Vermont Medical Records Retention Laws (2026 Guide)

Vermont hospitals must retain patient medical records for at least 10 years after discharge under 18 V.S.A. 1905 and VT Code R. 946. Most other licensed Vermont health professionals must keep client records for at least seven years under 3 V.S.A. 129a(a)(9), MD and physician assistant offices follow a 10-year standard drawn from the malpractice statute of limitations, and records for minor patients should be kept until the patient turns 21.

Vermont medical records retention laws establish how long hospitals and healthcare providers must preserve patient health information. The governing hospital licensing statute, 18 V.S.A. 1905, requires that professional case records be compiled for every patient and kept on file for a minimum of 10 years. Its companion administrative regulation, 12-5-14 VT Code R. 946, restates the same 10-year period for hospital medical records.

This guide covers all Vermont-specific retention requirements for hospitals and physicians, rules for minor and deceased patient records, federal requirements under HIPAA and CMS, patient access rights, proper destruction procedures, and what happens when a medical practice closes.

Vermont Hospital Medical Records Retention Requirements

Vermont law sets clear retention requirements for hospitals licensed in the state. Two primary authorities govern hospital record keeping: the Vermont hospital licensing statute and the associated administrative regulation.

The 10-Year Hospital Retention Rule

18 V.S.A. 1905 establishes minimum standards for hospital licensing in Vermont. Among those standards is a requirement that professional case records be compiled for all patients, signed by the attending physician, and kept on file for a minimum of 10 years.

The companion regulation, 12-5-14 VT Code R. 946, reinforces this requirement. Under this regulation, a hospital must maintain medical records for every patient and retain the records for 10 years following discharge. Medical records must be permanent, legible, and signed by the attending physician.

The 10-year clock begins on the date of patient discharge, not the date of the last entry in the record. This distinction matters for patients with extended hospital stays.

What Hospital Records Must Include

Under Vermont licensing standards, hospital medical records must contain sufficient information to justify the diagnosis and treatment provided. At a minimum, records should include:

• Patient identification and demographic information
• Admission and discharge dates
• History and physical examination findings
• Physician orders and progress notes
• Operative reports and pathology findings
• Nursing notes and medication administration records
• Diagnostic test results
• Discharge summary with follow-up instructions

Hospitals must also maintain accounting records of all operating procedures on a monthly basis. Complete operating and financial statements must be compiled at least once annually and kept on file for 20 years under 18 V.S.A. 1905.

Physician and Private Practice Retention Requirements

The answer depends on which board licenses the provider, and Vermont is often described as having no private-practice retention rule at all. That is only half right. There is no statutory retention period for medical doctors and physician assistants, both licensed by the Board of Medical Practice. For the roughly 50 other professions attached to the Office of Professional Regulation, a mandatory seven-year floor does apply.

The Seven-Year Rule for Office of Professional Regulation Licensees

Under 3 V.S.A. 129a(a)(9), "failing to retain client records for a period of seven years, unless laws specific to the profession allow for a shorter retention period" is unprofessional conduct. The statute adds that where other laws or agency rules require a longer period, the longer period controls.

This is a disciplinable statutory duty, not a recommendation, and it reaches every licensee of a board or profession listed in 3 V.S.A. 122, which the definitions in 3 V.S.A. 121 incorporate. That list includes osteopathic physicians and surgeons, naturopathic physicians, nurses, dentists, chiropractors, psychologists, physical therapists, occupational therapists, clinical social workers, pharmacists, optometrists, midwives, respiratory care practitioners, acupuncturists and roughly 40 other occupations. A Vermont osteopathic or dental practice that destroys patient records at year five has violated the statute, even if a nearby MD practice faces no equivalent statutory deadline.

The Board of Medical Practice is not on the section 122 list, and its own unprofessional conduct statute, 26 V.S.A. 1354, sets no retention period. Because that board licenses both medical doctors (26 V.S.A. chapter 23) and physician assistants (26 V.S.A. chapter 31), those two provider types are the narrow gap in Vermont law, not private practices generally.

The 10-Year Best Practice Recommendation for MD and PA Practices

Although no Vermont statute sets a retention period for MD and physician assistant offices, the Vermont Medical Society and professional liability insurers recommend that all healthcare providers retain medical records for at least 10 years after the patient was last treated.

This recommendation is based on Vermont's statute of limitations for medical malpractice claims. Under 12 V.S.A. 521, a medical malpractice action must be brought within three years of the date of the incident or two years from the date the injury is or reasonably should have been discovered, whichever occurs later, but not later than seven years from the date of the incident.

Because the seven-year outer limit for malpractice claims can be extended in cases involving fraudulent concealment or foreign objects left in the body, maintaining records for 10 years provides an additional safety margin for providers.

Why the 10-Year Standard Matters

Even without a statutory deadline of their own, MDs and physician assistants who destroy records before the 10-year mark face several risks:

• Inability to defend against a malpractice claim filed within the statute of limitations
• Loss of documentation needed for insurance audits or billing disputes
• Potential liability if a patient suffers harm due to a provider not having access to prior treatment history
• Regulatory complications with Medicare or Medicaid billing reviews

The practical effect is that most Vermont physicians follow the same 10-year standard as hospitals, even though the legal basis differs. It also comfortably exceeds the seven-year floor that binds other licensed health professions.

Records of Minors and Deceased Patients

Vermont applies special retention considerations for the medical records of children and patients who have died.

Minor Patient Records

The Vermont Medical Society recommends that records of minor patients be retained until at least three years after the child reaches the age of 18, which means keeping records until the patient turns 21. This extended retention period accounts for the fact that the statute of limitations for minors does not begin to run until the minor reaches the age of majority.

For hospitals, the 10-year post-discharge rule still applies. If a child is treated at age 5 and discharged, the hospital must keep the record for 10 years (until the child is 15). However, best practice dictates retaining the record until the child turns 21, which is the longer of the two periods.

Providers should always apply the longer retention period when state rules and best practice recommendations conflict.

Deceased Patient Records

For patients who have died, Vermont healthcare providers are advised to retain medical records for no less than three years after the date of death. This period aligns with the general statute of limitations for claims that may arise from the estate of a deceased individual.

Hospitals should still apply the 10-year rule if the patient died during a hospitalization or shortly after discharge, as the 10-year post-discharge requirement may extend beyond the three-year post-death recommendation.

Federal Requirements: HIPAA and CMS

Vermont providers must comply with both state and federal medical records requirements. When state and federal rules conflict, the stricter standard applies.

HIPAA Documentation Requirements

One of the most common misconceptions is that HIPAA requires providers to keep patient medical records for a specific number of years. It does not.

HIPAA requires covered entities to retain HIPAA-related administrative documentation for six years from the date of creation or the date when the document was last in effect, whichever is later, under 45 CFR 164.530(j). This six-year requirement covers:

• Privacy and security policies and procedures
• Business associate agreements
• Patient authorization forms
• Training records
• Complaint and resolution documentation
• Risk assessments and audit logs

The six-year rule applies to compliance paperwork only, not to patient treatment records. How long actual patient medical records must be kept is determined by state law.

HIPAA Privacy and Security Protections

While HIPAA does not dictate retention periods for medical records, it does require that all protected health information be safeguarded for as long as it exists. Under 18 V.S.A. 1881, Vermont law further reinforces HIPAA protections by prohibiting covered entities and business associates from disclosing protected health information unless the disclosure is permitted under HIPAA.

This means that even after a record has passed the minimum retention period, if it has not been destroyed, it must continue to be protected under HIPAA privacy and security standards.

CMS and Medicare Requirements

CMS Conditions of Participation establish separate federal minimums for providers participating in Medicare or Medicaid:

For Vermont hospitals that participate in Medicare, the state's 10-year requirement exceeds the federal five-year minimum. Vermont's stricter standard controls, meaning these hospitals must retain records for 10 years.

For Vermont physician offices that accept Medicare, the federal seven-year requirement provides a mandatory minimum even though Vermont sets no retention period for MD and physician assistant practices.

Patient Access to Medical Records in Vermont

Vermont law and federal law both guarantee patients the right to access their medical records.

State Law: 18 V.S.A. 9419

Under 18 V.S.A. 9419, Vermont patients have the right to obtain copies of their health care records. The statute sets specific limits on what providers can charge:

• A flat fee of no more than $5.00, or no more than $0.50 per page, whichever is greater
• An itemized bill must be provided to the patient or authorized recipient
• No charge for copies requested to support a claim or appeal under any provision of the Social Security Act or any other federal or state needs-based benefit program
• Reasonable fees may be charged for copies of X-rays, films, models, disks, tapes, or other non-standard formats

These fee limits apply to all custodians of health care records in Vermont, including hospitals, physician offices, and other healthcare facilities.

Federal Law: HIPAA Right of Access

Under the HIPAA Privacy Rule, patients have the right to inspect and obtain copies of their protected health information. Key provisions include:

• Providers must respond to a records request within 30 calendar days
• An additional 30-day extension is permitted with written notice explaining the delay
• For electronic copies of electronically maintained records, providers may charge a flat fee of $6.50 or less
• Providers cannot deny access because of unpaid bills, old records, or inconvenience
• Limited exceptions exist for psychotherapy notes, information compiled for legal proceedings, and certain lab results

The 21st Century Cures Act further strengthened patient access by prohibiting information blocking, defined as practices likely to interfere with access to, exchange of, or use of electronic health information. Penalties for information blocking can reach up to $1 million per violation for health IT developers.

Which Fee Applies?

When a Vermont patient requests paper copies of their records, the state fee limit under 18 V.S.A. 9419 ($5.00 flat or $0.50 per page) applies. When a patient requests electronic copies of electronically maintained records, the HIPAA flat fee of $6.50 or less may apply. Providers should apply the fee structure that is most favorable to the patient.

Proper Destruction of Medical Records

Once medical records have been retained for the required period, Vermont healthcare providers may destroy them. However, destruction must follow specific procedures to protect patient privacy.

HIPAA Destruction Standards

HIPAA requires that destroyed records be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed." Approved methods include:

Paper records: Shredding, burning, pulping, or pulverizing. Cross-cut shredding is preferred over strip-cut shredding because strip-cut documents can potentially be reassembled.

Electronic records: Clearing (overwriting with non-sensitive data), purging or degaussing (using a strong magnetic field to erase data), or physical destruction of the storage media such as hard drives, disks, or tapes.

Records may never be placed in dumpsters, recycling bins, or other publicly accessible containers. Providers who use a third-party destruction service must have a HIPAA business associate agreement in place with that vendor.

Vermont-Specific Considerations

Vermont does not have a specific state statute requiring patient notification before destroying medical records that have exceeded the retention period. However, as a best practice, providers should:

• Document the date and method of destruction
• Maintain a log of destroyed records (patient name, record dates, destruction date, destruction method)
• Keep the destruction log indefinitely for compliance verification
• Verify that all copies of the record, including backup tapes and off-site storage, are destroyed

Penalties for Improper Destruction

HIPAA civil penalties for improper disposal of protected health information range from $145 to $73,011 per violation depending on the level of culpability (up to $2,190,294 for the most serious tier), with a calendar-year cap of $2,190,294 for all violations of an identical provision, under the inflation-adjusted tiers effective January 28, 2026 (91 FR 3665; 45 CFR 160.404). Criminal penalties for knowing violations can reach $250,000 and 10 years of imprisonment.

What Happens When a Vermont Practice Closes

When a Vermont physician retires, relocates, or closes a practice, the provider must still ensure patient records are preserved for the remaining retention period.

Notifying Patients Is a Legal Duty for Most Vermont Licensees

For licensees of the boards listed in 3 V.S.A. 122, closure notification is not merely good practice. 3 V.S.A. 129a(a)(8) makes "failing to notify patients or clients how to obtain their records when a practice closes" unprofessional conduct, in the same subdivision that requires prompt production of records on written request. An osteopathic practice, dental office, chiropractic clinic, nursing practice or counseling practice that simply closes its doors without telling patients where their records went is exposed to board discipline.

Medical doctors and physician assistants are again the exception. Their unprofessional conduct statute, 26 V.S.A. 1354(a)(10), requires them to make records available promptly on written request but contains no closure-notification clause. So the steps below are best practice for MD and PA offices and, for every other licensed profession, the practical way to satisfy section 129a(a)(8).

Recommended Steps for Practice Closure

The Vermont Medical Society and the American Medical Association recommend the following steps when closing a medical practice:

1. Notify patients in writing. Send a letter to all active patients informing them of the closure date and explaining how they can obtain their records or have them transferred to another provider. Ideally, this letter should be sent by certified mail with return receipt requested.

2. Provide adequate notice. Give patients at least 30 to 60 days of notice before the practice closes. The notification should include the reason for closure, the date of closure, and the process for requesting records.

3. Offer records transfer. Include a consent form authorizing the transfer of records to a new provider of the patient's choice.

4. Arrange for a records custodian. If records must be retained beyond the closure date, arrange for a custodian (another provider, a medical records storage company, or the local hospital) to maintain the records for the remaining retention period.

5. Notify the Board of Medical Practice. The Vermont Board of Medical Practice should be informed of the closure and the arrangements made for record storage.

6. Continue HIPAA protections. All records, whether retained by a custodian or transferred to patients, must continue to be protected under HIPAA privacy and security standards.

Records of Patients Who Cannot Be Reached

For patients who do not respond to the closure notification, the provider must still arrange for proper storage of their records for the full retention period. These records cannot be destroyed simply because the patient did not respond.

Vermont Medical Records Retention Summary Table

The following table summarizes the key retention requirements for Vermont healthcare providers: