Tennessee Medical Records Retention Laws (2026 Guide)

Tennessee requires hospitals to retain patient medical records for at least 10 years after discharge or death under T.C.A. 68-11-305, the Medical Records Act of 1974. Physicians must keep records for a minimum of 10 years from the date of last professional contact under Tenn. Comp. R. & Regs. 0880-02-.15.

Tennessee has some of the most detailed medical records retention requirements in the country. Multiple state statutes, administrative rules, and federal regulations govern how long hospitals, physicians, and other healthcare providers must keep patient records. Whether you are a healthcare provider trying to stay compliant or a patient seeking access to your records, understanding these laws is essential.

This guide covers every major retention requirement under Tennessee law, the differences between hospital and physician rules, federal overlays like HIPAA and CMS, patient access rights, proper destruction procedures, and what happens when a practice closes.

Tennessee Medical Records Retention: The Core 10-Year Rule

The foundation of Tennessee's medical records retention framework is the Medical Records Act of 1974, codified at Tennessee Code Annotated (T.C.A.) Section 68-11-305. This statute establishes the primary retention period for hospitals and other healthcare facilities licensed by the state.

Under T.C.A. 68-11-305, hospitals must retain and preserve all records that relate directly to the care and treatment of a patient for a period of at least 10 years following the discharge of the patient or the patient's death during treatment at the facility.

This 10-year minimum applies to:

• Inpatient medical records
• Outpatient treatment records
• Emergency department records
• Surgical records
• Laboratory reports
• Pathology reports
• Nursing notes

The 10-year clock starts running from the date of discharge, not from the date of admission or the date a particular test was performed.

Hospital vs. Physician Retention Requirements

Tennessee draws a clear line between hospital records and physician office records. While both follow a 10-year minimum, the specific rules come from different sources of law and have some important differences.

Hospital Records (T.C.A. 68-11-305)

Hospitals and other licensed healthcare facilities follow the Medical Records Act of 1974. The Tennessee Health Facilities Commission enforces these standards through licensing rules found in Tenn. Comp. R. & Regs. Chapter 0720-14.

Key hospital-specific rules include:

• General records: 10 years from discharge or death
• X-ray films: May be retired after 4 years from the date of exposure, provided the written findings or interpretations signed by a radiologist are kept for the full 10-year period
• Minor patients: Records kept for the period of minority plus one year, or 10 years from discharge, whichever is longer
• Mentally disabled patients: Records kept for the duration of the known mental disability plus one year, or 10 years from discharge, whichever is longer

Physician Records (Tenn. Comp. R. & Regs. 0880-02-.15 and 1050-02-.18)

Physicians in private practice or outpatient settings follow retention rules set by their licensing boards. MDs are governed by the Tennessee Board of Medical Examiners under Tenn. Comp. R. & Regs. 0880-02-.15. DOs follow essentially identical requirements under the Board of Osteopathic Examination at Tenn. Comp. R. & Regs. 1050-02-.18.

Both rules require:

• General patient records: Minimum 10 years from the physician's (or supervisee's) last professional contact with the patient
• Immunization records: Retained indefinitely
• Records of incompetent patients: Retained indefinitely
• X-rays, radiographs, and other imaging: At least 4 years, after which they may be destroyed if separate interpretive records exist
• Mammography records: 10 years
• Minor patients: Records kept for one year after the patient reaches the age of majority, or 10 years from last contact, whichever is longer

An important distinction: the hospital rule measures from date of discharge, while the physician rule measures from the date of last professional contact. For patients with ongoing care relationships, the physician's clock resets with each visit.

Special Rules for Minors' Medical Records

Tennessee provides extended protection for the medical records of minor patients. Because the age of majority in Tennessee is 18, and state law requires retention for one year past majority or 10 years (whichever is longer), the practical effect depends on the child's age at last treatment.

Here is how the math works for hospital records under T.C.A. 68-11-305:

For physician records under Rule 0880-02-.15, the calculation uses "last professional contact" instead of discharge, which can extend the retention period further if the patient continues receiving care.

In practice, many Tennessee healthcare providers retain pediatric records until the patient turns at least 19 to 21, with records for older minors kept for the full 10 years from last treatment.

Federal Requirements That Apply in Tennessee

Tennessee's 10-year state requirement does not exist in a vacuum. Several federal laws and regulations create additional retention obligations that Tennessee healthcare providers must follow.

HIPAA (Health Insurance Portability and Accountability Act)

A common misconception is that HIPAA requires medical records to be kept for 6 years. That is not exactly correct. Under 45 CFR 164.530(j), HIPAA requires covered entities to retain HIPAA compliance documentation for 6 years from the date of creation or the date it was last in effect, whichever is later.

This includes:

• Privacy policies and procedures
• Notice of Privacy Practices
• Patient authorization forms
• Business associate agreements
• Breach notification records
• Accounting of disclosures logs
• Risk assessments and security documentation

HIPAA does not set a specific retention period for the medical records themselves. Instead, HIPAA defers to state law on how long actual patient records must be kept. Since Tennessee requires 10 years, that state standard governs medical record retention, while HIPAA's 6-year rule applies to the compliance paperwork surrounding those records.

However, HIPAA does impose strict requirements on how records are protected during storage and how they are destroyed, which adds to the obligations Tennessee providers must meet.

CMS Conditions of Participation (42 CFR 482.24)

Hospitals that participate in Medicare and Medicaid must comply with the Centers for Medicare and Medicaid Services (CMS) Conditions of Participation. Under 42 CFR 482.24, medical records must be retained in their original or legally reproduced form for a period of at least 5 years.

Since Tennessee's 10-year requirement exceeds the CMS 5-year minimum, Tennessee hospitals that follow state law are automatically in compliance with CMS on retention length. However, CMS also requires:

• A system of coding and indexing that allows timely retrieval by diagnosis and procedure
• Procedures ensuring the confidentiality of patient records
• Accurate, promptly completed, properly filed, and accessible records
• A system of author identification and record maintenance that ensures the integrity of authentication

Hospitals that fail to meet CMS conditions risk losing their Medicare and Medicaid certification, which for most facilities would be financially devastating.

Other Federal Considerations

Additional federal rules may extend retention beyond 10 years in certain situations:

• ERISA (Employee Retirement Income Security Act): Employers offering self-funded health plans must retain records for at least 6 years
• OSHA: Occupational health records must be kept for the duration of employment plus 30 years
• Substance abuse treatment records (42 CFR Part 2): Covered programs must retain records for the duration required by state law, plus any active consent forms

Patient Access Rights Under Tennessee Law

Tennessee law gives patients and their authorized representatives the right to access their own medical records. The primary statute governing this right is T.C.A. Section 63-2-101.

Right to Copies

Healthcare providers must furnish a copy of a patient's medical records within 10 working days of receiving a written request. This applies to:

• The patient
• The patient's authorized representative
• An attorney with proper authorization
• Another healthcare provider (with patient authorization)

Providers may offer a summary of the records at the provider's option, but a summary does not satisfy the patient's right to receive a complete copy. The patient can insist on the full record. Tennessee made this explicit in 2024: Public Chapter 831, effective July 1, 2024, rewrote T.C.A. 63-2-101(a)(1) to state that providing a summary "does not satisfy the patient's or representative's right to receive, or serve as a substitute for, a full medical record."

Fees for Medical Records Copies

Under T.C.A. Section 63-2-102, providers may charge for the cost of reproducing records. The schedule below reflects the rewrite of subsection (a) by Public Chapter 737, effective July 1, 2024:

One qualifier matters a great deal for patients. The electronic tiers above apply to third-party requesters. When patients request a copy of their own records in electronic form, T.C.A. 63-2-102(a)(2)(A) defers to HIPAA and the HITECH Act, which allow only a reasonable cost-based fee covering labor for copying, supplies, and postage.

For patients involved in a claim or an appeal of a denial of Social Security disability benefits, the fee is a flat $20.00 when the records are produced electronically.

Enforcement

If a provider fails to deliver records within the 10-working-day window, the patient may report the violation to the provider's licensing board. The board can impose disciplinary sanctions and monetary fines against non-compliant providers.

Confidentiality Protections

Tennessee law prohibits the disclosure of patient identifying information except in specific circumstances:

• Statutorily required reporting to health or government authorities
• Access by third-party payers for utilization review, case management, or peer review
• Court orders or subpoenas
• Patient authorization

Selling patient identifying information for any purpose is prohibited under T.C.A. 63-2-101.

Proper Destruction of Medical Records

Once medical records have met the required retention period, Tennessee law does not require providers to keep them forever. However, the destruction process must follow specific rules designed to protect patient confidentiality.

Permitted Destruction Methods

Under T.C.A. 68-11-305(d)(1), medical records may be destroyed by:

• Burning the physical records
• Shredding paper documents
• Other effective methods that protect the confidential nature of the contents

For electronic records, accepted destruction methods include degaussing magnetic media, physically destroying hard drives, and using certified data wiping software that meets Department of Defense standards.

Rules for the Destruction Process

Tennessee's constraints on destruction come from two different sources, and which one binds you depends on what kind of provider you are. The hospital statute supplies the first rule below. The other two are Board of Medical Examiners rules that bind physician practices, not hospitals.

1. Ordinary course of business (T.C.A. 68-11-305(d)(2)): Records must be destroyed as part of routine operations, not on an individual basis. A provider cannot single out one patient's records for destruction while retaining others from the same period.

2. Documentation of destruction (Tenn. Comp. R. & Regs. 0880-02-.15(4)(g)4): The time, date, and circumstances of the destruction must be recorded and maintained for future reference. The destruction log does not need to list individual patient names but must be sufficient to identify which group of destroyed records contained a particular patient's file. T.C.A. 68-11-305 imposes no comparable logging duty on hospitals.

3. Records under dispute (Tenn. Comp. R. & Regs. 0880-02-.15(4)(f)6): No medical record involving services currently under dispute may be destroyed until the dispute is resolved, regardless of whether the retention period has expired. This is also a board rule rather than a provision of T.C.A. 68-11-305.

4. HIPAA overlay: Even though Tennessee law sets the retention period, HIPAA requires that the destruction method render protected health information (PHI) unreadable, indecipherable, and unable to be reconstructed. Simply deleting electronic files without overwriting the data is not sufficient.

What Happens When a Practice Closes

Tennessee has specific rules governing what happens to patient records when a physician retires, dies, or closes a practice. These rules are found in the Board of Medical Examiners' regulations (Tenn. Comp. R. & Regs. 0880-02-.15) and the Board of Osteopathic Examination's parallel rules (Tenn. Comp. R. & Regs. 1050-02-.18).

Patient Notification Requirements

When a physician retires, dies, or leaves a group practice, the following notification rules apply:

• All patients seen within the preceding 36 months must be notified
• Notification must inform patients to find a new physician
• Patients must be told that their records will be transferred to the physician of their choice upon authorization
• Exception: notification is not required for patients who had fewer than 2 office encounters in the preceding 18 months

Record Transfer Upon Practice Sale

When a medical practice is sold or transferred:

• The new owner or custodian must maintain the same standards of confidentiality required by Tennessee law
• Patients retain the right to choose any physician to receive their records
• A group practice cannot withhold the medical records of any patient who has authorized a transfer to a departing physician

Abandoning Records Is a Violation

Under Tennessee regulations, abandoning a practice without properly securing patient records constitutes a prima facie violation of the licensing rules. This means the licensing board will presume the physician violated the law, and the physician bears the burden of proving otherwise.

Closed Facility Records

When a licensed healthcare facility closes entirely, the Tennessee Department of Health steps in to manage the records. Under Records Disposition Authorization RDA 2140, approved by the Tennessee Public Records Commission, closed facility records must be:

• Transferred to the State Record Center
• Retained for 20 years after the facility closure
• Destroyed using state-approved methods after the 20-year period

The Department of Health maintains these records at VRC 1714 Elm Hill Pike and handles patient requests for copies from closed facilities.

Frequently Asked Questions

How long do hospitals keep medical records in Tennessee?

Tennessee hospitals must keep patient medical records for at least 10 years after the patient is discharged or dies during treatment, under T.C.A. 68-11-305. For patients who were minors at the time of treatment, the retention period extends to the longer of 10 years from discharge or one year past the age of majority (18), meaning until the patient turns 19. X-ray films may be retired after 4 years if written radiology interpretations are kept for the full 10-year period.

Do Tennessee physicians have different retention rules than hospitals?

The minimum retention period is the same (10 years), but the rules come from different sources. Hospitals follow T.C.A. 68-11-305, while physicians follow their licensing board rules (Tenn. Comp. R. & Regs. 0880-02-.15 for MDs and 1050-02-.18 for DOs). The key difference is that hospitals measure the 10 years from date of discharge, while physicians measure from the date of last professional contact. Physicians also have additional requirements, such as keeping immunization records and records of incompetent patients indefinitely.

Can a Tennessee doctor charge me for copies of my medical records?

Yes, but the fees are limited by T.C.A. 63-2-102, whose fee schedule was rewritten effective July 1, 2024. Providers may charge up to $25 for the first 5 pages of paper copies and $0.50 for each additional page, plus actual mailing costs. For electronic copies requested by a third party, the fee is up to $25 for the first 10 pages and $0.25 for each additional page, capped at $90 total. When you request your own records electronically, the statute defers to HIPAA and the HITECH Act, which allow only a reasonable cost-based fee for labor, supplies, and postage. The provider must deliver records within 10 working days of receiving a written request, and failure to do so can result in disciplinary action by the licensing board.

What happens to my medical records if my doctor retires in Tennessee?

Tennessee licensing board rules require physicians who retire or close their practice to notify all patients seen within the preceding 36 months. Patients must be informed of their right to have records transferred to a new provider of their choice. The physician (or the physician's estate, in the case of death) must ensure all records are transferred to a custodian who will maintain the same confidentiality standards. Abandoning records without proper arrangements is a licensing violation.

Does HIPAA require Tennessee doctors to keep records for 6 years?

No. This is a common misunderstanding. HIPAA's 6-year retention rule under 45 CFR 164.530 applies to HIPAA compliance documentation (privacy policies, authorization forms, breach records), not to actual patient medical records. HIPAA defers to state law on medical record retention. Since Tennessee requires 10 years, that is the minimum retention period for patient records. Tennessee's 10-year rule exceeds both the HIPAA documentation requirement (6 years) and the CMS Conditions of Participation requirement (5 years for Medicare-participating hospitals).

Sources and References

1. T.C.A. Section 68-11-305 - Preservation of Records for Specified Time - Method of Destruction
2. Tenn. Comp. R. & Regs. 0880-02-.15 - Medical Records (Board of Medical Examiners)
3. Tenn. Comp. R. & Regs. 1050-02-.18 - Medical Records (Board of Osteopathic Examination)
4. T.C.A. Section 63-2-101 - Release of Medical Records
5. T.C.A. Section 63-2-102 - Costs of Reproduction, Copying or Mailing of Records
6. 42 CFR 482.24 - CMS Conditions of Participation: Medical Record Services
7. 45 CFR 164.530 - HIPAA Administrative Requirements
8. Tennessee Health Facilities Commission - Standards for Hospitals (Chapter 0720-14)
9. Tennessee Secretary of State - Rules of the Board of Medical Examiners, Chapter 0880-2
10. Tennessee Department of Health - Closed Medical Facility Patient Records (RDA 2140)
11. Tennessee Public Chapter 737 (2024) - Amending T.C.A. 63-2-102, Costs of Reproducing Medical Records
12. Tennessee Public Chapter 831 (2024) - Amending T.C.A. 63-2-101(a)(1), Patient Right to a Full Medical Record