Wyoming Medical Records Retention Laws (2026 Guide)

---

title: "Wyoming Medical Records Retention Laws" meta_description: "Wyoming repealed its hospital records statutes in 2019, and no state statute now sets a medical records retention period. Learn what federal rules apply and how long providers should keep records."

Overview of Wyoming Medical Records Retention Laws

Wyoming has no state statute that fixes how long a health care provider must keep a patient medical record. The 2019 Legislature repealed the Wyoming Hospital Records and Information Act, Wyo. Stat. Ann. 35-2-605 through 35-2-617, through Senate File 96, enrolled as Senate Enrolled Act No. 53 and codified as Chapter 78, Session Laws of Wyoming 2019. Section 3 of the act repealed those sections outright, and Section 4 set the effective date at July 1, 2019.

That repeal changed which rules answer the question, not whether the question has an answer. Wyoming providers now work from federal Medicare and Medicaid regulations, HIPAA, the Wyoming Board of Medicine's practice rules, and the limitations periods that govern malpractice and contract claims. For the broader national picture, see how long hospitals keep medical records.

Two different duties get confused constantly, so it is worth separating them at the outset. A retention rule says how long a record must exist. An access rule says how quickly a provider must hand a copy to the patient who asks. Wyoming now has no state rule that fixes a retention period, but it does have a state access rule, and the Board of Medicine enforces it.

Watch out: Licensing rules add conditions without adding a number. The current hospital licensing rule, Department of Health Healthcare Licensing and Surveys Chapter 12, effective March 1, 2023, sets no fixed retention period; its Section 23(c) instead requires public hospitals to preserve records under the retention schedules established by the Wyoming State Archives and the State Records Committee. Licensing chapters are revised on their own cycle, so confirm the current rule for your facility type before setting policy.

What the 2019 Repeal Actually Did

The bill carried the catch line "Repeal-hospital records and information statutes." Senators Kinskey, Baldwin and Nethercott and Representatives Kinner and Western sponsored it. The Senate passed it 28-0 on January 25, 2019, the House passed it 57-1 on February 21, 2019, and the Governor signed it on February 26, 2019.

The act's own title describes its scope precisely: "AN ACT relating to public health and safety; repealing provisions related to hospital record confidentiality and disclosure; recreating provisions related to medical staff committees as specified; amending references to repealed sections; and providing for an effective date."

Three things follow from that text.

• The repeal was targeted, not total. Section 1 created Wyo. Stat. 35-2-618, which provides that "All reports, findings, proceedings and data of medical staff committees shall be confidential and privileged." The Legislature kept the peer-review protection and let the records provisions go.
• The repeal was a cross-reference cleanup as much as a policy change. Section 2 amended Wyo. Stat. 7-13-1607(c), 7-13-1610, 9-2-125(a), 9-2-1035(a)(v)(A), 25-5-131(b)(vi) and 26-34-108(c) to strike citations to the repealed sections.
• HIPAA became the named standard in state law. Before the amendment, Wyo. Stat. 25-5-131(b)(vi) allowed record access to "A person as required by law, including the Wyoming Hospital Records and Information Act, the Health Insurance Portability and Accountability Act and the Medicaid program." The act struck the reference to the state act and left HIPAA and Medicaid standing.

That last change is the clearest signal of legislative intent available in the primary record. Where Wyoming law once named a state hospital records act alongside HIPAA, it now names HIPAA alone.

Hospital Records Retention in Wyoming

Because no Wyoming statute governs hospital record retention, hospitals in the state work from the federal Medicare Conditions of Participation.

Medicare Conditions of Participation

Under 42 CFR 482.24, hospitals participating in Medicare must maintain a medical record for every individual evaluated or treated. The regulation requires that records be accurately written, promptly completed, properly filed and retained, and accessible.

The retention figure sits in 42 CFR 482.24(b), which requires that medical records be "retained in their original or legally reproduced form for a period of at least 5 years." Note what the provision does not say: it sets no "after discharge" trigger, unlike the skilled nursing facility rule discussed below. Because virtually all Wyoming hospitals participate in Medicare, this 5-year federal minimum is the working floor in the state.

The same section requires a coding and indexing system that permits timely retrieval by diagnosis and procedure, and it requires hospitals to protect record confidentiality and release information only to authorized individuals.

State Licensing Rules for Hospitals

Licensing sits alongside Medicare participation, and it is the one place a state retention period could still live after the repeal. It does not. The Department of Health's current hospital licensing rule, Healthcare Licensing and Surveys Chapter 12, effective March 1, 2023, contains no fixed retention period anywhere in its text.

What Section 23 of that rule does require is a health information system maintained "in accordance with accepted professional principles," records kept in accordance with HIPAA and 42 CFR Part 2, and, under Section 23(c), that records of public hospitals be preserved "either in the original form or by other permanent means, for a period of time determined by the hospital administrator, based upon the legally approved retention schedules for publically-funded hospitals established by the Wyoming State Archives and the State Records Committee."

So a public hospital in Wyoming does carry a real state-level retention duty. The period just comes from an archives schedule rather than from a statute or the licensing rule itself.

Practical Implications for Wyoming Hospitals

The federal 5-year minimum is a floor, not a target. Hospitals routinely retain records longer because the limitations periods for malpractice and contract claims can outrun it, and because a destroyed record cannot be produced in a proceeding that is already underway. Set the policy against the longest claim window that could realistically reach the record, not against the shortest regulation that mentions one.

Physician and Private Practice Records

Wyoming has no statute that tells physicians in private practice how long to keep patient records. The repealed act addressed hospitals, and nothing in current Wyoming law fills that space for clinics.

Wyoming Board of Medicine Rules

The Board of Medicine does regulate physician conduct around medical records. Under 052-3 Wyo. Code R. Section 3-4, physicians carry several obligations.

Physicians must respond to a patient's written request for records "within a reasonable period or no more than thirty days, whichever is shorter." The rule applies to every licensed physician in the state.

The rule also settles ownership: the physical record belongs to the physician or health care facility. A patient has a right to the information, not to the paper chart, microfilm or storage medium itself.

A physician may supply either an accurate, detailed, comprehensive summary or actual copies of the record, including x-rays and diagnostic records where requested. On fees, the rule lets a physician "establish reasonable charges" and bill "the actual costs incurred in responding to a patient's request," and it spells out what those costs may include: the cost of copies, clerical staff time, and the physician's time spent reviewing and summarizing the records. What the rule does not permit is a paywall: a patient "shall not be denied a summary or a copy of requested medical records because of inability to pay."

Violating a Board rule is itself a ground for discipline. Wyo. Stat. Ann. 33-26-402(a)(xxxi) lists "Violation of any board rule or regulation" among the grounds for action against a license, which is the enforcement hook behind the access duty.

Setting a Retention Policy Without a State Deadline

With no state period to satisfy, a Wyoming physician's retention policy is a risk decision. The relevant limitations periods are fixed by statute and give the policy its shape:

• Medical malpractice. Wyo. Stat. Ann. 1-3-107 sets a two-year period running from the date of the alleged act, error or omission, subject to the statute's own discovery extensions and, for minors, to the Kordus rule discussed below.
• Written contracts. Wyo. Stat. Ann. 1-3-105(a) allows ten years on a written contract.
• Oral contracts. The same subsection allows eight years on an oral contract.

A retention period keyed to the longest of those windows, rather than to the two-year malpractice period alone, is the conservative reading. Professional associations including AHIMA publish their own retention guidance, and providers should confirm the current recommendation directly with the association rather than rely on secondhand summaries, which circulate in outdated form.

Minor Patient Records in Wyoming

Wyoming has no statute addressing retention of minor patients' records specifically. The limitations rules are what extend the practical horizon, and they deserve a careful reading because the printed statute and the controlling case law point in different directions, and the case law wins.

The Limitations Picture for Minors

Wyo. Stat. Ann. 1-3-107 addresses minors in its own terms. The statute requires a claim on behalf of a minor to be brought "by his eighth birthday or within two (2) years of the date of the alleged act, error or omission, whichever period is greater."

That provision is no longer enforceable. In Kordus v. Montes, 2014 WY 146, 337 P.3d 1138, the Wyoming Supreme Court reviewed the dismissal of a minor's medical malpractice claim under that provision and reversed. The holding, at paragraph 30 of the opinion, is direct: "We therefore hold that the statute of limitations for minors, Wyo. Stat. Ann. 1-3-107(a)(ii), violates Article 1, Section 8 of the Wyoming Constitution." The same paragraph holds the health care exception in Wyo. Stat. Ann. 1-3-114 constitutionally infirm as well. The eighth-birthday language still appears in the printed statutes, but it cannot be applied to bar a minor's malpractice claim.

With that exception struck, the general tolling statute controls. Under Wyo. Stat. Ann. 1-3-114, a person who is a minor when the cause of action accrues "may bring the action within three (3) years after the disability is removed or within any other statutory period of limitation, whichever is greater." For a Wyoming provider, that means a minor patient's malpractice exposure runs at least until the patient turns 21.

Watch out: Do not build a records-destruction schedule on the eighth-birthday figure. It reads like operative law in the statute books, and it is not: Kordus struck it, and a chart destroyed on that timetable could be gone years before the real exposure ends. Key a minor's retention to the age of majority plus three years, with a margin on top. A destroyed record is unrecoverable; a few extra years of storage is not.

Retention Practice for Minors

The practical rule follows from Kordus: key retention to the patient reaching adulthood plus the three-year window in Wyo. Stat. Ann. 1-3-114, and treat age 21 as the floor rather than the ceiling. For a provider treating newborns and young children, that means planning storage in decades rather than years.

HIPAA Requirements in Wyoming

With the state act repealed, the Health Insurance Portability and Accountability Act carries more of the load in Wyoming than it does in states that kept their own health records statutes.

What HIPAA Does and Does Not Require

The most persistent misconception in this area is that HIPAA sets a medical record retention period. It does not. HIPAA contains no retention requirement for patient medical records and leaves the question to state law and to program rules such as the Medicare Conditions of Participation.

The six-year figure people remember comes from 45 CFR 164.530(j), and it covers documentation, not charts. Under 164.530(j)(2), a covered entity "must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later." Paragraph (j)(1) reaches privacy policies and procedures, required written communications, and written or electronic records of required actions, activities and designations.

The distinction matters in Wyoming more than elsewhere. A provider who reads the six-year rule as a chart-retention rule will keep charts for the wrong reason and may still miss the actual federal floors that apply to their facility type.

HIPAA Privacy Rule Protections

Under HIPAA, Wyoming patients may access their protected health information, request amendments, receive an accounting of disclosures, and request restrictions on certain uses. Those rights do not depend on provider type or practice setting.

HIPAA Security Rule Requirements

The Security Rule requires covered entities to implement administrative, physical and technical safeguards for electronic protected health information. That obligation covers every electronic record system a Wyoming provider operates, whether hospital, clinic or solo practice.

CMS and Medicare Requirements by Facility Type

Beyond the hospital rule in 42 CFR 482.24, CMS sets separate retention periods by facility and program type. These differ from one another in ways that are easy to blur, so each is quoted here.

Critical Access Hospitals

Wyoming has several Critical Access Hospitals serving rural communities. Under 42 CFR 485.638(c), the requirement is that "The records are retained for at least 6 years from date of last entry, and longer if required by State statute, or if the records may be needed in any pending proceeding."

That is the entire retention rule for CAHs. The section contains no separate provision for minors and no reference to age 18. A CAH in Wyoming applies the 6-year period to all patient records, extended where a pending proceeding makes the record relevant. The state-statute clause is triggered by a state statute, and Wyoming currently has none that sets a longer period. The hospital licensing rule does not fill the gap either: Chapter 12 states in its purpose section that it "does not apply to critical access hospitals." For a minor treated at a CAH, the Kordus limitations horizon discussed above is the reason to keep the chart well past the 6-year federal minimum.

Skilled Nursing Facilities

Skilled nursing facilities follow a tiered rule at 42 CFR 483.70(h)(4). Medical records must be retained for:

• "The period of time required by State law", or
• "Five years from the date of discharge when there is no requirement in State law", or
• "For a minor, 3 years after a resident reaches legal age under State law."

Wyoming's repeal removed the state-law period that the first tier would otherwise point to, so the five-year-from-discharge default is the operative figure for adult residents in Wyoming. The three-year figure is the minor-specific provision and runs from the resident reaching legal age, not from discharge. Applying the three-year number to adult residents understates the requirement by two years.

The state's nursing facility licensing chapters do not restore a state period. Neither the licensure rule (Healthcare Licensing and Surveys Chapter 19) nor the program administration rule (Aging Division Chapter 11) fixes a general retention period for resident records. The one hard number in those chapters attaches at closure: under Chapter 19, Section 5(j)(iii), a nursing care facility that voluntarily ceases operating must maintain personnel, financial and client medical records "for a minimum of six (6) years after the month of closure."

Medicare Advantage Organizations

Organizations contracting with CMS under Medicare Advantage carry a longer obligation. Under 42 CFR 422.504(d), the organization "agrees to maintain for 10 years books, records, documents, and other evidence of accounting procedures and practices" sufficient for CMS audit and oversight. This is a program-integrity requirement on the plan, distinct from the clinical record duties that fall on the treating facility.

Providers who bill Medicare must also retain documentation sufficient to support the medical necessity and appropriateness of billed services. For providers and suppliers who order, certify, refer or prescribe Part A or Part B services, items or drugs, and for those who furnish what was ordered, CMS states the period plainly in its Medicare Learning Network guidance on medical record maintenance and access requirements: "The regulation requires you to maintain medical records for 7 years from the date of service (DOS)." The regulation behind that sentence is 42 CFR 424.516(f). Program instructions are revised more often than regulations, so check the current MLN fact sheet when setting policy.

Medical Records Destruction in Wyoming

When a retention period expires, destruction is itself a regulated act under federal law.

HIPAA Destruction Standards

HIPAA requires covered entities to apply appropriate administrative, physical and technical safeguards when disposing of protected health information. Under HHS guidance on disposal of PHI, acceptable methods include:

• Paper records: shredding, burning, pulping or pulverizing, so that the information is rendered essentially unreadable, indecipherable and otherwise incapable of reconstruction
• Electronic records: clearing by overwriting, purging by degaussing or cryptographic erase, or physical destruction through disintegration, pulverization, melting, incineration or shredding

Providers must never place PHI in dumpsters, recycling bins or other receptacles reachable by the public or by unauthorized persons.

Business Associate Requirements

A Wyoming provider using an outside vendor for record storage or destruction needs a HIPAA-compliant Business Associate Agreement in place. The agreement must set out the vendor's obligations for handling, storing and destroying protected health information.

Documentation of Destruction

Keep a destruction log recording what was destroyed, the date, the method used, and who performed the destruction. That log is compliance documentation, which places it under the six-year rule in 45 CFR 164.530(j)(2) rather than under any chart-retention period.

Practice Closure and Records Transfer

Wyoming's repeal left little state-level direction on what happens to records when a practice closes, but the underlying duties do not disappear.

Continuing Obligations

The Board of Medicine's access rule at 052-3 Wyo. Code R. Section 3-4 governs patient requests for records, and closure does not extinguish a patient's right to obtain them. Requirements specific to closing, selling or relocating a practice are set by Board rule and are revised periodically, so confirm the current notification obligations directly with the Wyoming Board of Medicine rather than relying on a summary.

Practical Steps for Practice Closure

• Give written notice to active patients well before the closing date
• Publish notice in local media serving the patient population
• Notify the Wyoming Board of Medicine
• Arrange a custodian to hold records for the applicable retention period
• Put a HIPAA-compliant Business Associate Agreement in place with that custodian
• Transfer records by secure, HIPAA-compliant methods

Professional records custodian services handle long-term storage and patient access after a closure, which is generally more reliable than a former practitioner storing charts personally.

Why Wyoming Has No State Retention Deadline

Wyoming's position is the product of a deliberate 2019 decision rather than an oversight. The Legislature repealed the retention and disclosure provisions and did not replace them, keeping only the peer-review privilege it recreated in Wyo. Stat. 35-2-618.

The phrase to be careful with is the headline. "No state retention law" is not the same as "no retention obligation." What Wyoming removed was a second, state-level layer, not the federal floor beneath it, and every federal period in the table below still binds the facilities it covers.

Summary of Retention Requirements for Wyoming Providers