Alaska Medical Records Retention Laws (2026 Guide)

Alaska hospitals must retain patient medical records for seven years after discharge under AS 18.20.085. Physician practices are covered instead by 12 AAC 40.967(10), which requires patient records to be kept for at least seven years from the date of the last entry. Records for patients under age 19 must be kept until at least two years after the patient turns 19 or seven years after discharge, whichever is longer. HIPAA sets no separate retention period; Alaska state law governs.

Overview of Alaska Medical Records Retention Laws

Last verified: March 2026. This page reflects current Alaska Statutes Title 18, Chapter 20, Section 085 and related state and federal regulations.

Table of Contents

• Overview of Alaska Medical Records Retention Laws
• Hospital Records Retention Under AS 18.20.085
• Retention by Physicians and Non-Hospital Providers
• Retention Rules for Minors
• X-Ray and Imaging Records
• Federal Requirements That Apply in Alaska
• HIPAA and Alaska Medical Records
• Patient Access Rights Under AS 18.23.005
• Proper Destruction of Medical Records
• Practice Closure and Record Transfer
• Statute of Limitations Considerations
• Frequently Asked Questions
• Sources and References

Alaska law establishes specific rules for how long hospitals and healthcare facilities must keep patient medical records. The primary statute governing this area is Alaska Statute 18.20.085, which sets a baseline retention period of seven years following patient discharge.

These rules protect patients by making sure their health information remains available for ongoing care, legal proceedings, and insurance purposes. They also protect healthcare providers by giving them clear guidance on their recordkeeping obligations.

Understanding these retention laws matters whether you are a healthcare provider managing compliance, a patient trying to access your own records, or an administrator overseeing records storage and destruction.

Hospital Records Retention Under AS 18.20.085

Alaska Statute 18.20.085 is the cornerstone of medical records retention law in the state. The statute requires that, unless the Alaska Department of Health specifies otherwise, a hospital must retain and preserve records that relate directly to the care and treatment of a patient for a period of seven years following the discharge of the patient.

For hospitals, this seven-year period begins on the date of discharge, not the date of the last entry in the medical record. A different trigger applies to physician practices, which are governed by regulation rather than by this statute; see the next section. The requirement applies to all records that relate directly to patient care and treatment, including:

• Admission and discharge summaries
• Physician orders and progress notes
• Nursing notes and assessments
• Laboratory and diagnostic test results
• Medication administration records
• Surgical and procedural reports
• Consultation reports
• Consent forms

The statute grants the Alaska Department of Health the authority to modify these requirements. If the department issues specific regulations that differ from the seven-year baseline, those regulations take precedence.

AS 18.20.085(e) limits the section to facilities defined as hospitals under AS 18.20.130 and AS 18.20.210, so by its own terms it does not reach a physician's private office or clinic.

Electronic Preservation Under AS 18.23.100

AS 18.20.085(d) makes the entire hospital retention section subject to AS 18.23.100. That section allows a health care provider to maintain and preserve its medical records in an electronic format that protects the physical security of the records and protects them from access by unauthorized persons, and it states that a provider who does so is not required to maintain a separate paper copy.

In other words, the retention obligation is about preserving the record, not the paper. The Department of Health may adopt regulations under the Administrative Procedure Act (AS 44.62) to govern how this section is implemented.

Retention by Physicians and Non-Hospital Providers

AS 18.20.085 is a hospital statute, so the seven-years-after-discharge rule does not answer how long a physician's office must keep its charts. Physicians and other licensees under AS 08.64 are covered instead by the Alaska State Medical Board's unprofessional conduct regulation.

12 AAC 40.967(10) makes it unprofessional conduct to falsify, intentionally make an incorrect entry in, destroy, or fail to maintain patient or facility medical records for at least seven years from the date of the last entry.

Two differences matter in practice:

• The trigger is different. A hospital counts seven years from the patient's discharge. A physician practice counts seven years from the date of the last entry in the record, so a chart that is still being updated has not started its retention clock.
• The enforcement route is different. The physician rule is enforced as a disciplinary matter against the individual license, alongside the 30-day records-copy duty in 12 AAC 40.967(11) and the duty in 12 AAC 40.967(9) to prepare and maintain accurate, complete, and legible records.

A practice that is unsure which rule reaches a given record should retain to the later of the two dates.

Retention Rules for Minors

Alaska law provides extended protection for the medical records of younger patients. Under AS 18.20.085, the records of a patient under 19 years of age must be kept until at least two years after the patient reaches age 19, or until seven years following discharge, whichever period is longer.

This provision ensures that minors have access to their complete medical history after they reach adulthood.

Here is how the calculation works in practice:

• A child discharged at age 5 would have records retained until age 21 (two years past age 19), because that is longer than the standard seven-year window (which would end at age 12).
• A teenager discharged at age 17 would have records retained until age 24 (seven years post-discharge), because that is longer than the two-years-past-19 window (which would end at age 21).
• A patient discharged at age 13 would have records retained until age 21 (two years past age 19), since that deadline falls later than seven years after discharge (age 20).

The key principle is always to apply whichever calculation produces the longer retention period. Healthcare facilities should build these calculations into their records management systems to avoid premature destruction of pediatric records.

X-Ray and Imaging Records

Alaska law treats diagnostic imaging records differently from other medical records. Under AS 18.20.085, records consisting of X-ray film must be retained for a minimum of five years.

This shorter retention period reflects the physical storage challenges that X-ray films present, particularly their size and the specialized conditions required for proper preservation.

It is important to note that while original X-ray films may be disposed of after five years, any written reports or interpretations of those images that are part of the patient medical record are still subject to the standard seven-year retention requirement.

Modern digital imaging systems, including those using the DICOM standard, have reduced the storage burden significantly. Many Alaska hospitals now retain digital images for the full seven-year period alongside other medical records, even though the statute only requires five years for X-ray film specifically. AS 18.23.100 expressly permits secure electronic preservation without a separate paper or film copy.

Federal Requirements That Apply in Alaska

Alaska healthcare providers must comply with federal records retention requirements in addition to state law. Several federal rules create overlapping obligations.

CMS Conditions of Participation

Hospitals that participate in Medicare must follow the Conditions of Participation outlined in 42 CFR 482.24. This regulation requires hospitals to maintain medical records in their original or legally reproduced form for a period of at least five years.

Since Alaska state law requires seven years of retention, the state requirement is more restrictive and takes precedence in practice. Alaska hospitals already exceed the federal minimum by complying with state law.

Medicare Documentation Requirements

For providers who bill Medicare, CMS requires that medical records supporting claims be retained for seven years from the date of service. This aligns with Alaska state law, but providers should note that the Medicare requirement is measured from the date of service rather than the date of discharge.

For patients with extended hospital stays, the Medicare and state retention periods could end at different times. Providers should always retain records for whichever period ends later.

False Claims Act Considerations

The federal False Claims Act has a statute of limitations of up to 10 years for certain fraud claims. Healthcare organizations that participate in federal programs should consider retaining billing-related documentation beyond the minimum state requirement to protect against potential audits or investigations.

HIPAA and Alaska Medical Records

A common misconception is that HIPAA establishes a minimum retention period for medical records. It does not. The U.S. Department of Health and Human Services has confirmed that the HIPAA Privacy Rule does not include medical record retention requirements. State laws govern how long medical records must be retained.

However, HIPAA does impose two important requirements that affect Alaska healthcare providers:

HIPAA Administrative Documentation

Under 45 CFR 164.530, covered entities must retain HIPAA compliance documentation for six years from the date of creation or the date it was last in effect, whichever is later. This includes privacy policies, notices of privacy practices, complaint records, and related documentation. This is separate from the medical records themselves.

HIPAA Security During Retention

HIPAA requires covered entities to implement administrative, technical, and physical safeguards to protect the privacy of protected health information (PHI) for as long as the information is maintained. This means Alaska providers must keep medical records secure throughout the entire seven-year retention period and beyond, until the records are properly destroyed.

Patient Access Rights Under AS 18.23.005

Alaska patients have strong rights to access their own medical records. Under Alaska Statute 18.23.005, a patient is entitled to inspect and copy any records developed or maintained by a health care provider concerning the patient's own health care, notwithstanding the confidentiality protections that Chapter 18.23 otherwise gives to peer-review and quality-assurance records. The federal HIPAA Privacy Rule (45 CFR 164.524) separately requires the provider to act on a written access request within 30 days of receipt, extendable once by up to 30 more days with written notice, and to provide the records or a copy.

30-Day Response Requirement

Alaska takes the right to access medical records seriously. Under 12 AAC 40.967, the Alaska State Medical Board defines it as unprofessional conduct for a physician to fail to provide copies of complete patient records within 30 days of receiving a written request from the patient or their guardian.

This means physicians who delay or refuse records requests can face disciplinary action from the Medical Board, including potential sanctions against their medical license.

Limited Exceptions

There is a narrow exception to the patient access rule. Under the federal HIPAA Privacy Rule (45 CFR 164.524(a)(3)), if a licensed health care professional determines, in the exercise of professional judgment, that access is reasonably likely to endanger the life or physical safety of the patient or another person, the provider may deny access to that specific information. The patient then has the right under 45 CFR 164.524(a)(4) to have the denial reviewed by another licensed health care professional designated by the covered entity, who did not participate in the original decision.

Right to Request Amendments

Under the federal HIPAA Privacy Rule (45 CFR 164.526), a patient may request that a covered entity amend health information about them in a designated record set. The provider must act on the request within 60 days, extendable once by up to 30 more days with written notice, and either make the amendment or provide the patient with a written denial explaining why the amendment was refused.

Proper Destruction of Medical Records

Once the retention period has expired, healthcare providers may destroy medical records. However, both state and federal rules govern how that destruction must happen.

HIPAA Destruction Requirements

The HHS Office for Civil Rights requires that covered entities implement reasonable safeguards when disposing of protected health information. Acceptable methods include:

For paper records:

• Cross-cut shredding
• Burning
• Pulping or pulverizing
• Any method that renders the information unreadable and impossible to reconstruct

For electronic records:

• Clearing (overwriting with non-sensitive data using certified software)
• Purging (degaussing or exposing media to a strong magnetic field)
• Physical destruction (disintegration, pulverization, melting, incinerating, or shredding of the media)

Documentation of Destruction

Providers should maintain a destruction log that records what was destroyed, the date of destruction, the method used, and the name of the person who performed or supervised the destruction. While Alaska does not have a specific statute requiring a destruction log, maintaining one is a widely recommended best practice that protects providers in the event of an audit or legal dispute.

Third-Party Destruction Services

If a healthcare organization uses a third-party vendor for records destruction, HIPAA requires a Business Associate Agreement (BAA) with that vendor. The vendor must comply with all applicable HIPAA safeguards, and the provider should obtain a certificate of destruction as documentation.

Practice Closure and Record Transfer

When a physician retires, dies, or closes a practice in Alaska, specific rules govern what happens to patient records.

Medical Board Notification

The Alaska State Medical Board requires that within 30 days of retiring or closing a practice, a licensee must notify the board of the location of patient medical records. This notification can be submitted by email to the board.

Patient Notification

When a physician retires or a practice closes, patients must be notified and encouraged to find a new provider. Patients should also be informed that, upon their authorization, records will be transferred to their new provider.

Best practices for patient notification include:

• Sending written notice to all active patients well in advance of the closure date
• Publishing a notice in local newspapers
• Posting a notice at the practice location
• Including in the notice: the closure date, how to request records, where records will be stored, how long records will remain accessible, and contact information for future requests

Continued Retention Obligations

Closing a practice does not eliminate the obligation to retain records for the full statutory period. If a physician retires and has patient records from the previous three years, those records must still be maintained for the remaining duration of the seven-year retention period. The physician may transfer custody to another provider, a medical records custodian service, or a secure storage facility.

Statute of Limitations Considerations

Healthcare providers should consider Alaska's medical malpractice statute of limitations when deciding how long to retain records beyond the minimum required period.

Under AS 09.10.070, the statute of limitations for medical malpractice claims in Alaska is two years from the date the claim accrues. A claim accrues when the patient discovers, or reasonably should have discovered, the injury.

Alaska also has a statute of repose under AS 09.10.055(a)(2), which generally bars an action for personal injury, death, or property damage brought more than 10 years after the last act alleged to have caused it, regardless of when the injury was discovered.

That outer limit is not absolute. AS 09.10.055(b) lists circumstances in which the section does not apply at all, including where the injury resulted from an intentional act or gross negligence, fraud or misrepresentation, breach of an express warranty or guarantee, a defective product, or breach of trust or fiduciary duty, and where the facts that would give notice of a potential cause of action are intentionally concealed. AS 09.10.055(c) separately tolls the 10-year limit for any period in which an undiscovered foreign body with no therapeutic or diagnostic purpose remains in the patient's body and the claim is based on its presence. Several of those exceptions are squarely in play in malpractice disputes.

For a patient who was a minor when the claim accrued, AS 09.10.140(a) provides that the time of the disability of minority is not part of the time limit, but that the period within which the action may be brought is not extended more than two years after the disability ceases. In practice, that means a claim for a childhood injury generally must be brought within two years after the patient turns 18, not later. A separate rule in AS 09.10.140(c) applies to a personal injury suffered before the patient's eighth birthday: the time before that eighth birthday does not count toward the two-year limit in AS 09.10.070(a).

Because medical records are often the primary evidence in malpractice litigation, many healthcare attorneys recommend retaining records for at least 10 years to align with the statute of repose, and longer where one of the AS 09.10.055(b) exceptions could apply. This provides protection even in cases where the discovery rule delays the start of the limitations period.

Frequently Asked Questions

How long must Alaska hospitals keep medical records?

Alaska hospitals must retain patient medical records for seven years following discharge under AS 18.20.085. Records of patients under age 19 must be kept until at least two years after the patient turns 19, or seven years after discharge, whichever is longer. X-ray films have a separate five-year retention requirement.

How long must a physician's office in Alaska keep patient records?

AS 18.20.085 applies only to hospitals, so a physician practice follows a different rule. Under 12 AAC 40.967(10), it is unprofessional conduct for a licensee under AS 08.64 to fail to maintain patient or facility medical records for at least seven years from the date of the last entry. The trigger is the last entry in the record, not a discharge date.

Does HIPAA require a minimum retention period for medical records in Alaska?

No. The HIPAA Privacy Rule does not include any medical record retention requirements. The U.S. Department of Health and Human Services has confirmed that state laws, not HIPAA, govern how long medical records must be retained. HIPAA does require that records be kept secure for as long as they are maintained and that they be properly destroyed when disposed of.

How can I get a copy of my medical records in Alaska?

Under AS 18.23.005, you have the right to inspect and copy your medical records. The federal HIPAA Privacy Rule (45 CFR 164.524(b)) requires the provider to act on a written access request within 30 days of receipt, extendable once by up to 30 more days with written notice. Under Alaska regulation 12 AAC 40.967, a physician who fails to provide copies within 30 days of a written request can be charged with unprofessional conduct by the State Medical Board.

Can Alaska providers keep medical records only in electronic form?

Yes. Under AS 18.23.100, a health care provider may maintain and preserve medical records in an electronic format that protects their physical security and protects them from access by unauthorized persons, and a provider who does so is not required to keep a separate paper copy. AS 18.20.085(d) makes the hospital retention rule subject to that section.

What happens to my medical records if my doctor retires or closes their practice in Alaska?

The Alaska State Medical Board requires physicians to notify the board of the location of patient records within 30 days of retiring or closing a practice. Patients must be notified and informed about how to request their records. The physician remains responsible for ensuring records are retained for the full statutory period, even after the practice closes.

How should medical records be destroyed in Alaska after the retention period expires?

HIPAA requires that protected health information be destroyed so it cannot be reconstructed. Paper records should be cross-cut shredded, burned, pulped, or pulverized. Electronic records should be cleared using certified software, purged through degaussing, or physically destroyed. Providers should maintain a destruction log and obtain certificates of destruction from any third-party vendors.