an applicant or beneficiary (or someone representing one) needs the record to support a claim or appeal under the Social Security Act or under a federal or state needs-based program such as Medical Assistance, RIte Care, Temporary Disability Insurance, or unemployment compensation. Separately, paragraph (16) of R.I. Gen. Laws 23-17-19.1 bars a licensed healthcare facility from charging anything for a record needed to support a Social Security Act appeal, a Workers' Compensation Act claim, or a veteran's application for benefits.

Electronic access. Patients may request records in electronic format. The total charge for pages in electronic format cannot exceed $100.

Proper Destruction of Medical Records

Once the applicable retention period has expired, Rhode Island providers may destroy medical records. However, destruction must comply with both state and federal requirements.

HIPAA Destruction Standards

The HIPAA Privacy Rule requires that protected health information be rendered essentially unreadable, indecipherable, and otherwise unable to be reconstructed when destroyed.

Paper records must be destroyed by shredding, burning, pulping, or pulverizing. Cross-cut shredding is recommended. The Rhode Island State Archives recommends using vendors with NAID AAA Certification for secure document destruction.

Electronic records must be destroyed by clearing (overwriting with non-sensitive data), purging or degaussing (exposing to a strong magnetic field), or physically destroying the storage media through disintegration, pulverization, melting, incinerating, or shredding.

Business Associate Requirements

Providers may hire a business associate to handle record destruction. However, a business associate agreement must be in place that requires the business associate to appropriately safeguard the protected health information through the disposal process.

Records must never be placed in dumpsters, recycling bins, or other publicly accessible containers, even if they are in sealed bags or boxes.

Maintaining a Destruction Log

While Rhode Island does not explicitly require a destruction log by statute, maintaining one is a best practice recommended by the Department of Health. A destruction log should include the date of destruction, description of records destroyed, method of destruction, and the name of the person or company that performed the destruction.

Practice Closure and Record Preservation

When a physician retires, relocates, or otherwise closes a medical practice in Rhode Island, specific statutory requirements govern how patient records must be handled.

Voluntary Practice Closure

Under Rhode Island regulation 216-RICR-40-05-1, Section 1.5.10, a physician who voluntarily closes a practice must:

1. Provide at least 90 days' notice before closure.
2. Publish public notice in a newspaper with statewide circulation, including the closure date and information about where and how patients may obtain their records both before and after closure.
3. Notify the Rhode Island Medical Society and the Rhode Island Board of Medical Licensure and Discipline of the location of the records.
4. Send individual notice to patients seen within the previous two years.
5. Ensure records are stored securely and remain accessible to patients after closure.

Death of a Practicing Physician

Under R.I. Gen. Laws 5-37-30, the heirs or estate of a deceased physician who had been practicing at the time of death must:

1. Give public notice within 90 days of the physician's death regarding the disposition of patient medical records, published in a newspaper with statewide circulation.
2. Notify the Rhode Island Medical Society and the Board of Medical Licensure and Discipline of the location of the records.
3. Dispose of patient records in a location and manner that ensures the records are maintained and accessible to patients.

Confidentiality After Transfer

Any person, corporation, or other legal entity that receives medical records from a retired or deceased physician must comply with the Confidentiality of Health Care Communications and Information Act (R.I. Gen. Laws Chapter 5-37.3). This means the receiving party has the same confidentiality obligations as the original physician, even if the receiving party is not a licensed healthcare provider.

Records of a deceased or retired physician may only be released upon the written request of a patient, the patient's authorized representative, or the patient's heirs or estate, and only to a designated physician, except as otherwise provided under Section 5-37.3-4.

Rhode Island Health Information Exchange

In April 2025, Rhode Island transitioned its statewide Health Information Exchange (HIE), known as CurrentCare, from an opt-in to an opt-out consent model. This means patient health information is now automatically shared through the exchange unless the patient specifically opts out.

CurrentCare allows authorized healthcare providers across the state to access patient records electronically, which can reduce delays in care and decrease the need for patients to request paper copies of their records from individual providers.

Rhode Island is also implementing an electronic medical records system throughout the state hospital system, including Eleanor Slater Hospital. Electronic case reporting using HL7 standards is required for eligible hospitals and clinicians participating in the CMS Promoting Interoperability Program.