Medical Records FAQs

If you didn’t find the answer to your question, submit your own to the NCMS Solution Center.

Submit Your Question

How long should medical records be retained?

There is no statutory or regulatory requirement in NC that provides a definitive amount of time that records must be kept in physicians offices (unless the office is licensed in NC as an ambulatory surgical facility, in which case, records must be kept for a minimum of 20 years). The North Carolina Medical Board (NCMB), however, has issued some guidelines on medical record retention in the form of a position statement–see below. This and other position statements can be found on the NCMB’s website at:

Please note that medical considerations and continuity of care are the guiding principles for keeping records, although other factors are also important and should be considered as well.

Under HIPAA, records should be retained for a minimum of six years so that patients can obtain access to their records and for disclosure accounting purposes. This is defined under HIPAA as the “designated record set,” which includes the medical record itself, including records obtained from other providers (if used in medical decision making), and financial records, including Explanation of Benefits.

For Medicare and Medicaid investigations, records should be kept for seven years. Therefore, the minimum amount of time to keep records should be seven years from the last date of service.

In North Carolina, the statutes of limitation and repose for bringing a medical malpractice suit against a physician can vary depending on the age of the patient at the time the services were delivered and whether or not surgery was performed.

For patients who had surgery or any other procedure where a non-therapeutic foreign object could be left in the body, the minimum retention time would be 10 years from the last date of service. If the patient is/was a minor, the records should be kept for the applicable (7 or 10 years) minimum retention time or until the patient reaches 19 years of age, whichever is greater. Again, all these considerations should be extended if medical considerations and continuity of care warrant a greater retention period.

Before records are destroyed, some form of notice should be given. If letters to the last-known address of the patient are not feasible, a notice in local newspapers should suffice. In any event, be sure to check with your medical malpractice insurance carrier prior to making a final decision.

When the decision is made to destroy medical records, incineration or shredding are the preferred methods. Extra precautions must be taken to ensure that records are destroyed in such a manner that protected, confidential patient information cannot be found by others who do not have authorization to see the information contained in the records (don’t forget HIPAA).


Created: May 1, 1998 | Modified: May 2009 | Reviewed July 2013

Licensees have both a legal and ethical obligation to retain patient records. The Board, therefore, recognizes the necessity and importance of a licensee’s proper maintenance, retention, and disposition of medical records. The following guidelines are offered to assist licensees in meeting their ethical and legal obligations:

  • State and federal laws require that records be kept for a minimum length of time including but not limited to:
    • Medicare and Medicaid Investigations (up to 7 years);
    • HIPAA (up to 6 years);
    • Medical Malpractice (varies depending on the case but should be measured from the date of the last professional contact with the patient)—licensees should check with their medical malpractice insurer);
      North Carolina has no statute relating specifically to the retention of medical records;
    • Immunization records always must be kept.
  • In addition to existing state and federal laws, medical considerations may also provide the basis for deciding how long to retain medical records. Patients should be notified regarding how long the licensee will retain medical records.
  • In deciding whether to keep certain parts of the record, an appropriate criterion is whether a licensee would want the information if he or she were seeing the patient for the first time. The Board, therefore, recognizes that the retention policies of licensees giving one-time, brief episodic care may differ from those of licensees providing continuing care for patients.
  • In order to preserve confidentiality when discarding old records, all records should be destroyed, including both paper and electronic medical records.
  • Those licensees providing episodic care should attempt to provide a copy of the patient’s record to the patient, the patient’s primary care provider, or, if applicable, the referring licensee.
  • If it is feasible, patients should be given an opportunity to claim the records or have them sent to another licensee before old records are discarded.
  • The licensee should respond in a timely manner to requests from patients for copies of their medical records or to access to their medical records.
  • Licensees should notify patients of the amount, and under what circumstances, the licensee will charge for copies of a patient’s medical record, keeping in mind that N.C. Gen. Stat. 90-411 provides limits on the fee a licensee can charge for copying of medical records.

1 Licensees should retain medical records as long as needed not only to serve and protect patients, but also to protect themselves against adverse actions. The times stated may fall below the community standard for retention in their communities and practice settings and for the specific needs. Licensees are encouraged (may want to) seek advice from private counsel and/or their malpractice insurance carrier.

How much can I charge for medical records?

Unless there is a personal injury, social security disability, or workers’ compensation claim, physicians may charge a reasonable fee for copying records. See the NC Medical Board’s position statement on access to medical records below.

For personal injury and social security disability claims (N.C. Gen. Stat. 90-411), the following maximum per page schedule applies:

Pages 1-25: 75 cents per page;

Pages 26-100: 50 cents per page;

Pages over 100: 25 cents per page.

Please note that even under this schedule, a minimum charge of $10.00 may be imposed.

If the physician wants to assert a lien for medical services and supplies in a personal injury case, then the physician must provide without charge, if requested by the “attorney representing the person in whose behalf the claim for personal injury is made, an itemized statement, hospital record, or medical report for the use of the attorney in the negotiation, settlement, or trial of the claim arising by reason of the personal injury…” (NC Gen. Stat. 44-49(b)).

For workers’ compensation claims, pursuant to N.C. Gen. Stat. 97-26.1, the NC Industrial Commission (see January 12, 1995 Minutes of the NC Industrial Commission) has adopted the following maximum schedule for costs incurred in searching, handling, copying, and mailing medical records:

Pages 1-40: 50 cents per page;

Pages over 40: 20 cents per page.

A minimum charge of $10.00 may be imposed.

Created: Nov 1, 1993 | Modified: May 1996, September 1997, March 2002, August 2003, September 2010


A licensee’s policies and practices relating to medical records under his or her control should be designed to benefit the health and welfare of patients, whether current or past, and should facilitate the transfer of clear and reliable information about a patient’s care. Such policies and practices should conform to applicable federal and state laws governing health information.

It is the position of the North Carolina Medical Board that notes made by a licensee in the course of diagnosing and treating patients are primarily for the licensee’s use and to promote continuity of care. Patients, however, have a substantial right of access to their medical records and a qualified right to amend their records pursuant to the HIPAA privacy regulations.

Medical records are confidential documents and should only be released when permitted by law or with proper written authorization of the patient. Licensees are responsible for safeguarding and protecting the medical record and for providing adequate security measures.

Each licensee has a duty on the request of a patient or the patient’s representative to release a copy of the record in a timely manner to the patient or the patient’s representative, unless the licensee believes that such release would endanger the patient’s life or cause harm to another person. This includes medical records received from other licensee offices or health care facilities. A summary may be provided in lieu of providing access to or copies of medical records only if the patient agrees in advance to such a summary and to any fees imposed for its production.

Licensees may charge a reasonable fee for the preparation and/or the photocopying of medical and other records. To assist in avoiding misunderstandings, and for a reasonable fee, the licensee should be willing to review the medical records with the patient at the patient’s request. Medical records should not be withheld because an account is overdue or a bill is owed (including charges for copies or summaries of medical records).

Should it be the licensee’s policy to complete insurance or other forms for established patients, it is the position of the Board that the licensee should complete those forms in a timely manner. If a form is simple, the licensee should perform this task for no fee. If a form is complex, the licensee may charge a reasonable fee.

To prevent misunderstandings, the licensee’s policies about providing copies or summaries of medical records and about completing forms should be made available in writing to patients when the licensee-patient relationship begins.

Licensees should not relinquish control over their patients’ medical records to third parties unless there is an enforceable agreement that includes adequate provisions to protect patient confidentiality and to ensure access to those records.

When responding to subpoenas for medical records, unless there is a court or administrative order, licensees should follow the applicable federal regulations.

What are the State regulations with regard to Electronic Medical Records?

§ 90-412. Electronic medical records.
(a) Notwithstanding any other provision of law, any health care provider or facility licensed, certified, or registered under the laws of this State or any unit of State or local government may create and maintain medical records in an electronic format. The health care provider, facility, or governmental unit shall not be required to maintain a separate paper copy of the electronic medical record. A health care provider, facility, or governmental unit shall maintain electronic medical records in a legible and retrievable form, including adequate data backup.
(b) Notwithstanding any other provision of law, any health care provider or facility licensed, certified, or registered under the laws of this State or any unit of State or local government may permit authorized individuals to authenticate orders and other medical record entries by written signature, or by electronic or digital signature in lieu of a signature in ink. Medical record entries shall be authenticated by the individual who made or authorized the entry. For purposes of this section, “authentication” means identification of the author of an entry by that author and confirmation that the contents of the entry are what the author intended.
(c) The legal rights and responsibilities of patients, health care providers, facilities, and governmental units shall apply to records created or maintained in electronic form to the same extent as those rights and responsibilities apply to medical records embodied in paper or other
media. This subsection applies with respect to the security, confidentiality, accuracy, integrity,
access to, and disclosure of medical records. (1999-247, s. 2; 2007-248, s. 3.)

How do I handle departures from or openings/closings of my medical practice with regard to medical records?

This issue is addressed by the North Carolina Medical Board in a position statement.


Created: Jan 1, 2000 | Modified: August 2003, July 2009 |


Departures from or closings of medical practices are trying times. If mishandled, they can significantly disrupt continuity of care and endanger patients.

Provide Continuity of Care
Practitioners continue to have obligations toward their patients during and after the departure from or closing of a medical practice. Practitioners may not abandon a patient or abruptly withdraw from the care of a patient. Patients should therefore be given reasonable advance notice (at least 30 days) to allow other medical care to be secured. Good continuity of care includes preserving and providing appropriate access to medical records.* Also, good continuity of care may often include making appropriate referrals. The practitioner(s) and other parties that may be involved should ensure that the requirements for continuity of care are effectively addressed.

It is the position of the North Carolina Medical Board that during such times practitioners and other parties that may be involved in such processes must consider how their actions affect patients. In particular, practitioners and other parties that may be involved have the following obligations.

Permit Patient Choice
It is the patient’s decision from whom to receive care. Therefore, it is the responsibility of all practitioners and other parties that may be involved to ensure that:

  • Patients are notified in a timely fashion of changes in the practice and given the opportunity to seek other medical care, sufficiently far in advance (at least 30 days) to allow other medical care to be secured, which is often done by newspaper advertisement and by letters to patients currently under care;
  • Patients clearly understand that they have a choice of health care providers;
  • Patients are told how to reach any practitioner(s) remaining in practice, and when specifically requested, are told how to contact departing practitioners; and
  • Patients are told how to obtain copies of or transfer their medical records.

No practitioner, group of practitioners, or other parties involved should interfere with the fulfillment of these obligations, nor should practitioners put themselves in a position where they cannot be assured these obligations can be met.

Written Policies
The Board recommends that practitioners and practices prepare written policies regarding the secure storage, transfer and retrieval of patient medical records. Practitioners and practices should notify patients of these policies. At a minimum, the Board recommends that such written policies specify:

  • A procedure and timeline that describes how the practitioner or practice will notify each patient when appropriate about (1) a pending practice closure or practitioner departure, (2) how medical records are to be accessed, and (3) how future notices of the location of the practice’s medical records will be provided;
  • How long medical records will be retained;
  • The procedure by which the practitioner or practice will dispose of unclaimed medical records after a specified period of time;
  • How the practitioner or practice shall timely respond to requests from patients for copies of their medical records or to access to their medical records; In the event of the practitioner’s death or incapacity, how the deceased practitioner’s executor, administrator, personal representative or survivor will notify patients of the location of their medical records and how patients can access those records; and
  • The procedure by which the deceased or incapacitated practitioner’s executor, administrator, personal representative or survivor will dispose of unclaimed medical records after a specified period of time.

The Board further expects that its licensees comply with any applicable state and/or federal law or regulation pertaining to a patient’s protected healthcare information.

*NOTE: The Board’s Position Statement on the Retention of Medical Records applies, even when practices close permanently due to the retirement or death of the practitioner.


Information obtained through this website is not to be construed as professional advice, legal or otherwise, from NCMS.

Print Friendly, PDF & Email