Alabama Medical Records Retention Laws (2026 Guide)

Alabama hospitals must retain adult medical records for at least five years from discharge, and physicians must keep records for at least seven years from their last patient contact. For minors, both providers extend retention past age 19. These timelines are set by Ala. Admin. Code r. 420-5-7-.13 and r. 540-X-9-.10.

Overview of Alabama Medical Records Retention Laws

Alabama regulates how long healthcare providers must keep patient medical records through a combination of state administrative rules and federal requirements. The primary state authorities are the Alabama Department of Public Health (ADPH), which oversees hospital standards, and the Alabama Board of Medical Examiners (ABME), which regulates physicians and physician assistants.

Understanding these retention periods matters for patients seeking access to their records, healthcare providers ensuring compliance, and attorneys involved in medical malpractice or personal injury cases. Alabama sets different retention timelines depending on the type of provider, the age of the patient, and the category of records involved.

In 2022, the ABME and the Medical Licensure Commission replaced their older guidelines with formal administrative rules, establishing clearer and more specific retention timeframes for physician practices. These rules now carry the force of law and apply to all licensed physicians in the state.

Hospital Medical Records Retention (Ala. Admin. Code r. 420-5-7-.13)

Alabama hospitals must follow the retention requirements set by the Alabama Department of Public Health under Ala. Admin. Code r. 420-5-7-.13. This rule establishes the baseline standards for hospital medical record services.

Adult Patient Records

Hospitals must retain medical records in their original or legally reproduced form for a minimum of five years from the date of discharge or last treatment. This applies to both inpatient and outpatient records.

Records must be accurately written, promptly completed, properly filed, and accessible throughout the retention period. The hospital must maintain a system of coding and indexing that allows timely retrieval by diagnosis and procedure.

Minor Patient Records

For patients who are minors at the time of treatment, hospitals must retain records for at least five years after the patient reaches the age of majority. Because Alabama sets the age of majority at 19 (not 18, as in most states), this means a hospital could be required to keep records for a child born today for up to 24 years in some cases.

For example, if a child receives hospital treatment at age 1, the hospital must retain those records until the child turns 24 (age 19 plus five years).

Confidentiality and Access

Hospitals must have procedures in place to prevent unauthorized access to or alteration of medical records. Information may only be released to authorized individuals. Original medical records may only be removed from the hospital in accordance with federal or state law, court orders, or subpoenas.

Cessation of Operations

If a hospital ceases operations, it must maintain a plan for transferring medical records to another healthcare facility to ensure continuity of access for patients and authorized parties.

Physician Medical Records Retention (Ala. Admin. Code r. 540-X-9-.10)

The Alabama Board of Medical Examiners and the Medical Licensure Commission jointly regulate physician records management under Ala. Admin. Code r. 540-X-9-.10. These rules, formally adopted in 2022, replaced earlier guidelines and now set binding minimum retention periods.

Standard Retention Period

Physicians must retain all medical records for a minimum of seven years from the date of the physician's (or other provider's within the practice) last professional contact with the patient. This seven-year period is longer than the hospital minimum and reflects the ABME's recognition that physician-patient relationships often span decades.

Records must be maintained in their original or legally reproduced form. This includes paper records, electronic health records (EHR), and hybrid formats, as long as they remain legible and retrievable throughout the retention period.

Minor Patient Records

For patients who are minors, physicians must retain records for the longer of:

• Seven years from the date of the physician's last professional contact with the patient, OR
• Two years after the minor reaches the age of majority (age 19 in Alabama)

Which branch controls depends on the patient's age at treatment. For minors treated before about age 14, the two-years-past-majority provision is the longer period and controls, since it can extend retention past the patient's 21st birthday. The seven-year rule mainly controls for minors treated in their teens, closer to their 18th or 19th birthday.

Immunization Records

Immunization records that have not been transmitted to the Alabama Department of Public Health Immunization Registry follow the same retention formula as other minor patient records, not a separate schedule. These must be kept for the longer of:

• Seven years from the date of the physician's last professional contact with the patient, OR
• Two years after a minor patient reaches the age of majority

Imaging and Diagnostic Records

Alabama sets separate retention periods for imaging:

If no separate written report exists for an imaging study, the original image must be retained for the full standard retention period of seven years.

Records of Disputed Services

Alabama law prohibits the destruction of any medical record involving services that are the subject of an active dispute. If a physician has received formal notice of a dispute (such as a malpractice claim, insurance disagreement, or complaint to a licensing board) before the normal retention period expires, the records must be preserved until the dispute is fully resolved, regardless of how long that takes.

HIPAA and Federal Requirements

HIPAA Privacy Rule

The HIPAA Privacy Rule does not set specific medical record retention periods. The U.S. Department of Health and Human Services has confirmed that state laws generally govern how long medical records must be retained.

However, HIPAA does require that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information (PHI) for the entire time the information is maintained, including during the disposal process.

HIPAA also requires that covered entities retain certain compliance documentation for at least six years. This includes privacy policies, notices of privacy practices, complaint dispositions, and other required documentation. This six-year requirement applies to the compliance paperwork, not to patient medical records themselves.

CMS Conditions of Participation (42 CFR 482.24)

For hospitals that participate in Medicare and Medicaid, the Centers for Medicare and Medicaid Services (CMS) imposes additional requirements through the Conditions of Participation. Under 42 CFR 482.24, participating hospitals must retain medical records in their original or legally reproduced form for a minimum of five years.

This federal five-year minimum aligns with Alabama's state hospital requirement. However, because physicians in Alabama must retain records for seven years under state law, physician practices participating in Medicare should follow the longer state standard.

42 CFR Part 2: Substance Use Disorder Records

Records related to substance use disorder (SUD) treatment at federally assisted programs receive additional protections under 42 CFR Part 2. These records carry strict confidentiality protections that go beyond standard HIPAA requirements. Disclosure generally requires specific written patient consent, a court order, or one of a few narrow exceptions.

A 2024 final rule updated Part 2 as required by the CARES Act, with compliance required by February 2026. Enforcement authority was delegated to the HHS Office for Civil Rights in August 2025.

Mental Health Records in Alabama

Alabama does not impose a separate, longer retention period specifically for mental health records. The same retention timelines that apply to general medical records also apply to psychiatric and psychological treatment records.

However, mental health records carry additional confidentiality protections under Alabama law. The Mental Health Consumers' Rights Act (Code of Alabama, Title 22, Chapter 56) guarantees mental health consumers the right to confidentiality of all information in their mental health, medical, and financial records.

Alabama recognizes several professional privileges that restrict disclosure of mental health communications, including psychologist-patient privilege, psychiatrist-patient privilege, counselor-patient privilege, social worker privilege, and Department of Mental Health privilege. Providers should not routinely forward psychological, psychiatric, or substance abuse treatment records without explicit patient authorization.

Access restrictions also apply. While patients generally have the right to access their own records, a clinical determination by professional staff that access would be detrimental to the patient's health can limit that right in certain circumstances.

Patient Access Rights and Copy Fees

Alabama patients have the right to obtain copies of their medical records. Under Alabama Code Section 12-21-6.1, the maximum fees a provider may charge for copies are:

Under HIPAA, when a patient requests access to their own records (as opposed to requesting a transfer to a third party), the provider must waive the search fee. The provider may only charge a reasonable, cost-based fee for copying.

Providers must respond to records requests within a reasonable timeframe. HIPAA requires that covered entities act on access requests within 30 days, with one 30-day extension permitted if the entity provides written notice of the delay.

Records Destruction Rules

Alabama law permits the destruction of medical records once the applicable retention period has passed, provided no dispute involving those records is pending. The rules establish specific requirements for how destruction must occur.

Approved Destruction Methods

Records may be destroyed by:

• Burning
• Shredding
• Permanent electronic deletion
• Other methods consistent with the confidential nature of the records

All destruction must comply with state and federal privacy requirements, including HIPAA's disposal standards.

Destruction Log Requirement

When medical records are destroyed, the physician or practice must record the time, date, and circumstances of the destruction. This destruction log must be maintained for a minimum of four years. The log does not need to list individual patient records but must be detailed enough to identify which group of destroyed records contained a particular patient's file.

Practice Closure and Physician Departure

Alabama's rules address several scenarios that require patient notification and records transfer.

Physician Retirement

A solo practitioner or group practice must notify all active patients at least 30 days before the physician's retirement date. Active patients are defined as those treated one or more times during the preceding 36 months.

Notification must be sent by U.S. Mail or through a HIPAA-compliant electronic health record portal and must include:

• The name of the physician who treated the patient
• The reason for the notification
• Instructions for how the patient can obtain their records
• A HIPAA-compliant authorization form for records transfer
• How long the records will remain available
• What will happen to records if the patient does not respond

Physician Death

When a physician dies, the personal representative of the estate or the practice must notify active patients within 30 days. Records must be transferred to another physician or a HIPAA-compliant custodian who can maintain them for the remainder of the required retention period.

License Suspension or Revocation

If a physician's license is suspended or revoked, the physician must notify patients within 30 days and bears all costs of the notification. Records must be transferred to a qualified custodian or another physician.

Departure from a Group Practice

When a physician leaves a group practice, the employment contract generally determines notification responsibilities. Regardless of contract terms, the departing physician cannot be denied access to patient records, and patients must be informed of their options for records transfer.

Practice Sale

When a medical practice is sold, the buyer must notify patients within 30 days that their records have transferred to the new provider. Patients must be given the option to authorize transfer of their records elsewhere.

Other Facility Types

Alabama sets different retention periods for other types of healthcare facilities:

Recent Changes to Alabama Law

2022 Rules Update

The most significant recent change occurred in 2022 when the Alabama Board of Medical Examiners and Medical Licensure Commission converted their previous medical records management guidelines into formal administrative rules. The key changes included:

• Establishing a specific seven-year minimum retention period (replacing the previous vague standard of retaining records "as long as necessary")
• Defining "active patients" as those treated within the preceding 36 months
• Setting a quantified 30-day notification period (replacing "reasonable notice")
• Adding detailed destruction protocols and log requirements
• Addressing specific practice departure scenarios (death, retirement, license action, group practice departure, and practice sale)

2025 Age of Medical Consent Change

In 2025, Alabama raised the age of medical consent from 14 to 16, effective October 1, 2025. This change also granted parents and guardians expanded rights to access a minor's medical information upon request, until the minor reaches age 19, unless the provider suspects abuse or neglect, a court order prohibits disclosure, law enforcement is investigating the parent or guardian, or federal substance use disorder confidentiality rules apply.

More Alabama Laws

• Alabama Medical Recording Laws
• Alabama Data Privacy Laws
• Alabama Whistleblower Laws

Frequently Asked Questions

How long do Alabama hospitals have to keep medical records?

Alabama hospitals must retain adult patient medical records for a minimum of five years from the date of discharge or last treatment, per Ala. Admin. Code r. 420-5-7-.13. For minor patients, hospitals must keep records for at least five years after the patient reaches the age of majority, which is 19 in Alabama. This means records for a child treated at birth could be retained for up to 24 years.

How long must Alabama physicians keep patient records?

Alabama physicians must retain medical records for at least seven years from the date of their last professional contact with the patient, under Ala. Admin. Code r. 540-X-9-.10. For minor patients, records must be kept for the longer of seven years from last contact or two years after the patient reaches age 19. Immunization records not sent to the state registry follow the same formula as other minor patient records: seven years from last contact or two years past age of majority, whichever is longer.

What are the rules for destroying medical records in Alabama?

Alabama allows medical records to be destroyed by burning, shredding, permanent electronic deletion, or other methods that protect confidentiality. Providers must maintain a destruction log recording the time, date, and circumstances of the destruction for at least four years. Records involved in any pending dispute cannot be destroyed until the dispute is resolved, regardless of the normal retention period.

What must an Alabama physician do when closing or selling a practice?

A physician must notify all active patients (those treated within the prior 36 months) at least 30 days before retirement or practice closure. The notification must be sent by U.S. Mail or HIPAA-compliant electronic portal and must include a records transfer authorization form and instructions for obtaining records. If a physician dies, the estate representative must notify patients within 30 days and transfer records to a qualified custodian.

Does HIPAA set a retention period for medical records in Alabama?

No. The HIPAA Privacy Rule does not establish minimum retention periods for medical records. The U.S. Department of Health and Human Services has confirmed that state laws govern how long records must be kept. However, HIPAA does require that covered entities retain compliance documentation (such as privacy policies and complaint records) for at least six years, and it requires appropriate safeguards to protect patient information for as long as it is maintained.