Washington
Washington Medical Records Retention Laws (2026 Guide)
Independently fact-checked against primary sources (last audited September 7, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 18, 2026. · 27 primary sources cited on this page. How we verify our legal content
Washington hospitals must retain medical records for at least 26 years from the date of creation under RCW 70.41.190, as amended by SB 5239. Individual physicians have no statutory mandate, but the Washington Medical Commission recommends 10 years from last patient contact. HIPAA does not set its own medical record retention period.
Washington state has detailed rules governing how long hospitals, physicians, and other health care providers must keep patient medical records. These requirements come from a combination of state statutes, administrative rules, and federal regulations. Understanding them matters whether you are a patient trying to access old records, a provider managing storage, or a practice planning for closure.
This guide covers the current retention periods, federal requirements under HIPAA and CMS, patient access rights, proper destruction methods, and what happens when a medical practice closes in Washington.
Hospital Medical Records Retention in Washington
The 26-Year Rule Under RCW 70.41.190
Washington Governor Bob Ferguson signed SB 5239 into law on April 22, 2025, fundamentally changing hospital record retention requirements. The new law took effect on July 27, 2025.
Under the amended RCW 70.41.190 (2025 c 131 s 1), hospitals must retain and preserve all medical records for a minimum of 26 years from the date the record was created. This replaced the previous requirement, which mandated retention for 10 years following patient discharge.
"A hospital shall retain and preserve all medical records for a minimum period of 26 years from the date the record was created." RCW 70.41.190
The old law created a practical problem: records without a clear discharge date had to be kept indefinitely. According to Sen. Vandana Slatter, the bill's sponsor, UW Medical Center alone was spending approximately $750,000 annually on storing decades-old records.
What the New Law Covers
The 26-year requirement applies to:
- Medical records created before July 27, 2025, that the hospital still retained on that date
- All medical records created on or after July 27, 2025
- Records in any format. The statute permits a hospital to retain records on paper, microfilm, electronically, or on other media.
The 26-year requirement does not reach records the hospital no longer held on July 27, 2025, provided the hospital complied with the prior version of the statute when it destroyed or otherwise disposed of them.
WAC 246-320-166: Administrative Requirements
WAC 246-320-166 provides the administrative framework for hospital medical records management. Under this regulation, hospitals must:
- Maintain confidentiality and security of all patient records
- Initiate and sustain medical records for every patient evaluated or treated
- Ensure records contain patient identification, clinical data supporting diagnosis and treatment, signed consent documents, and entries that are accurately written, signed, dated, and timed
- Establish systematic methods for identifying, filing, and retrieving patient records
- File records accessibly and retain them per RCW 70.41.190 and chapter 5.46 RCW
Physician and Other Provider Retention Requirements
No Mandatory Statutory Period for Physicians
Unlike hospitals, Washington state does not have a general statute requiring individual physicians to retain medical records for a specific number of years. This is an important distinction that many providers and patients misunderstand.
"There is no general law in Washington requiring a practitioner to retain a patient's medical record for a specific period of time." Washington Medical Commission, Medical Records Guideline GUI2024-01
The Washington Medical Commission (WMC) has issued formal guidance recommending retention periods anyway. Concurring with the Washington State Medical Association, the WMC recommends that practitioners retain medical records and x-rays for at least:
- Ten years from the date of a patient's last visit, prescription refill, telephone contact, test, or other patient contact
- Twenty-one years from the date of a minor patient's birth
- Six years from the date of a patient's death
- Indefinitely, if the practitioner has reason to believe the patient is or was incompetent, there are or were significant concerns involving the patient's care, or the patient is or is likely to become involved in litigation
The WMC also advises practitioners to consider whether retaining records indefinitely is feasible, to verify the retention time their medical malpractice insurer requires, and to tell patients how long records will be kept.
While these are recommendations rather than legal mandates, failing to follow them could factor into professional discipline proceedings or malpractice claims. The WMC considers record retention practices when evaluating complaints against physicians.
Retention Periods for Other Provider Types
Different categories of health care providers in Washington have specific retention requirements set by statute or rule:
| Provider Type | Minimum Retention Period | Authority |
|---|---|---|
| Hospitals | 26 years from date of creation | RCW 70.41.190 |
| Nursing facilities | 8 years from most recent discharge | RCW 18.51.300 |
| Psychologists | 8 years from last client contact | WAC 246-924-354 |
| Physicians (recommended) | 10 years from last contact | WMC Guideline GUI2024-01 |
| Podiatric physicians | 7 years after treatment is rendered | WAC 246-922-260 |
| Chiropractors | 5 years | WAC 246-808-650 |
Records of Minor Patients
Washington has specific rules for retaining records of patients who were minors at the time of treatment:
- Hospitals: 26 years from date of creation under the amended RCW 70.41.190. Previously, the longer of 10 years after discharge or 3 years after the minor turned 18. The new 26-year rule provides even longer protection in most cases.
- Nursing facilities: The longer of 10 years after discharge or 3 years after the minor turns 18, under RCW 18.51.300.
- Psychologists: Until the client reaches age 22 or for 8 years after last contact, whichever is longer, under WAC 246-924-354.
- Physicians (recommended): The WMC recommends retaining a minor patient's records for 21 years from the date of the patient's birth.
Each of these rules runs longer than the ordinary adult retention period for the same provider type. If you are requesting childhood records, the practical takeaway is that they may still exist well after you turn 18, and the holder is often a hospital rather than the individual physician who treated you.
Federal Requirements: HIPAA and CMS
HIPAA Record Retention
A common misconception is that HIPAA requires health care providers to retain medical records for a specific number of years. It does not. No provision of the HIPAA Privacy Rule sets a retention period for medical records themselves, a point the U.S. Department of Health and Human Services has also made in its published HIPAA guidance. State laws govern how long medical records must be retained.
HIPAA does require covered entities to retain certain HIPAA-related documentation for 6 years. Under 45 CFR 164.530(j)(2), the Privacy Rule requires that documentation be kept "for six years from the date of its creation or the date when it last was in effect, whichever is later." That covers:
- Privacy policies and procedures
- Privacy practices notices
- Disposition of complaints
- Required accounting of disclosures
- Training records
- Patient authorization forms
The Security Rule imposes a parallel 6-year documentation requirement at 45 CFR 164.316(b)(2)(i), which covers security policies and procedures and written records of any action, activity, or assessment the Security Rule requires to be documented.
Both 6-year clocks attach to compliance paperwork, not to the patient's chart, so neither one tells you how long your medical records are kept. Providers must comply with both their state retention obligations and the HIPAA documentation retention rules.
HIPAA also requires that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for the entire period the information is maintained, including through final disposal.
CMS Conditions of Participation
Hospitals participating in Medicare and Medicaid must comply with the Conditions of Participation under 42 CFR 482.24. These federal rules require that:
- A medical record must be maintained for every individual evaluated or treated in the hospital
- Records must be accurately written, promptly completed, properly filed and retained, and accessible
- The hospital must have a system for coding and indexing medical records
Under 42 CFR 482.24(b)(1), medical records must be retained in their original or legally reproduced form for at least 5 years. When state law requires a longer retention period, as Washington's 26-year hospital requirement does, the state law controls.
Patient Access to Medical Records
Rights Under RCW 70.02.080
Washington patients have a statutory right to access their own medical records under RCW 70.02.080. When a patient submits a written request, the provider must respond as promptly as the circumstances require, but no later than 15 working days.
If the provider cannot meet the 15-day deadline, they must notify the patient by that date, explain the reason for the delay, and complete the request no later than the 21st working day.
Upon request, providers must:
- Make records available for examination during regular business hours
- Provide copies if requested
- Inform patients if records do not exist or cannot be located
- Identify other providers who may hold the requested information
- Explain any codes or abbreviations used in the records
Fees for Copies
Under WAC 246-08-400, providers may charge the following maximum fees for medical record copies:
| Fee Type | Maximum Amount |
|---|---|
| First 30 pages | $1.24 per page |
| Additional pages (beyond 30) | $0.94 per page |
| Clerical search and handling fee | $28.00 |
| Editing for confidential information removal | Usual fee for a basic office visit |
HIPAA-covered entities may not charge fees exceeding those permitted under 45 CFR 164.524. The Washington Department of Health notes that the Secretary of Health adjusts these amounts biennially based on changes in the Consumer Price Index, so confirm the current figures before disputing a charge.
Right to Correct Records
Under RCW 70.02.100, patients may request in writing that a provider correct or amend inaccurate or incomplete information in their medical records. Providers must also maintain records for at least one year following receipt of an authorization to disclose health care information, per RCW 70.02.160.
Proper Destruction of Medical Records
State Requirements
When the applicable retention period has expired, Washington requires that records containing personal health information be destroyed by secure means. Under RCW 19.215.020, part of chapter 19.215 RCW on disposal of personal information, an entity must take all reasonable steps to destroy, or arrange for the destruction of, personal financial and health information in records within its custody or control when it disposes of records it will no longer retain.
That statute sets a reasonableness standard rather than prescribing one specific method. The practical benchmark comes from federal law: the Washington Medical Commission's guideline notes that the HIPAA Privacy Rule prohibits digital and paper records containing confidential information from being thrown away in a public dumpster or recycling bin until they have been rendered unreadable or indecipherable by shredding, burning, or another method of destruction.
The WMC also advises that practitioners give patients an opportunity to claim their records, or to have them sent to another practitioner, before the records are destroyed.
HIPAA Destruction Standards
For electronic records, 45 CFR 164.310(d)(2) requires covered entities to implement policies and procedures addressing the final disposition of electronic protected health information and the hardware or electronic media on which it is stored, plus procedures for removing that information from media before the media are reused.
Covered entities may hire a vendor to handle disposal. Under 45 CFR 164.308(b)(1), the covered entity must first obtain satisfactory assurances, documented in a written contract or other arrangement meeting 45 CFR 164.314(a), that the business associate will appropriately safeguard the information.
Practice Closure and Record Transfer
Physician Practice Closure
When a Washington physician closes a practice, the Washington Medical Commission recommends the following steps in Guideline GUI2024-01:
- Notify active patients and patients seen within the previous three years before the practice closes.
- Give notice at least 30 days in advance, with 90 days being the best practice.
- Deliver notice by at least one, and preferably all, of these methods: an individual letter to the last known patient address, electronic communication where that is a normal method of clinical communication with the patient, and a notice on the practice website.
- Include the practical details in the notice: the name, telephone number, and mailing address of the entity or agent to contact for records; how records can be obtained or transferred; the format of the records; how long records will be maintained before they are destroyed; and the cost of recovering or transferring records as defined in chapter 70.02 RCW.
- Arrange a custodian if needed. A practitioner may contract with a third party to act as custodian, and that custodian must comply with applicable federal and state confidentiality laws.
The obligation to make medical records available to patients and other practitioners continues after a practice closes. If a practice closes because the practitioner died, the practitioner's estate becomes the owner of the records, and the WMC encourages the estate to notify patients.
Hospital Closure
Under RCW 70.41.190, if a hospital ceases operations, it must make immediate arrangements, as approved by the Washington State Department of Health, for preservation of its records. The hospital cannot simply destroy records or abandon them upon closing.
Nursing Facility Closure
Similarly, RCW 18.51.300 requires nursing facilities that cease operations to make immediate arrangements, approved by the department, for preservation of patient care records.
Psychologist Practice Closure
WAC 246-924-354 requires psychologists to establish a written succession plan that designates qualified individuals or facilities to handle referrals and record requests if the psychologist retires, discontinues practice, or becomes unable to work.
Key Differences: Washington vs. Federal Requirements
| Requirement | Washington State | Federal (HIPAA/CMS) |
|---|---|---|
| Hospital retention period | 26 years from creation (RCW 70.41.190) | CMS: 5 years minimum |
| Physician retention period | No statutory mandate; 10 years recommended | No HIPAA mandate; state law governs |
| HIPAA documentation | N/A (federal rule) | 6 years for policies, authorizations, training records |
| Patient access response time | 15 working days (RCW 70.02.080) | 30 days under 45 CFR 164.524 |
| Records of minors | Varies by provider type | No specific federal rule |
When state and federal requirements differ, providers must follow whichever standard imposes the longer retention period or stricter obligation.
Frequently Asked Questions
How long do Washington hospitals have to keep medical records?
As of July 27, 2025, Washington hospitals must retain all medical records for a minimum of 26 years from the date the record was created, under the amended RCW 70.41.190. This replaced the previous 10-year requirement that was measured from the date of patient discharge.
How long must a Washington physician keep patient records?
Washington has no general statute requiring physicians to retain medical records for a specific period. The Washington Medical Commission recommends keeping records for at least 10 years from the patient's last visit, prescription refill, telephone contact, test, or other contact; 21 years from a minor patient's birth; and 6 years from a patient's death. It recommends indefinite retention where the patient is or was incompetent, there are significant concerns about the patient's care, or litigation is likely.
How do I get copies of my medical records in Washington?
Submit a written request to your health care provider. Under RCW 70.02.080, the provider must respond within 15 working days. If there is a delay, the provider must notify you and complete the request by the 21st working day. Under WAC 246-08-400, providers may charge up to $1.24 per page for the first 30 pages, $0.94 per page after that, and a $28 clerical search and handling fee. The Department of Health adjusts these amounts biennially, so confirm the current figures.
What happens to medical records when a doctor's office closes in Washington?
The Washington Medical Commission recommends that the physician notify active patients and patients seen within the previous three years at least 30 days before closing, with 90 days as best practice. Notice may go out by letter to the last known address, by electronic communication where that is normal for the practice, or by a notice on the practice website, and it should say how to obtain or transfer records. A practitioner may contract with a third party custodian, who must comply with state and federal confidentiality laws. The duty to make records available continues after the practice closes.
Does HIPAA require medical records to be kept for a specific number of years?
No. The HIPAA Privacy Rule does not set a medical record retention period. However, 45 CFR 164.530(j) requires covered entities to retain HIPAA-related documentation, including privacy policies, authorization forms, and training records, for at least 6 years, and the Security Rule sets a parallel 6-year rule for its own documentation at 45 CFR 164.316(b)(2)(i). Both clocks apply to compliance paperwork, not to the patient's chart. Medical record retention is governed by state law, which in Washington varies by provider type.
How long are a Washington child's medical records kept?
It depends on who holds them. A hospital must keep them 26 years from the date the record was created (RCW 70.41.190). A nursing facility must keep them until 3 years after the minor turns 18 or 10 years after discharge, whichever is longer (RCW 18.51.300). A psychologist keeps them until the client turns 22 or 8 years after last contact, whichever is longer (WAC 246-924-354). The Washington Medical Commission recommends physicians keep them 21 years from the date of the patient's birth.
Updates
Independently fact-checked against the cited primary sources
Independently fact-checked against the cited primary sources; governing law re-checked for recent changes
Governing law re-checked for recent changes
Governing law re-checked for recent changes
Corrected the medical records copying fee for pages beyond the first 30 to $0.94 per page, and fixed the Washington Medical Commission's recommendation for minors' records to its actual figure of 21 years from the patient's birth. Also re-sourced the record destruction rules to RCW 19.215.020 and added the Commission's retention guidance for records after a patient's death or where litigation is likely. Also corrected the name of the governor who signed the 2025 hospital records law (Bob Ferguson, not Jay Inslee) and the citation for HIPAA's 6-year documentation rule, which comes from 45 CFR 164.530(j) for privacy records rather than 45 CFR 164.316.
Independently fact-checked against the cited primary sources
Reviewed and approved by an editor
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
Revised Code of Washington
§ 70.41.190Medical records of patients—Retention and preservation.In forcecited in 4 of our articles
(1) A hospital shall retain and preserve all medical records for a minimum period of 26 years from the date the record was created. A hospital may retain medical records on paper, microfilm, electronically, or on other media. (a) This subsection applies to: (i) Medical records created prior to July 27, 2025, and retained or preserved by the hospital on July 27, 2025; and (ii) Medical records created on or after July 27, 2025. (b) This subsection does not apply to medical records no longer retained and preserved by the hospital on July 27, 2025, if the hospital complied with this section as it existed prior to July 27, 2025, when it destroyed or otherwise disposed of the records. (c) This subsection does not exempt hospitals from compliance with any other record retention requirements. (2) All information collected at each unique visit is considered a medical record for the purposes of this section. (3) If a hospital ceases operations, it shall make immediate arrangements, as approved by the department, for preservation of its records.
Official text (excerpt) · last checked 2026-09-07 · Read the full text in our law library · Verify at app.leg.wa.gov
Cited in 2 court opinions in our collectionLatest citing opinion in our collection: 2025
Opinions citing this section in our collection:
- Debra Stevens, Appellant/cr-respondent V. Craig Jonov, M.d., Respondent/cr-appellants (Court of Appeals of Washington 2025)“…information when a practice is sold or acquired. See, e.g., RCW 70.41.190 (providing that hospitals “shall retain…”
- Lumumba v. Pierce County (District Court, W.D. Washington 2025)“…ical 2 records as it was already required to do so under RCW 70.41.190. Dkt. 28 at 2. Ms. Lumumba 3 replied…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: How Long Do Hospitals Keep Medical Records? (2026), Medical Records Retention Laws by State (2026 Guide), Medical Records Retention Laws by State (2026 Guide)
§ 18.51.300Retention and preservation of records of patients.In force
Unless specified otherwise by the department, a nursing home shall retain and preserve all records which relate directly to the care and treatment of a patient for a period of no less than eight years following the most recent discharge of the patient; except the records of minors, which shall be retained and preserved for a period of no less than three years following attainment of the age of eighteen years, or ten years following such discharge, whichever is longer. If a nursing home ceases operations, it shall make immediate arrangements, as approved by the department, for preservation of its records. The department shall by regulation define the type of records and the information required to be included in the records to be retained and preserved under this section; which records may be retained in photographic form pursuant to chapter 5.46 RCW.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at app.leg.wa.gov
§ 70.02.080Patient's examination and copying—Requirements.In force
(1) Upon receipt of a written request from a patient to examine or copy all or part of the patient's recorded health care information, a health care provider, as promptly as required under the circumstances, but no later than fifteen working days after receiving the request shall: (a) Make the information available for examination during regular business hours and provide a copy, if requested, to the patient; (b) Inform the patient if the information does not exist or cannot be found; (c) If the health care provider does not maintain a record of the information, inform the patient and provide the name and address, if known, of the health care provider who maintains the record; (d) If the information is in use or unusual circumstances have delayed handling the request, inform the patient and specify in writing the reasons for the delay and the earliest date, not later than twenty-one working days after receiving the request, when the information will be available for examination or copying or when the request will be otherwise disposed of; or (e) Deny the request, in whole or in part, under RCW 70.02.090 and inform the patient.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at app.leg.wa.gov
Cited in 5 court opinions in our collectionLatest citing opinion in our collection: 2025
Opinions citing this section in our collection:
- Wynn v. Earin (Court of Appeals of Washington 2005, 131 Wash. App. 28)“…ver did produce the records. Mr. Wynn claimed this violated RCW 70.02.080, which requires a health care provider…”
- Neel v. Luther Child Center (Court of Appeals of Washington 1999, 98 Wash. App. 390)“…ust state whether or not it will grant or deny the request. RCW 70.02.080(1). Denial is appropriate if the health…”
- Debra Stevens, Appellant/cr-respondent V. Craig Jonov, M.d., Respondent/cr-appellants (Court of Appeals of Washington 2025)“…(PHI) to Alderwood Surgical absent her consent, contrary to RCW 70.02.080 and the Health Insurance Portability an…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 70.02.100Correction or amendment of record.In force
(1) For purposes of accuracy or completeness, a patient may request in writing that a health care provider correct or amend its record of the patient's health care information to which a patient has access under RCW 70.02.080. (2) As promptly as required under the circumstances, but no later than ten days after receiving a request from a patient to correct or amend its record of the patient's health care information, the health care provider shall: (a) Make the requested correction or amendment and inform the patient of the action; (b) Inform the patient if the record no longer exists or cannot be found; (c) If the health care provider does not maintain the record, inform the patient and provide the patient with the name and address, if known, of the person who maintains the record; (d) If the record is in use or unusual circumstances have delayed the handling of the correction or amendment request, inform the patient and specify in writing, the earliest date, not later than twenty-one days after receiving the request, when the correction or amendment will be made or when the request will otherwise be disposed of; or (e) Inform the patient in writing of the provider's…
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at app.leg.wa.gov
Cited in 1 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Michelle Zimmerman V. King County (Court of Appeals of Washington 2026)“…a duty, she cites a statute not mentioned in her petition—RCW 70.02.100, which addresses correction or amendme…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 70.02.160Retention of record.In force
A health care provider shall maintain a record of existing health care information for at least one year following receipt of an authorization to disclose that health care information under RCW 70.02.040, and during the pendency of a request for examination and copying under RCW 70.02.080 or a request for correction or amendment under RCW 70.02.100.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at app.leg.wa.gov
Cited in 1 court opinions in our collectionLatest citing opinion in our collection: 2025
Opinions citing this section in our collection:
- Debra Stevens, Appellant/cr-respondent V. Craig Jonov, M.d., Respondent/cr-appellants (Court of Appeals of Washington 2025)“…years following the most recent discharge of the patient); RCW 70.02.160 (explaining that a provider must “maint…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 19.215.020Destruction of information—Liability—Exception—Civil action.In force
(1) An entity must take all reasonable steps to destroy, or arrange for the destruction of, personal financial and health information and personal identification numbers issued by government entities in an individual's records within its custody or control when the entity is disposing of records that it will no longer retain. (2) An entity is not liable under this section for records it has relinquished to the custody and control of the individual to whom the records pertain. (3) This subsection [section] does not apply to the disposal of records by a transfer of the records, not otherwise prohibited by law, to another entity, including a transfer to archive or otherwise preserve public records as required by law. (4) An individual injured by the failure of an entity to comply with subsection (1) of this section may bring a civil action in a court of competent jurisdiction.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at app.leg.wa.gov
Code of Federal Regulations Title 42
§ 482.24Condition of participation: Medical record services.In forcecited in 52 of our articles
The hospital must have a medical record service that has administrative responsibility for medical records. A medical record must be maintained for every individual evaluated or treated in the hospital. (a) Standard: Organization and staffing. The organization of the medical record service must be appropriate to the scope and complexity of the services performed. The hospital must employ adequate personnel to ensure prompt completion, filing, and retrieval of records. (b) Standard: Form and retention of record. The hospital must maintain a medical record for each inpatient and outpatient. Medical records must be accurately written, promptly completed, properly filed and retained, and accessible. The hospital must use a system of author identification and record maintenance that ensures the integrity of the authentification and protects the security of all record entries. (1) Medical records must be retained in their original or legally reproduced form for a period of at least 5 years. (2) The hospital must have a system of coding and indexing medical records. The system must allow for timely retrieval by diagnosis and procedure, in order to support medical care evaluation studies.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 18 court opinions in our collectionLatest citing opinion in our collection: 2024
In the courts (editorial summary, independently checked):United States ex rel. Janssen v. Lawrence Memorial Hospital (2020) held the accurate medical record duty in 42 C.F.R. 482.24 is a generic regulatory requirement that does not establish False Claims Act materiality. United States Ex Rel. El-Amin v. George Washington University (2008) applied 482.24(c) to record completion evidence.
Opinions citing this section in our collection:
- United States ex rel. Janssen v. Lawrence Memorial Hospital (Court of Appeals for the Tenth Circuit 2020, 949 F.3d 533)✓A relator alleged the hospital falsified patient arrival times to raise its Medicare quality-program payments. The court held the general duty to keep accurate medical records under 42 C.F.R. 482.24 does not address those programs and cannot show False Claims Act materiality.
- United States Ex Rel. El-Amin v. George Washington University (District Court, District of Columbia 2008, 533 F. Supp. 2d 12)✓Nurse anesthetists claimed the hospital billed Medicare as though anesthesiologists performed whole procedures. Citing the 30-day rule in 42 C.F.R. 482.24(c)(2), the court excluded late-signing evidence, and excluded mass-signing evidence too though (c)(1) made it probative.
- NATIONAL ASS'N OF PSYCHIATRIC HEALTH SYSTEM v. Shalala (District Court, District of Columbia 2000, 120 F. Supp. 2d 33)“…to preexisting recordkeeping requirements, as specified in 42 C.F.R. § 482.24 . 7 . Proposed Rul…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: How to Find Old Medical Records Online, Florida Medical Records Retention Laws (2026 Guide), Arkansas Medical Records Retention Laws (2026 Guide)
Code of Federal Regulations Title 45
§ 164.530Administrative requirements.In forcecited in 40 of our articles
(a)(1) Standard: Personnel designations. (i) A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity. (ii) A covered entity must designate a contact person or office who is responsible for receiving complaints under this section and who is able to provide further information about matters covered by the notice required by § 164.520. (2) Implementation specification: Personnel designations. A covered entity must document the personnel designations in paragraph (a)(1) of this section as required by paragraph (j) of this section. (b)(1) Standard: Training. A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity. (2) Implementation specifications: Training.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 23 court opinions in our collectionLatest citing opinion in our collection: 2025
In the courts (editorial summary, independently checked):Surprise v. Innovation Group, Inc. (2013) applied 45 CFR 164.530(c), noting it requires appropriate safeguards but does not specify what they must be, and rejected a wrongful discharge claim resting on it. Baum v. KEYSTONE MERCY HEALTH PLAN (2011) treated the same duty as background to state tort claims and remanded.
Opinions citing this section in our collection:
- Baum v. KEYSTONE MERCY HEALTH PLAN (District Court, E.D. Pennsylvania 2011, 826 F. Supp. 2d 718)✓A lost flash drive exposed health data on 280,000 insured children, and a parent sued in state court for negligence per se. The court held that resting the claim on the HIPAA safeguard rule at 45 C.F.R. 164.530(c)(2)(i) raised no substantial federal question, and remanded.
- Surprise v. Innovation Group, Inc. (District Court, D. Massachusetts 2013, 925 F. Supp. 2d 134)✓An employee fired after complaining that health-information documents went into unsecured trash sued for wrongful discharge. The court read 45 C.F.R. 164.530(c) to require safeguards without prescribing a method, and held HIPAA disposal rules are not well-defined public policy.
- Michael Terpin v. at and T Mobility LLC (Court of Appeals for the Ninth Circuit 2024, 118 F.4th 1102)“…viders to protect patients’ “protected health information.” 45 C.F.R. § 164.530(c)(1); Moore, 299 Cal. Rptr. 3d at 561.…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Alaska Medical Records Retention Laws (2026 Guide), District of Columbia Medical Records Retention Laws (2026 Guide), Delaware Medical Records Retention Laws (2026 Guide)
§ 164.316Policies and procedures and documentation requirements.In forcecited in 6 of our articles
A covered entity or business associate must, in accordance with § 164.306: (a) Standard: Policies and procedures. Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart. (b)(1) Standard: Documentation. (i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and (ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment. (2) Implementation specifications: (i) Time limit (Required).
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 1 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Deisy Granados v. Pan American Life Insurance Co. (New Jersey Superior Court Appellate Division 2026)“…authorized members of its workforce." She further claimed 45 C.F.R. § 164.316 bars defendants from "retaliating agai…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Oklahoma Medical Records Retention Laws (2026 Guide), Texas Medical Records Retention Laws (2026 Guide), Minnesota Medical Records Retention Laws (2026 Guide)
§ 164.524Access of individuals to protected health information.In forcecited in 23 of our articles
(a) Standard: Access to protected health information —(1) Right of access. Except as otherwise provided in paragraph (a)(2) or (a)(3) of this section, an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for: (i) Psychotherapy notes; and (ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. (2) Unreviewable grounds for denial. A covered entity may deny an individual access without providing the individual an opportunity for review, in the following circumstances. (i) The protected health information is excepted from the right of access by paragraph (a)(1) of this section.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 88 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):Webb v. Smart Document Solutions, LLC (2007) held the reduced, cost-based fee in section 164.524(c)(4) applies only when the individual himself requests his records, not a law firm acting as his agent. Ciox Health, LLC v. Hargan (2020) vacated 2016 guidance that extended that patient rate to third-party directives.
Opinions citing this section in our collection:
- Webb v. Smart Document Solutions, LLC (Court of Appeals for the Ninth Circuit 2007, 499 F.3d 1078)✓A law firm ordered its client's hospital records and was billed a copying company's higher third-party rate; the Ninth Circuit held Section 164.524(c)(4)'s cost-based fee limit applies only when the individual or a personal representative asks, not an attorney acting as agent.
- Evenson v. Hartford Life & Annuity Insurance (District Court, M.D. Florida 2007, 244 F.R.D. 666)✓A therapist refused a subpoena for her psychotherapy notes, citing Section 164.524(a)(1)'s exclusion of those notes from a patient's right of access; the court held that exclusion governs only individual access, not discovery, and ordered the notes produced.
- Ciox Health, LLC v. Hargan (District Court, District of Columbia 2020)“…fee that can be charged for such production. See generally 45 C.F.R. § 164.524. For requests brought by an individual…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Kentucky Medical Records Retention Laws (2026 Guide), North Carolina Medical Records Retention Laws (2026 Guide), South Carolina Medical Recording Laws: Patient Rights, HIPAA, and Consent (2026)
§ 164.310Physical safeguards.In forcecited in 3 of our articles
A covered entity or business associate must, in accordance with § 164.306: (a)(1) Standard: Facility access controls. Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed. (2) Implementation specifications: (i) Contingency operations (Addressable). Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency. (ii) Facility security plan (Addressable). Implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft. (iii) Access control and validation procedures (Addressable). Implement procedures to control and validate a person's access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision. (iv) Maintenance records (Addressable).
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 2 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Wentworth-Douglass Hospital v. Young (District Court, D. New Hampshire 2012, 2012 DNH 057)“…electronic protected health information” or “media re-use,” 45 C.F.R. § 164.310 (d)(1),(2), in its own Security Officer…”
- Deisy Granados v. Pan American Life Insurance Co. (New Jersey Superior Court Appellate Division 2026)“…taining access to electronic protected health information"; 45 C.F.R. § 164.310 provides, in relevant part, covered ent…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Maryland Medical Records Retention Laws (2026 Guide)
§ 164.308Administrative safeguards.In forcecited in 2 of our articles
(a) A covered entity or business associate must, in accordance with § 164.306: (1)(i) Standard: Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations. (ii) Implementation specifications: (A) Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate. (B) Risk management (Required). Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a). (C) Sanction policy (Required). Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate. (D) Information system activity review (Required). Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. (2) Standard: Assigned security responsibility.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 12 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- United States Ex Rel. Sheldon v. Kettering Health Network (Court of Appeals for the Sixth Circuit 2016, 816 F.3d 399)“…ity risk analysis in accordance with the requirements under 45 C.F.R. § 164.308(a)(1) and implement security updates as…”
- Florida Ex Rel. Attorney General v. United States Department of Health & Human Services (Court of Appeals for the Eleventh Circuit 2011, 648 F.3d 1235)“…nd technical privacy safeguards and employee training. See 45 C.F.R. §§ 164.308, 164.310, 164.312. Fourth, Congr…”
- Weinberg v. Advanced Data Processing, Inc. (District Court, S.D. Florida 2015, 147 F. Supp. 3d 1359)“…contain, and correct security violations in violation of 45 C.F.R. § 164.308 (a)(1); Failing to identify and respo…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: HIPAA Compliance Companies: Top Platforms Compared (2026)
§ 164.314Organizational requirements.In force
(a)(1) Standard: Business associate contracts or other arrangements. The contract or other arrangement required by § 164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable. (2) Implementation specifications (Required) —(i) Business associate contracts. The contract must provide that the business associate will— (A) Comply with the applicable requirements of this subpart; (B) In accordance with § 164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit electronic protected health information on behalf of the business associate agree to comply with the applicable requirements of this subpart by entering into a contract or other arrangement that complies with this section; and (C) Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410. (ii) Other arrangements. The covered entity is in compliance with paragraph (a)(1) of this section if it has another arrangement in place that meets the requirements of § 164.504(e)(3). (iii) Business associate contracts with subcontractors.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Explore the law
This article also draws on these acts and chapters (opening at their first section): Revised Code of Washington § 70.02.005 (Findings.)
Related law for further reading — not part of this article’s citations.
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- RCW 70.41.190: Medical records of patients - Retention and preservation(app.leg.wa.gov).gov
- Substitute Senate Bill 5239, Chapter 131, Laws of 2025 (enrolled session law, approved April 22, 2025)(lawfilesext.leg.wa.gov).gov
- Washington State Legislature: SSB 5239 bill summary and history (2025)(app.leg.wa.gov).gov
- RCW 70.02.080: Patient examination and copying requirements(app.leg.wa.gov).gov
- RCW 70.02.160: Retention of record(app.leg.wa.gov).gov
- RCW 70.02.100: Correction or amendment of record(app.leg.wa.gov).gov
- RCW 18.51.300: Retention and preservation of records of patients (nursing facilities)(app.leg.wa.gov).gov
- Chapter 70.02 RCW: Medical Records - Health Care Information Access and Disclosure(app.leg.wa.gov).gov
- RCW 19.215.020: Destruction of information, liability, exception, civil action (chapter 19.215 RCW, Disposal of Personal Information)(app.leg.wa.gov).gov
- WAC 246-320-166: Hospital medical records management(app.leg.wa.gov).gov
- WAC 246-924-354: Psychologist record retention requirements(app.leg.wa.gov).gov
- WAC 246-922-260: Podiatric physicians - Maintenance of patient records (7 years)(app.leg.wa.gov).gov
- WAC 246-808-650: Chiropractors - Maintenance and retention of patient records (5 years)(app.leg.wa.gov).gov
- WAC 246-08-400: Health care providers charging for searching and duplicating records(app.leg.wa.gov).gov
- Washington Medical Commission: Medical Records Guideline GUI2024-01 (adopted April 26, 2024)(wmc.wa.gov).gov
- SB 5239: Governor signs Slatter bill on hospital medical records retention(senatedemocrats.wa.gov).gov
- 42 CFR 482.24: Condition of participation - Medical records (5-year retention)(ecfr.gov).gov
- 45 CFR 164.530(j): Privacy Rule documentation and six-year retention period(ecfr.gov).gov
- 45 CFR 164.316: Security Rule policies, procedures and documentation requirements (6-year documentation retention at (b)(2)(i))(ecfr.gov).gov
- 45 CFR 164.524: Access of individuals to protected health information(ecfr.gov).gov
- 45 CFR 164.310: Physical safeguards - device and media controls, disposal and media re-use(ecfr.gov).gov
- 45 CFR 164.308: Administrative safeguards - business associate contracts(ecfr.gov).gov
- CMS Conditions of Participation: Hospitals(cms.gov).gov
- HHS: Does HIPAA require covered entities to keep medical records for any period?(hhs.gov).gov
- HHS: Summary of the HIPAA Privacy Rule(hhs.gov).gov
- HHS: Individuals Right under HIPAA to Access Health Information(hhs.gov).gov
- Washington Department of Health: Medical Records(doh.wa.gov).gov