Arkansas Medical Records Retention Laws (2026 Guide)

Last verified: March 2026. This page reflects current Arkansas State Board of Health Rules for Hospitals and Related Institutions (Ark. Code R. 007.05.17), Ark. Code Ann. 16-46-106, and applicable federal regulations.

Table of Contents

• Overview of Arkansas Medical Records Retention Laws
• Hospital Medical Records Retention Requirements
• Retention Rules for Minor Patients
• Physician and Private Practice Retention Standards
• Nursing Homes and Long-Term Care Facilities
• Federal HIPAA Retention Requirements
• CMS and Medicare Conditions of Participation
• Patient Access to Medical Records
• Copy Fees and Timelines
• Proper Destruction of Medical Records
• Practice Closure and Records Custodianship
• Statute of Limitations Considerations
• Frequently Asked Questions
• Sources and References

Overview of Arkansas Medical Records Retention Laws

Arkansas medical records retention laws establish how long healthcare providers and facilities must keep patient health information on file. These rules serve a dual purpose. They protect patients' right to access their own medical history, and they protect providers by preserving documentation that may be needed for legal, billing, or continuity-of-care purposes.

The primary state regulation governing hospital records is found in the Arkansas State Board of Health Rules for Hospitals and Related Institutions, codified at Ark. Code R. 007.05.17. This regulation sets clear minimum retention periods for hospitals and related institutions licensed in the state.

For physician offices and private practices, Arkansas does not have a specific statute mandating a retention period. Instead, professional organizations and the Arkansas State Medical Board provide recommended guidelines that align closely with hospital standards.

Both state and federal laws apply to medical records retention in Arkansas. Healthcare providers must comply with whichever law requires the longest retention period, meaning federal requirements under HIPAA and the Centers for Medicare and Medicaid Services (CMS) can extend obligations beyond the state minimum.

Hospital Medical Records Retention Requirements

Under the Arkansas State Board of Health Rules for Hospitals and Related Institutions (Ark. Code R. 007.05.17), hospitals must retain all patient medical records for a minimum of 10 years following the patient's last discharge from the facility.

This 10-year requirement applies to all medical records maintained by licensed hospitals and related institutions in Arkansas. The regulation covers the complete medical record, including admission and discharge documentation, physician orders, progress notes, operative reports, diagnostic test results, nursing notes, and all other clinical documentation.

Acceptable Storage Formats

Arkansas law permits hospitals to retain medical records in their original paper form, on microfilm, or through other acceptable methods such as electronic health record (EHR) systems. Regardless of the storage format, the records must remain legible, accessible, and reproducible for the full 10-year retention period.

Master Patient Index

Even after the 10-year retention period has passed and records are eligible for destruction, Arkansas hospitals must permanently maintain information contained in the master patient index. This index typically includes the patient's name, dates of service, medical record number, and basic demographic information. The permanent retention of the master patient index allows facilities to confirm that a patient received care even after detailed clinical records have been destroyed.

Documentation Standards

The Arkansas hospital rules also establish standards for record completion and authentication. All entries in the medical record must be legible, dated, and authenticated by the responsible provider. Typewritten reports must include both the date of dictation and the date of transcription. Block charting and co-signatures are not acceptable practices under Arkansas hospital regulations.

Dictated records must be transcribed within 48 hours of dictation. These completion standards help ensure that medical records are accurate and reliable for the duration of the retention period.

Retention Rules for Minor Patients

Arkansas provides extended retention requirements for the medical records of minor patients. Under the same hospital regulations (Ark. Code R. 007.05.17), complete medical records of minors must be retained for a period of 2 years after the patient reaches the age of majority.

Since the age of majority in Arkansas is 18, this means hospitals must keep a minor's records until the patient turns 20 years old, or for 10 years after the last discharge, whichever period is longer.

How the Two Rules Interact

Consider a child who is discharged from a hospital at age 5 in 2026. Under the standard 10-year rule, the records would be eligible for destruction in 2036. However, under the minor patient rule, the records must be kept until 2 years after the child turns 18, which would be 2043 (when the patient is 20 years old). In this case, the minor patient rule extends the retention requirement by 7 years beyond the standard period.

For a teenager discharged at age 16, the standard 10-year rule would require retention until the patient is 26. The minor patient rule only extends to age 20. In that scenario, the 10-year rule controls, and the records must be kept until the patient turns 26.

Connection to Statute of Limitations

The extended retention period for minors' records aligns with Arkansas medical malpractice statutes. Under Ark. Code Ann. 16-114-203, minors who are 9 years old or younger at the time of an alleged medical injury have until the later of their 11th birthday or 2 years from the act to file a claim. For injuries not discovered before the minor's 11th birthday, the deadline extends to 2 years after the injury is discovered or until the patient's 19th birthday, whichever comes first. Retaining records beyond the standard period helps ensure documentation is available for any potential claims.

Physician and Private Practice Retention Standards

Arkansas does not have a specific statute that mandates a retention period for medical records maintained by physician offices, clinics, or private practices. This is a notable gap compared to many other states that set explicit requirements for all provider types.

In the absence of a statutory mandate, the Arkansas Medical Society recommends that physicians retain patient records for at least 10 years from the date of last treatment. This recommendation mirrors the hospital retention period and provides a consistent standard across practice settings.

Factors That May Extend Retention

Several practical and legal considerations may require physicians to keep records longer than 10 years:

• Minor patients: Records for minors should be retained until at least 2 years after the patient reaches age 18, consistent with hospital standards
• Medical malpractice statute of limitations: Arkansas allows 2 years from the date a cause of action accrues to file a malpractice claim, but discovery rules and minor tolling provisions can extend this period significantly
• Ongoing treatment: Records for patients with chronic conditions or ongoing treatment should be retained as long as the patient continues to receive care and for the full retention period after the last visit
• Federal program participation: Providers who accept Medicare or Medicaid must comply with CMS retention requirements, which may differ from state guidelines

Best Practice Recommendation

Healthcare attorneys and professional organizations generally recommend that Arkansas physicians adopt a written records retention policy that specifies at least a 10-year retention period from the last date of service, with extended retention for minors and patients involved in known or anticipated litigation.

Nursing Homes and Long-Term Care Facilities

Arkansas nursing homes and long-term care facilities licensed by the Office of Long Term Care (OLTC) within the Arkansas Department of Human Services follow retention standards consistent with hospital regulations.

All medical records in long-term care settings must be retained for 10 years after the last discharge in either the original form, on microfilm, or through other acceptable methods. After the 10-year period, records may be destroyed only if the facility permanently maintains the information contained in the master patient index.

For minor patients in long-term care, complete medical records must be retained for 2 years after the patient reaches the age of majority, consistent with hospital rules.

Resident Assessment Instruments

Nursing facilities that participate in Medicare or Medicaid must also retain original resident assessment instruments (such as the Minimum Data Set, or MDS) together with supporting documentation for at least 6 years following the date of the assessment. This requirement comes from federal participation conditions and applies in addition to the state retention period.

Federal HIPAA Retention Requirements

The Health Insurance Portability and Accountability Act (HIPAA) does not directly mandate how long healthcare providers must retain patient medical records. According to the U.S. Department of Health and Human Services (HHS), the HIPAA Privacy Rule does not include medical record retention requirements. State laws govern how long medical records must be retained.

However, HIPAA does require covered entities to retain certain compliance and administrative documentation for a minimum of 6 years. Under 45 CFR 164.530(j), covered entities must keep the following types of records for 6 years from the date of creation or the date when the document last was in effect, whichever is later:

• HIPAA privacy policies and procedures
• Privacy practices notices
• Disposition of complaints
• Required accounting of disclosures
• Business associate agreements
• Training records
• Sanctions applied to workforce members

How HIPAA Interacts with Arkansas Law

For Arkansas healthcare providers, the practical effect is a layered compliance obligation. The state 10-year requirement for hospital medical records exceeds the HIPAA 6-year documentation retention period, so the state rule controls for clinical records. However, HIPAA administrative documentation must be retained for 6 years regardless of whether the underlying patient records are still on file.

Providers who destroy patient records after the state retention period must still be able to produce their HIPAA compliance documentation if audited by the HHS Office for Civil Rights (OCR). This means privacy policies, business associate agreements, and training records from the period in question must remain accessible.

CMS and Medicare Conditions of Participation

Hospitals that participate in the Medicare program must meet the Conditions of Participation (CoPs) set by the Centers for Medicare and Medicaid Services. Under 42 CFR 482.24, Medicare-participating hospitals must retain medical records in their original or legally reproduced form for a minimum of 5 years.

Since Arkansas state law requires 10 years, the state requirement controls for hospitals in Arkansas. The CMS 5-year minimum becomes relevant only if a state does not set its own longer retention requirement.

Broader Medicare Provider Requirements

For non-hospital Medicare providers and suppliers, 42 CFR 424.516(f) requires maintenance of medical records for 7 years from the date of service. This requirement applies to physician practices, outpatient clinics, and other providers that bill Medicare.

Arkansas physicians who participate in Medicare should therefore plan to retain records for at least 10 years (following the state recommended standard), which exceeds the 7-year federal minimum.

CMS Documentation Standards

CMS also requires that medical records be accurately written, promptly completed, properly filed and retained, and accessible. The hospital must have a system for coding and indexing medical records that allows timely retrieval by diagnosis and procedure. These standards apply throughout the entire retention period.

Patient Access to Medical Records

Arkansas patients have a legal right to access their medical records through multiple pathways established by both state and federal law.

State Law: Ark. Code Ann. 16-46-106

Under Ark. Code Ann. 16-46-106, patients or their authorized representatives may submit a written request for copies of their medical records. This statute originally focused on access for legal proceedings, insurance claims, and life insurance applications, but has been interpreted broadly to support general patient access.

The statute establishes specific procedures when a physician or facility receives a records request. Providers must respond and produce records within a reasonable timeframe. If a physician believes releasing certain records could harm the patient, the physician may deny direct access and instead provide the records to another physician designated by the patient for review.

Federal Law: HIPAA Right of Access

Under the HIPAA Privacy Rule (45 CFR 164.524), patients have a broad right to access their protected health information (PHI) held by covered entities. Key provisions include:

• Covered entities must act on a request within 30 calendar days
• One extension of up to 30 additional days is permitted with written notice to the patient explaining the reason for the delay
• Records must be provided in the form and format requested by the patient, if readily producible (including electronic format for electronically maintained records)
• If the requested format is not available, the provider must offer a readable hard copy or mutually agreed alternative
• The fee charged must be reasonable and cost-based

The HIPAA right of access is broader than the Arkansas statutory provision and applies to virtually all protected health information maintained by covered entities, with limited exceptions for psychotherapy notes, information compiled for legal proceedings, and certain research records.

Copy Fees and Timelines

Arkansas law sets specific caps on the fees that providers may charge for copies of medical records. These caps apply to requests made under Ark. Code Ann. 16-46-106.

Paper Copy Fees

Pages	Maximum Fee Per Page
First 25 pages	$0.50 per page
Each additional page beyond 25	$0.25 per page

Additional Allowable Charges

Charge Type	Maximum Amount
Labor fee per request	$25.00
Certification or notarization	$2.00
Postage	Actual cost
Retrieval fee (off-site stored paper records only)	Reasonable cost

Electronic Records

For medical records maintained in electronic format, the statute sets a flat fee of $75.00 for producing records electronically, plus actual postage costs if applicable.

Medical records requested in electronic format must be produced within 30 days after receipt of the request, unless a different deadline is established by the Arkansas Rules of Civil Procedure or by a court order.

HIPAA Fee Limitations

HIPAA may further limit the fees a provider can charge. HHS guidance states that fees must be reasonable and cost-based, limited to the cost of copying (including supplies and labor), postage, and preparing a summary or explanation if requested and agreed to by the patient. Providers cannot charge search or retrieval fees under HIPAA, even if Arkansas state law would otherwise permit a retrieval fee.

When a patient makes a direct request for their own records, the more restrictive HIPAA fee limitations generally apply.

Proper Destruction of Medical Records

After the applicable retention period has expired, Arkansas healthcare providers may destroy medical records. However, destruction must be carried out in a manner that protects patient privacy and complies with both state standards and HIPAA destruction requirements.

Paper Record Destruction

For paper medical records, HHS requires that records be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed." Acceptable methods include:

• Shredding using cross-cut or micro-cut shredders
• Burning in a controlled, supervised environment
• Pulping through a commercial document destruction service
• Pulverizing to reduce records to unrecoverable fragments

Simply placing records in a dumpster, recycling bin, or trash receptacle accessible to the public is a HIPAA violation, regardless of whether the state retention period has passed.

Electronic Record Destruction

For electronically stored medical records, acceptable destruction methods include:

• Clearing (overwriting) the storage media so data cannot be recovered
• Purging (degaussing) magnetic media to eliminate all data
• Physical destruction of storage media through pulverization, melting, or incineration

Deletion of files without overwriting or physical destruction of the media is generally insufficient, as deleted electronic data can often be recovered using forensic tools.

Documentation of Destruction

Providers should maintain a log of destroyed records that includes the patient name or record identifier, the date of destruction, the method used, and the name of the individual who carried out or supervised the destruction. This documentation should be retained permanently as part of the facility's records management program.

Master Patient Index Preservation

As noted above, Arkansas hospitals must permanently maintain the master patient index even after destroying the detailed clinical records. Facilities should verify that index information is preserved before proceeding with any record destruction.

Practice Closure and Records Custodianship

When an Arkansas medical practice closes, the provider remains responsible for ensuring that patient medical records are properly maintained and accessible for the duration of the applicable retention period.

Notification Requirements

The Arkansas Medical Society recommends the following steps when closing a practice:

• Place a notice in the local newspaper announcing the closure and providing instructions for patients to obtain copies of their records
• Send a letter to all patients seen within the past year informing them of the closure, providing the expected date of closure, and explaining how to request their records
• Notify the Arkansas State Medical Board of the practice closure and provide contact information for the records custodian

Designating a Records Custodian

A records custodian is the individual or entity responsible for maintaining and providing access to medical records after a practice closes. In Arkansas, the custodian is typically:

• The physician who operated the practice (if retiring but still accessible)
• The executor of the physician's estate (if the physician is deceased)
• A successor practice or purchasing physician who acquires the practice
• A professional medical records storage company contracted to maintain the records

The custodian must maintain the records for the remainder of the retention period and respond to authorized requests for copies. Contact information for the custodian should be filed with the Arkansas State Medical Board so that patients and other authorized requestors can locate their records.

Records Transfer

If a practice is being acquired by another physician or group, patient records may be transferred to the new provider. Patients should be notified of the transfer and given the opportunity to request that their records be sent elsewhere if they prefer.

Statute of Limitations Considerations

Medical records retention is closely connected to the statute of limitations for medical malpractice claims in Arkansas. Providers should consider these timelines when determining how long to keep records.

General Medical Malpractice Statute of Limitations

Under Ark. Code Ann. 16-114-203, all actions for medical injury must be filed within 2 years after the cause of action accrues.

Tolling for Minors

Special rules apply to minor patients:

• Minors age 9 or younger at the time of the alleged injury have until the later of their 11th birthday or 2 years from the act to file a claim
• Undiscovered injuries in minors extend the deadline to 2 years after the injury is discovered or the patient's 19th birthday, whichever comes first

These tolling provisions for minors are one reason why the state requires extended retention of minor patient records. A claim filed when a patient is 19 years old could involve medical records from infancy.

Practical Impact on Retention

Because the statute of limitations can extend well beyond the standard 2-year period for minors and in cases involving undiscovered injuries, the 10-year retention requirement and the minor patient retention extension work together to ensure that records are available during the period when claims are most likely to be filed.

Frequently Asked Questions

How long do Arkansas hospitals have to keep medical records?

Arkansas hospitals must retain patient medical records for a minimum of 10 years following the patient's last discharge. This requirement comes from the Arkansas State Board of Health Rules for Hospitals and Related Institutions, codified at Ark. Code R. 007.05.17. Records may be stored in their original form, on microfilm, or in electronic format. After the 10-year period, records may be destroyed, but the facility must permanently maintain its master patient index.

How long must doctors keep medical records in Arkansas?

Arkansas does not have a specific statute requiring physician offices to retain records for a set period. However, the Arkansas Medical Society recommends that physicians keep records for at least 10 years from the date of last treatment. Physicians who participate in Medicare should retain records for at least 7 years under federal rules, though the 10-year recommendation remains the best practice standard. Records for minor patients should be kept until at least 2 years after the patient reaches age 18.

What are the fees for obtaining copies of medical records in Arkansas?

Under Ark. Code Ann. 16-46-106, paper copies are capped at $0.50 per page for the first 25 pages and $0.25 per page after that. A labor charge of up to $25.00 per request may be added, along with actual postage costs. For electronic records, the fee is a flat $75.00 plus actual postage. Certification or notarization costs an additional $2.00. HIPAA may further limit fees when a patient requests their own records directly.

What happens to medical records when an Arkansas practice closes?

When a medical practice closes in Arkansas, the provider must arrange for a records custodian to maintain patient records for the remainder of the retention period. The Arkansas Medical Society recommends placing a newspaper notice, sending letters to recent patients, and notifying the Arkansas State Medical Board with custodian contact information. The custodian may be the retiring physician, the physician's estate executor, a successor practice, or a professional records storage company.

Does HIPAA require keeping medical records for a specific number of years?

No. According to HHS, the HIPAA Privacy Rule does not include medical record retention requirements. State laws govern how long medical records must be retained. HIPAA does require covered entities to retain certain administrative and compliance documentation, such as privacy policies, training records, and business associate agreements, for 6 years under 45 CFR 164.530(j). The 6-year requirement applies to these compliance documents, not to patient clinical records.

Sources and References

• Arkansas State Board of Health Rules for Hospitals and Related Institutions (Ark. Code R. 007.05.17)
• Ark. Code Ann. 16-46-106 - Access to Medical Records (2024)
• Ark. Code Ann. 16-114-203 - Statute of Limitations for Medical Malpractice
• HHS: Does HIPAA Require Keeping Medical Records?
• 45 CFR 164.530 - HIPAA Administrative Requirements
• 45 CFR 164.524 - Individual Right of Access
• 42 CFR 482.24 - CMS Conditions of Participation: Medical Record Services
• CMS Medical Record Maintenance and Access Requirements
• HHS: Individuals' Right to Access Health Information
• HHS: Disposal of Protected Health Information
• Arkansas Medical Society FAQs
• Arkansas State Medical Board FAQs
• Arkansas Office of Long Term Care

Related State Laws

• Medical Records Retention Laws by State
• Alabama Medical Records Retention Laws
• Arizona Medical Records Retention Laws
• California Medical Records Retention Laws
• Florida Medical Records Retention Laws
• Georgia Medical Records Retention Laws
• Illinois Medical Records Retention Laws
• Louisiana Medical Records Retention Laws
• Kentucky Medical Records Retention Laws