Utah Medical Records Retention Laws (2026 Guide)

Utah hospitals must retain medical records for at least 7 years under Utah Admin. Code R432-100-34, extended to age 18 plus 4 years for minor patients. Private physicians are covered by Utah Code 58-67-803, which sets a professional standard rather than a fixed number of years.

Overview of Utah Medical Records Retention Laws

Utah regulates medical records retention primarily through its Administrative Code, which sets minimum holding periods for hospitals and licensed healthcare facilities. Private physicians are also covered by a state requirement, though it is a professional standard rather than a set term: Utah Code 58-67-803 routes physician records to a licensing rule instead of naming a number of years. Physicians therefore work from that standard alongside federal rules under HIPAA and CMS.

Understanding these retention requirements is essential for healthcare providers, patients, and legal professionals. Failing to retain records for the required period can result in regulatory penalties, malpractice liability, and loss of Medicare or Medicaid participation.

This guide breaks down the rules for every type of provider in Utah, explains federal overlay requirements, and covers patient rights, destruction procedures, and what happens when a practice closes.

Hospital Medical Records Retention in Utah

Utah Administrative Code R432-100-34 establishes the primary retention requirements for hospitals licensed in the state. Under this rule, hospitals must retain medical records for a minimum of seven years. The rule sets that seven-year floor without naming a trigger date, unlike the rules for small health care facilities and ambulatory surgical centers, which run their seven years from the last date of care.

Retention for Minor Patients

Hospital records for minors carry a longer retention obligation. Under R432-100-34, medical records of minor patients must be retained until the patient reaches age 18 plus an additional four years. However, the total retention period can never be less than seven years.

For example, if a child receives treatment at age 10, the hospital must keep those records until the child turns 22 (age 18 plus 4 years). If a child receives treatment at age 16, the hospital must still keep records until age 22, since that exceeds the seven-year minimum.

Master Patient Index

Hospitals in Utah are required to permanently maintain a master patient index. This index must include each patient's name, medical record number, date of birth, admission and discharge dates, and attending physician name. The master index has no expiration date and must be kept indefinitely.

Storage Requirements

The regulation requires hospitals to provide secure storage, controlled access, prompt retrieval, and the equipment and facilities needed to review medical records. Records may be stored in multiple locations as long as each record can be retrieved or accessed within a reasonable time period. Access is limited to medical staff, authorized personnel, patients who have provided consent, and Utah Department of Health compliance investigators.

Small Healthcare Facilities (4 to 16 Beds)

Utah Administrative Code R432-200-29 governs small healthcare facilities with 4 to 16 beds. These facilities must retain medical records for at least seven years after the last date of resident care.

For minors, small healthcare facilities must retain records until the minor reaches age 18 plus an additional two years. However, the total retention period may not be less than seven years.

Small healthcare facilities must also safeguard records from loss, defacement, tampering, fires, and floods. Records must be protected against access by unauthorized individuals at all times.

Ambulatory Surgical Centers

Freestanding ambulatory surgical centers in Utah follow the rules in R432-500-21. These facilities must retain medical records for at least seven years after the last date of patient care.

For minors treated at ambulatory surgical centers, records must be kept until the patient reaches age 18 or the age of majority, plus three years. Unlike the hospital and small health care facility rules, R432-500-21 states this as an alternative to the seven-year period rather than adding an explicit seven-year floor for minors.

Private Physicians and Office-Based Practices

Utah does not set a specific number of years for records held by private physicians or office-based practices, but it does impose a state-level requirement on them. Utah Code 58-67-803, part of the Utah Medical Practice Act, provides that medical records maintained by a licensee shall "meet the standards and ethics of the profession" and "be maintained in accordance with division rules made in collaboration with the board."

The division rule that provision points to is Utah Admin. Code R156-67-803, which requires that medical records be maintained in accordance with applicable laws, regulations, and rules, and with the AMA Code of Medical Ethics, 2017 edition, incorporated by reference at R156-67-502(14). Violating that Code is itself listed as unprofessional conduct for a Utah physician.

So the accurate picture is not that Utah leaves private practices unregulated. It is that the state requirement is qualitative, and the specifics are left to the incorporated ethics standard and to federal law. Private physicians in Utah should weigh the following when setting a retention policy:

• HIPAA documentation retention: 6 years for compliance policies and procedures
• CMS/Medicare requirements: At least 5 to 7 years for billing and audit purposes
• Malpractice statute of limitations: Utah Code 78B-3-404 generally allows malpractice claims within 2 years of discovery, but no more than 4 years from the act
• Incorporated ethics standard: The AMA Code of Medical Ethics, which Utah incorporates by reference, directs physicians to use medical considerations to decide how long to keep records, retaining what a physician seeing the patient for the first time would reasonably need to know, and to keep immunization records indefinitely

Most Utah attorneys and compliance professionals recommend that private physicians retain adult patient records for at least seven years and minor patient records until the patient turns 18 plus an additional four years, matching the hospital standard.

Summary of Utah Retention Periods by Provider Type

Federal Requirements That Apply in Utah

HIPAA Requirements

The HIPAA Privacy Rule does not require covered entities to retain medical records for any specific period. According to the U.S. Department of Health and Human Services, HIPAA defers to state laws for medical record retention.

However, HIPAA does require covered entities to retain certain compliance documentation for six years. Under 45 CFR 164.530(j), the following must be kept for six years from creation or the date last in effect, whichever is later:

• Privacy policies and procedures
• Privacy practices notices
• Disposition of complaints
• Training records
• Business associate agreements
• Any other actions, activities, or designations required to be documented under the HIPAA Privacy Rule

CMS and Medicare/Medicaid Requirements

Healthcare providers that participate in Medicare or Medicaid must comply with the Conditions of Participation under 42 CFR 482.24. Hospitals must maintain medical records that are accurately written, promptly completed, properly filed and retained, and accessible.

CMS generally requires that Medicare providers retain records for at least five years from the date of service. For billing and audit purposes, many compliance professionals recommend retention that accounts for the False Claims Act statute of limitations under 31 U.S.C. 3731(b), which generally runs 6 years from the violation (or 3 years from when the responsible government official learns of it), with an outer cap of 10 years, so some providers extend retention up to 10 years for this purpose rather than stopping at seven.

Providers participating in Medicare Advantage or Part D programs may face longer retention requirements of up to 10 years.

Patient Access to Medical Records in Utah

Utah Code 78B-5-618 establishes the right of patients and their authorized representatives to inspect and obtain copies of their medical records.

Patient Rights

Under this statute, a patient or the patient's personal representative may inspect or receive a copy of the patient's records from any healthcare provider. For providers subject to HIPAA, the access standards in 45 CFR 164.524 also apply, which require providers to respond within 30 calendar days of a request.

If the provider cannot respond within 30 days, HIPAA allows one 30-day extension, provided the provider notifies the patient in writing with the reason for the delay and the expected completion date.

Copying Fees in Utah

Utah Code 78B-5-618 sets specific limits on what providers may charge when a third party requests medical records:

• Search/retrieval fee: Up to $30 per request for locating records
• First 40 pages: Up to $0.53 per page
• Additional pages: Up to $0.32 per page
• Certification fee: $20 if requested
• Postage: Actual cost when applicable

These fees are adjusted annually based on the Consumer Price Index. When patients request their own records, HIPAA limits charges to a reasonable, cost-based fee that covers only copying and postage.

Proper Destruction of Medical Records in Utah

Once the applicable retention period expires, Utah healthcare providers must follow specific procedures before destroying medical records.

Hospital Destruction Requirements

Under R432-100-34, hospitals must provide public notice before destroying medical records. The hospital must publish a notice in a newspaper of statewide distribution at least once per week for three consecutive weeks before destruction. This notice gives former patients the opportunity to request copies of their records before they are destroyed.

HIPAA-Compliant Destruction Methods

All healthcare providers, regardless of type, must destroy records in a manner that protects against unauthorized disclosure of protected health information. According to HHS guidance on PHI disposal, acceptable destruction methods include:

Paper records:

• Shredding using cross-cut or micro-cut shredders
• Incineration or burning
• Pulverizing

Electronic records:

• Clearing (overwriting data)
• Purging (degaussing or cryptographic erasure)
• Physical destruction of the storage media

Providers must never dispose of records containing PHI in dumpsters, recycling bins, or any receptacle accessible to the public. If using a third-party destruction service, the provider must execute a HIPAA business associate agreement with that vendor.

Documenting Destruction

Best practice requires maintaining a log of all destroyed records, including the patient name or record number, dates of the records, the date of destruction, the method used, and the name of the person or company that performed the destruction. This destruction log should be retained permanently.

When a Utah Medical Practice Closes

When a hospital ceases operations in Utah, R432-100-34 requires the facility to arrange for secure, safe storage and prompt retrieval of all medical records, patient indexes, and discharge records for the remainder of the required retention period.

Options for Records Storage After Closure

The regulation permits three options for handling records when a hospital closes:

1. Transfer to another hospital: Records may be stored by another licensed hospital in the area
2. Approved storage facility: Records may be placed with a medical records storage company
3. Return to attending physician: Records may be returned to the patient's attending physician, provided the physician is still practicing in the community

Physician Practice Closure

For physicians closing a private practice, Utah follows general professional guidelines. The Utah Division of Professional Licensing (DOPL) oversees physician licensing and expects that departing physicians will:

• Notify patients in writing at least 30 days before closing
• Offer patients the option to transfer records to another provider
• Offer patients the ability to obtain copies of their own records
• Designate a records custodian for any records not transferred
• Report the records custodian information to DOPL as required by HB 312 (2023)

Since 2023, all Utah healthcare providers who use third-party medical records services must report the custodian's contact information to DOPL.

More Utah Laws

• Utah Recording Laws
• Utah Hit and Run Laws
• Utah Car Seat Laws
• Utah Lemon Law
• Utah Dog Bite Laws
• Utah Statute of Limitations