Virginia Medical Records Retention Laws (2026 Guide)

Virginia law sets different retention minimums depending on the provider type: hospitals must keep records for at least 5 years after patient discharge under 12 VAC 5-410-370, while physicians must retain records for a minimum of 6 years after the last patient encounter under Va. Code § 54.1-2910.4.

Last verified: March 2026. This page reflects the current Code of Virginia, Virginia Administrative Code, and federal regulations governing medical records retention in the Commonwealth.

Table of Contents

• Overview of Virginia Medical Records Retention Laws
• Hospital Records Retention Requirements
• Physician and Practitioner Retention Requirements
• Records for Minor Patients
• Federal Requirements: HIPAA and CMS
• Patient Access to Medical Records
• Fees for Copies of Medical Records
• Record Storage and Format Requirements
• Record Destruction Rules
• Practice Closure and Record Transfer
• Penalties for Noncompliance
• Frequently Asked Questions

Overview of Virginia Medical Records Retention Laws

Virginia law establishes different medical records retention periods depending on the type of health care provider. Hospitals follow regulations set by the Virginia Department of Health, while physicians and other practitioners follow rules issued by the Virginia Board of Medicine.

The two primary retention frameworks are:

• Hospitals: Minimum 5 years after patient discharge, governed by 12 VAC 5-410-370
• Physicians: Minimum 6 years after the last patient encounter, governed by Va. Code § 54.1-2910.4

Both frameworks include extended requirements for records of minors. Federal rules under HIPAA and CMS add additional layers of compliance for facilities that participate in Medicare or handle protected health information.

Virginia providers should treat these periods as minimums. Other obligations, including malpractice statutes of limitations, federal program participation, and contractual requirements, may require longer retention in practice.

Hospital Records Retention Requirements

Virginia's hospital medical records retention rules are found in the Regulations for the Licensure of Hospitals in Virginia, specifically 12 VAC 5-410-370. These regulations apply to all hospitals licensed by the Virginia Department of Health.

General Retention Period

All medical records, whether originals or accurate reproductions, must be preserved for a minimum of five years following the discharge of the patient. This applies to inpatient, outpatient, and emergency department records.

Hospitals must establish a medical record for every patient treated on an inpatient, outpatient, or emergency basis. A separate medical record is required for each newborn infant, including documentation of gestational history and delivery complications.

Birth and Death Records

Birth and death information must be retained for 10 years in accordance with Va. Code § 32.1-274. This longer period applies specifically to vital records documentation maintained by the hospital.

Storage Standards

Hospitals must make provisions for the safe storage of medical records or accurate and legible reproductions. Storage practices must comply with both Va. Code § 32.1-127.1:03 (Health Records Privacy) and the Health Insurance Portability and Accountability Act (HIPAA) at 42 U.S.C. § 1320d et seq.

Physician and Practitioner Retention Requirements

Physicians and other practitioners licensed under Chapter 29 of the Code of Virginia (Medicine and Other Healing Arts) follow a separate set of retention rules under Va. Code § 54.1-2910.4 and the Virginia Board of Medicine regulations at 18 VAC 85-20-26.

General Retention Period

Practitioners must maintain health records for a minimum of six years following the last patient encounter. This applies to all records as defined in Va. Code § 32.1-127.1:03.

Maximum Retention Period

Virginia law provides that practitioners are not required to maintain health records for longer than 12 years from the date of creation. This ceiling applies to adult patient records and gives practitioners a clear endpoint for retention obligations.

The exceptions to this 12-year maximum include:

• Records of minor patients (which follow the minor-specific rules described below)
• Records required by a contractual obligation to be maintained longer
• Records required by federal law to be maintained for a longer period

Transferred Records Exception

Practitioners are not required to retain records that have been transferred to another practitioner or health care provider, or that have been provided directly to the patient or the patient's personal representative. This allows practitioners to satisfy retention obligations through proper transfer rather than indefinite storage.

Record Management Standards

Under 18 VAC 85-20-26, practitioners must properly manage patient records and maintain timely, accurate, legible, and complete documentation. Records must be made available for transfer to other practitioners, patients, or authorized representatives in accordance with state law.

Records for Minor Patients

Both hospitals and physicians face extended retention periods for the records of minor patients. The rules differ slightly between the two provider types.

Hospital Rules for Minors

Under 12 VAC 5-410-370, hospital records for minors must be kept for at least five years after the minor has reached the age of 18. This means a hospital record created for a newborn must be retained for approximately 23 years from the date of creation.

For example, if a child is born in 2026, the hospital must retain that record until at least 2049 (when the child turns 18 plus five additional years).

Physician Rules for Minors

Under Va. Code § 54.1-2910.4, physician records for minor children, including immunization records, must be maintained until the child reaches the age of 18 or becomes emancipated. The minimum retention period of six years from the last patient encounter still applies regardless of the patient's age.

In practice, this means a physician who last treats a 10-year-old patient in 2026 must keep those records until at least 2034 (when the child turns 18), or 2032 (six years from the last encounter), whichever is later.

Federal Requirements: HIPAA and CMS

Virginia providers must also comply with federal requirements that affect medical records management, even though federal law does not impose a single nationwide retention period.

HIPAA (Health Insurance Portability and Accountability Act)

The HIPAA Privacy Rule does not require covered entities to retain medical records for any specific period. According to the U.S. Department of Health and Human Services, HIPAA defers to state law on retention periods.

However, HIPAA does require covered entities to:

• Retain HIPAA-related documentation (policies, procedures, and compliance records) for six years from the date of creation or the date it was last in effect, whichever is later (45 CFR § 164.530(j))
• Apply appropriate administrative, technical, and physical safeguards to protect records throughout retention
• Implement policies for the secure disposal of electronic protected health information (ePHI) and the hardware or media on which it is stored

This means Virginia providers must keep their HIPAA compliance documentation for six years, even though the medical records themselves follow Virginia's state retention schedule.

CMS Conditions of Participation

Hospitals that participate in Medicare must meet the Conditions of Participation under 42 CFR § 482.24. These federal regulations require hospitals to maintain medical records that are accurately written, promptly completed, properly filed and retained, and accessible.

42 CFR § 482.24(b)(1) sets an explicit federal floor: hospitals must retain medical records in their original or legally reproduced form for a period of at least 5 years. Beyond that floor, CMS guidance and Medicare billing rules can effectively call for longer retention depending on the record type; Medicare claims records, for example, are often retained for at least 7 years to support potential audits.

Virginia hospitals should follow whichever period is longer: Virginia's 5-year state minimum or the applicable CMS/Medicare retention guidance.

Patient Access to Medical Records

Virginia law provides patients with clear rights to access their own medical records. These rights are established primarily through Va. Code § 32.1-127.1:03 and Va. Code § 8.01-413.

Who Can Request Records

Two different statutes govern access, and who may request records depends on which one applies:

• A patient's own records: under Va. Code § 32.1-127.1:03, the individual or the individual's personal representative may request a copy of the health record.
• Requests in anticipation of or during litigation: under Va. Code § 8.01-413 subsection D, the patient, the patient's attorney, the patient's executor or administrator, or an authorized insurer may request records.

Response Timeline

Health care providers must furnish copies of requested records within 30 days of receiving a written request. If the provider cannot meet this deadline, they must notify the requester in writing explaining the reason for the delay. The provider then has an additional 30 days to comply.

Providers must also include an audit trail of any additions, deletions, or revisions to the health record if specifically requested.

Format Options

Providers must produce records in either paper (hard copy) or electronic format, as requested by the requester. When electronic format is requested, the provider should furnish the records in an available electronic format. Providers may decline an electronic format request only if it would require substantial additional cost, modify the records, or compromise their integrity.

Nonpayment and Records Requests

Va. Code § 8.01-413 subsection B9 provides that production of health records to the patient, or to the patient's attorney, requested pursuant to that section shall not be withheld or delayed solely on the grounds of nonpayment for the records. Read together with subsection D, which limits the whole section to requests made in anticipation of litigation or in the course of litigation, that protection is written for litigation-related requests rather than as a blanket rule for every records request.

A routine request by a patient for a copy of their own records is governed instead by Va. Code § 32.1-127.1:03, which allows a reasonable cost-based copying fee and contains no equivalent nonpayment provision. Patients who are told a copy is being held over a balance should ask the provider which statute it is relying on and, where litigation is involved, point to § 8.01-413(B9).

Fees for Copies of Medical Records

What a Virginia provider may charge for copies depends on why the records were requested. Two statutes apply, and they set materially different standards, so the applicable one has to be identified first.

Routine Patient Requests for Your Own Records

A request by a patient for a copy of their own health record is governed by subsection J of Va. Code § 32.1-127.1:03. Subsection G of Va. Code § 8.01-413 expressly carves such requests out of its own fee provisions and routes them to that subsection.

Under § 32.1-127.1:03(J), the health care entity may impose a reasonable cost-based fee, which shall include only:

• The cost of supplies for copying the requested information
• The labor of copying the requested information
• Postage, when the individual asks that the records be mailed
• Preparation of an explanation or summary of the information, as agreed to by the individual

This standard sets no fixed per-page dollar caps and no maximum total charge. The charge must be reasonable and cost-based, and it may not recover costs outside that list.

One Free Copy Per Calendar Year for Benefit Claims

Subsection B7 of Va. Code § 8.01-413 requires a provider to furnish one free copy per calendar year of a patient's records stored or maintained in an electronic health record, when the patient or the patient's attorney requests them to support a claim or appeal under Title II, XVI, XVIII, or XIX of the Social Security Act, under 38 U.S.C. § 101 et seq., or under any federal or state financial needs-based benefit program. The request must be supported by reasonable documentation, such as a Social Security Administration appointment form or hearing notice.

Section 32.1-127.1:03(J) opens with an express exception for subsection B7, so this free copy applies to a patient's own-records request as well. Additional requests in the same calendar year are subject to a reasonable fee, and no fee may be charged if no records are found in response to the request.

Litigation-Related Requests: Paper Copies

The per-page schedule below comes from Va. Code § 8.01-413. Subsection D limits that section to requests by the patient, the patient's attorney, the patient's executor or administrator, or an authorized insurer, made in anticipation of litigation or in the course of litigation. These figures are not the general cap on what a provider may charge a patient for a routine copy of their own chart.

Litigation-Related Requests: Electronic Copies

Additional Allowable Charges for Litigation-Related Requests

• Search and handling fee: Up to $20
• Postage and shipping: Actual costs
• X-ray/imaging studies (electronic): $25 per study plus $10 search/handling fee
• X-ray/imaging studies (hard copy): Actual cost of supplies and labor plus $10 search/handling fee

Under § 8.01-413(C), if a court finds that a provider willfully refused to comply with a written request made in accordance with subsection B, the court may award the expenses the patient or authorized insurer incurred to obtain the copies, a refund of fees already paid, court costs, and reasonable attorney fees.

Record Storage and Format Requirements

Virginia law permits health care providers to store medical records in a variety of formats. Under Va. Code § 32.1-127.1:01, providers may maintain records using:

• Computerized or other electronic processes
• Microfilm
• Other photographic, mechanical, or chemical processes

Once records have been converted to an unalterable technological format, the provider may dispose of the original paper documents. However, this disposal must be done in a manner that preserves patient confidentiality.

Any documents or information that cannot be stored in a technological format must be identified and preserved separately. This ensures that no part of the patient record is lost during format conversion.

Providers using electronic health records (EHR) systems should ensure their systems maintain data integrity, include audit trails, and meet both HIPAA security requirements and Virginia state standards.

Record Destruction Rules

When medical records have been retained for the required minimum period, Virginia law permits their destruction. However, the destruction process must follow specific rules to protect patient privacy.

Acceptable Destruction Methods

Under 18 VAC 85-20-26, patient records may only be destroyed in a manner that protects patient confidentiality. The regulation specifically identifies the following acceptable methods:

• Incineration of paper records
• Shredding of paper records
• Secure electronic deletion of digital records, including wiping of storage media

Patient Notification Requirement

Practitioners are required to post information or otherwise inform all patients about the timeframe for record retention and destruction. This notification should be part of the practice's standard patient communications, such as intake forms, office signage, or the practice website.

This transparency requirement ensures patients know when their records may be destroyed and can request copies before that happens.

HIPAA Disposal Requirements

In addition to Virginia state requirements, HIPAA requires covered entities to implement policies and procedures that address the final disposition of electronic protected health information (ePHI). This includes procedures for removing ePHI from electronic media before the media are made available for reuse or disposal.

Paper records containing protected health information must also be disposed of securely. Placing unshredded documents in a standard trash receptacle does not meet HIPAA disposal requirements.

Practice Closure and Record Transfer

When a Virginia physician or health care practitioner closes, sells, or relocates a practice, Va. Code § 54.1-2405 establishes specific requirements for handling patient records.

Notice Requirements

Before transferring patient records, the provider must:

1. Attempt to notify current patients of the pending transfer, either electronically or by mail, at the patient's last known address
2. Publish advance notice in a newspaper of general circulation within the practice area

A "current patient" under the statute is defined as any patient who had a patient encounter with the provider during the two-year period immediately preceding the date of the record transfer.

Patient Rights During Closure

Patients have the right to request that their records be:

• Sent to another like-regulated provider of their choice
• Provided directly to them

Any charges for copying and mailing records during a practice closure cannot exceed the actual costs incurred by the provider.

Relocation Definition

Virginia defines "relocation" as moving a Virginia practice more than 30 miles from its current location, or moving to another state or the District of Columbia. Moves of 30 miles or less within Virginia do not trigger the notice requirements.

Ongoing Retention Obligations

Even after a practice closes, the retention requirements of Va. Code § 54.1-2910.4 still apply. Records that have not been transferred to another provider or given to the patient must be maintained for the full minimum retention period (6 years from last encounter, up to 12 years from creation).

Penalties for Noncompliance

Virginia providers who fail to comply with medical records retention laws face several types of consequences.

State Licensing Actions

The Virginia Board of Medicine may take disciplinary action against practitioners who fail to maintain adequate records or who destroy records prematurely. Potential sanctions include reprimand, probation, license suspension, or license revocation.

Civil Liability

Under Va. Code § 8.01-413, providers who unlawfully refuse to provide records or charge excessive fees may be liable for damages, court costs, and attorney fees. Patients may seek court intervention to compel the production of records.

HIPAA Enforcement

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) enforces HIPAA requirements. Violations related to improper disposal of protected health information can result in civil monetary penalties ranging from $145 to $73,011 per violation depending on the level of culpability (up to $2,190,294 for the most serious tier), with a calendar-year cap of $2,190,294 for all violations of an identical provision, under the inflation-adjusted tiers effective January 28, 2026 (91 FR 3665; 45 CFR 160.404).

Malpractice Implications

Providers who destroy records prematurely may face adverse inferences in malpractice litigation. If a provider cannot produce records during a malpractice suit, a court may instruct the jury to presume the missing records would have been unfavorable to the provider.