Connecticut Medical Records Retention Laws (2026 Guide)

---

title: "Connecticut Medical Records Retention Laws (2026 Guide)" description: "Learn how long Connecticut hospitals and physicians must keep medical records. Covers Conn. Agencies Regs. 19a-14-42, HIPAA, CMS rules, patient access, and more."

Connecticut has specific regulations governing how long hospitals, physicians, and other healthcare providers must retain patient medical records. These rules vary depending on the type of facility, the kind of record, and whether the patient was a minor. Understanding these requirements is important for healthcare providers, patients, and legal professionals alike.

This guide breaks down every major aspect of Connecticut medical records retention law, including state regulations, federal requirements under HIPAA and CMS, patient access rights, destruction rules, and what happens when a practice closes.

Key Takeaways

• General hospitals must keep medical records for at least 10 years after a patient is discharged (Conn. Agencies Regs. Section 19-13-D3).
• Children's hospitals and long-term care hospitals must retain records for 25 years after discharge (Conn. Agencies Regs. Sections 19-13-D4a and 19-13-D5).
• Physicians and individual practitioners must retain all medical records for 7 years from the last date of treatment, or 3 years after the patient's death (Conn. Agencies Regs. Section 19a-14-42).
• HIPAA does not set a minimum retention period for medical records themselves, but requires proper safeguards through disposal.
• CMS requires Medicare providers to maintain records for at least 7 years from the date of service under 42 CFR Section 424.516(f).
• Patients can request copies of their records, and providers must supply them within 30 days (Conn. Gen. Stat. Section 20-7c).

Hospital Medical Records Retention

General Hospitals: 10-Year Minimum

Under Connecticut Agencies Regulations Section 19-13-D3(D)(6), general hospitals must keep medical records for a minimum of 10 years after the patient is discharged. This applies to the complete medical record, including all clinical documentation, physician orders, nursing notes, and diagnostic reports.

Hospitals may destroy original records before the 10-year mark only if they preserve them using a method consistent with current hospital industry standards. Before destroying any original records, the hospital must provide the Connecticut Department of Public Health (DPH) with documentation of the preservation process used.

Medical records must also be completed within 30 days after patient discharge, except in unusual circumstances defined in the medical staff rules and regulations.

Children's Hospitals: 25-Year Minimum

Connecticut Agencies Regulations Section 19-13-D4a imposes a significantly longer retention requirement for children's hospitals. These facilities must keep medical records for a minimum of 25 years after patient discharge.

Original records at children's hospitals may be destroyed earlier only if they have been microfilmed using a process approved by the Connecticut Department of Public Health.

Long-Term Care Hospitals: 25-Year Minimum

Similarly, long-term care hospitals and chronic disease hospitals must retain medical records for 25 years following patient discharge under Conn. Agencies Regs. Section 19-13-D5. The same microfilming exception applies as with children's hospitals.

These extended retention periods reflect the unique nature of care at these facilities, where treatment histories may span many years and have ongoing relevance to patient care.

Physician and Practitioner Retention Requirements

The 7-Year Rule

Connecticut Agencies Regulations Section 19a-14-42 establishes the retention schedule for physicians and other individual practitioners licensed under the state's public health code. The baseline requirement states that all parts of a medical record must be retained for 7 years from the last date of treatment.

If the patient dies, the practitioner must keep the records for at least 3 years from the date of death.

This regulation took effect on August 29, 1984, and applies to all practitioners regulated under Title 19a of the Connecticut Agencies Regulations.

Retention Periods for Specific Record Types

While 7 years is the general rule, Conn. Agencies Regs. Section 19a-14-42 sets different minimum periods for certain types of records:

Record Type	Minimum Retention Period
Complete medical record	7 years from last treatment
Pathology slides	7 years
EEG tracings	7 years
ECG tracings	7 years (only most recent needed if results unchanged)
Lab reports	5 years (only positive/abnormal results required)
PKU reports	5 years
X-ray films	3 years

Reports associated with pathology slides, EEG tracings, and ECG tracings must be retained for the full 7-year period, even if the physical materials have a shorter minimum.

An important detail is that only positive (abnormal) lab results are required to be retained. Routine normal results do not carry the same mandatory retention obligation.

Nothing in the regulation prevents a practitioner from keeping records longer than the minimum period. Practitioners are encouraged to consider malpractice risk when deciding how long to retain records beyond the minimum.

When a Facility Holds Records

Under Conn. Agencies Regs. Section 19a-14-43, when a health care facility or organization maintains records for a patient, the individual practitioner is not required to keep duplicate records. In that case, the facility's retention schedule applies to those records.

Records Retention for Minor Patients

Connecticut does not have a single statute that explicitly extends medical records retention based on the age of majority. However, several provisions effectively create longer retention obligations for minors' records.

The age of majority in Connecticut is 18 years old under Conn. Gen. Stat. Section 1-1d. At that age, a person has full legal capacity and rights.

For general hospitals, the 10-year retention period runs from discharge. If a child is treated at age 5, the hospital must keep those records until the child is at least 15. For children's hospitals, the 25-year retention period means records of a child treated at age 5 would be retained until at least age 30.

For physicians, the 7-year rule runs from the last date of treatment. A pediatrician who last treats a child at age 10 must keep those records until at least age 17.

Healthcare providers should also consider the medical malpractice statute of limitations when retaining records for minors. Under Conn. Gen. Stat. Section 52-584, the general statute of limitations for medical malpractice is 2 years from when the injury is discovered, with a 3-year statute of repose from the date of the act or omission. For minors, tolling provisions may extend these deadlines. Retaining records beyond the minimum period provides protection against late-filed claims.

HIPAA and Federal Requirements

HIPAA Does Not Set a Retention Period for Medical Records

A common misconception is that HIPAA requires providers to keep medical records for a specific number of years. In fact, the HIPAA Privacy Rule does not include a medical record retention requirement.

According to the U.S. Department of Health and Human Services (HHS), state laws generally govern how long medical records must be retained. HIPAA defers to state law on this point.

However, HIPAA does require covered entities to retain certain administrative documentation for at least 6 years. This includes privacy policies and procedures, privacy practices notices, complaint dispositions, and other actions or designations required by the Privacy Rule. This 6-year requirement applies to the documentation itself, not to patient medical records.

HIPAA also requires covered entities to maintain appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for the entire time those records are maintained, including through the disposal process.

CMS and Medicare Requirements

Healthcare providers who participate in Medicare must comply with additional federal record retention rules. Under 42 CFR Section 424.516(f), Medicare providers must maintain medical records for 7 years from the date of service.

CMS or a Medicare contractor may request access to medical records at any time during this period. Failure to comply with these requirements can result in revocation of Medicare enrollment under 42 CFR Section 424.535(a)(10).

For Connecticut providers who accept Medicare, this 7-year federal requirement aligns with the state's 7-year rule for individual practitioners but falls short of the 10-year requirement for hospitals. Hospitals must follow the longer state requirement.

Patient Access to Medical Records

Right to Access Under Connecticut Law

Connecticut General Statutes Section 20-7c gives patients the right to access their medical records. Under this statute, a healthcare provider must supply a patient with complete and current information about any diagnosis, treatment, and prognosis upon request.

Providers must also notify patients of any test results in the provider's possession or requested by the provider for diagnostic, treatment, or prognostic purposes.

Timeline for Providing Records

A provider must furnish requested health records within 30 days of the request under Conn. Gen. Stat. Section 20-7c.

Fees for Copies

Connecticut law caps what providers can charge for medical record copies:

• 65 cents per page, which includes research fees, handling fees, and related costs
• First-class postage costs may also be charged if applicable
• X-ray copies may be charged at the actual cost of materials

Importantly, no fee may be charged for furnishing records (or portions of records) when they are needed to support a claim or appeal under the Social Security Act, a claim for veterans' benefits under Title 38 of the United States Code, or a claim under Chapter 506 of the Connecticut General Statutes. The request must include documentation of the claim or appeal.

When a Provider Can Withhold Records

Under Conn. Gen. Stat. Section 20-7c, a provider may withhold medical records from a patient if the provider determines that disclosure would harm the patient's physical or mental health. In that case, the provider may supply the information to an appropriate third party or another provider, who can then release it to the patient.

Hospital Records Access

Private hospitals, public hospital societies, and corporations receiving state aid must provide access to patient records under Conn. Gen. Stat. Section 4-104. This includes the patient's history, bedside notes, charts, pictures, and plates connected to treatment. Patients may also copy these materials.

Destruction of Medical Records

State Requirements

Connecticut regulations do not prescribe a single mandatory method for destroying medical records. However, the regulations do establish conditions for early destruction of original records:

• General hospitals may destroy originals before 10 years if records are preserved using methods consistent with current hospital industry standards (Conn. Agencies Regs. Section 19-13-D3).
• Children's and long-term hospitals may destroy originals before 25 years only if they are microfilmed using a DPH-approved process (Conn. Agencies Regs. Sections 19-13-D4a and 19-13-D5).

HIPAA Destruction Requirements

While Connecticut regulations focus on when records can be destroyed, HIPAA governs how they must be destroyed. Under the HIPAA Privacy and Security Rules, covered entities must implement reasonable safeguards when disposing of protected health information (PHI).

For paper records, acceptable destruction methods include:

• Shredding
• Burning
• Pulping
• Pulverizing

The goal is to render PHI unreadable, indecipherable, and impossible to reconstruct.

For electronic records, acceptable methods include:

• Clearing (overwriting media with non-sensitive data)
• Purging (degaussing or using strong magnetic fields)
• Physical destruction (disintegration, pulverization, melting, incineration, or shredding of the media)

Covered entities may hire a business associate to dispose of PHI, but they must execute a business associate agreement requiring proper safeguards through the disposal process. Simply placing records in a public dumpster or recycling bin is not permitted.

Litigation Hold

Under Conn. Agencies Regs. Section 19a-14-43, if a claim of malpractice, unprofessional conduct, or negligence has been made against a practitioner regarding a specific patient, or if litigation has been commenced, all records for that patient must be retained until the matter is fully resolved. This applies regardless of whether the standard retention period has expired.

Practice Closure Requirements

Notification Obligations

When a Connecticut healthcare practitioner discontinues a practice, whether due to retirement, relocation, or death, specific notification and record retention duties apply under Conn. Agencies Regs. Section 19a-14-44.

The practitioner (or, in the case of death, the surviving responsible relative or executor) must notify patients through two channels:

1. Published notice in a local daily newspaper serving the practice community. The notice must be at least two columns wide and two inches in height, published twice with at least seven days between insertions.
2. Written letter sent directly to every patient seen within the three years before the practice was discontinued.

Record Retention After Closure

After both forms of notice have been given, the practitioner must retain all patient medical records for at least 60 days. This 60-day window gives patients time to request their records and arrange transfer to a new provider.

This 60-day period is in addition to the general 7-year retention requirement. Records that have not yet reached their 7-year retention mark must continue to be maintained or transferred to a successor provider or records custodian.

Electronic Medical Records Storage

Connecticut law permits healthcare institutions to create, maintain, and use medical records in electronic format, paper format, or both. Under Conn. Gen. Stat. Sections 19a-25b and 19a-25c, electronic record-keeping systems must be able to:

• Store medical records and patient health care information in a reproducible manner
• Maintain records in a secure format
• Protect patient confidentiality

Hospitals that use electronic signatures for medical records must submit their protocols to the Connecticut Department of Public Health for approval under Conn. Gen. Stat. Section 19a-25a. These protocols must address patient confidentiality and record security.

Regardless of format, the same retention periods apply. A hospital using electronic health records must still retain those records for at least 10 years after discharge, just as it would with paper records.

Practical Recommendations for Connecticut Providers

While the law sets minimum retention periods, many legal and medical experts recommend keeping records longer than required. Here are practical guidelines:

1. Consider malpractice risk. The statute of limitations for medical malpractice in Connecticut is 2 years from discovery with a 3-year statute of repose (Conn. Gen. Stat. Section 52-584). Tolling for minors and other exceptions can extend these deadlines. Retaining records for at least 10 years provides a reasonable buffer.

2. Follow the longest applicable rule. If you are a Medicare-participating physician in a hospital setting, you may be subject to the hospital's 10-year rule, the CMS 7-year rule, and the state's 7-year practitioner rule simultaneously. Always follow the longest applicable period.

3. Document your retention policy. Having a written records retention and destruction policy helps demonstrate compliance and provides guidance for staff.

4. Use secure destruction methods. Whether you use paper or electronic records, follow HIPAA-compliant destruction methods when records reach the end of their retention period.

5. Plan for practice transitions. If you are approaching retirement or closing a practice, begin the notification process well in advance and arrange for a records custodian to maintain records that have not yet reached their retention deadline.

Frequently Asked Questions

How long do Connecticut hospitals keep medical records?

General hospitals in Connecticut must retain medical records for a minimum of 10 years after patient discharge under Conn. Agencies Regs. Section 19-13-D3. Children's hospitals and long-term care hospitals must keep records for 25 years after discharge under Sections 19-13-D4a and 19-13-D5. Hospitals may destroy original records sooner if they preserve them using approved methods such as microfilming or digital storage consistent with industry standards.

How long must a Connecticut doctor keep patient records?

Individual physicians and licensed practitioners in Connecticut must retain all parts of a patient's medical record for 7 years from the last date of treatment under Conn. Agencies Regs. Section 19a-14-42. If the patient dies, records must be kept for at least 3 years from the date of death. Certain record types have shorter minimums: lab reports require 5 years, and X-ray films require 3 years.

Does HIPAA require keeping medical records for a specific time?

No. The HIPAA Privacy Rule does not set a minimum retention period for patient medical records. According to HHS, state laws govern medical record retention periods. However, HIPAA does require covered entities to retain administrative documentation related to privacy policies and procedures for at least 6 years. HIPAA also requires proper safeguards when disposing of any protected health information.

What happens to medical records when a Connecticut doctor retires?

When a practitioner discontinues a practice in Connecticut, they must notify patients through a published newspaper notice and a direct letter to each patient seen in the prior three years (Conn. Agencies Regs. Section 19a-14-44). All records must be maintained for at least 60 days after both notices are given, allowing patients time to request their files. Records that have not yet reached the 7-year minimum must continue to be stored or transferred to a custodian.

Can a Connecticut patient get copies of their medical records?

Yes. Under Conn. Gen. Stat. Section 20-7c, patients have the right to request complete copies of their medical records. Providers must supply the records within 30 days of the request. The maximum fee is 65 cents per page, including handling and research fees, plus first-class postage if applicable. No fee may be charged when records are needed for Social Security or veterans' benefits claims.

Sources and References

1. Connecticut Agencies Regulations Section 19a-14-42, Retention Schedule (effective August 29, 1984)
2. Connecticut Agencies Regulations Section 19-13-D3, General Hospital Medical Records
3. Connecticut Agencies Regulations Section 19-13-D4a, Children's Hospital Medical Records
4. Connecticut Agencies Regulations Section 19-13-D5, Long-Term Hospital Medical Records
5. Connecticut Agencies Regulations Section 19a-14-43, Exceptions to Retention Schedule
6. Connecticut Agencies Regulations Section 19a-14-44, Discontinuance of Practice
7. Connecticut General Statutes Section 20-7c, Access to Medical Records
8. Connecticut General Statutes Section 4-104, Hospital Records Access
9. Connecticut General Statutes Section 1-1d, Age of Majority
10. Connecticut General Statutes Section 52-584, Medical Malpractice Statute of Limitations
11. Connecticut General Statutes Sections 19a-25a, 19a-25b, 19a-25c, Electronic Medical Records
12. U.S. Department of Health and Human Services, HIPAA Privacy Rule FAQ on Record Retention (hhs.gov)
13. 42 CFR Section 424.516(f), CMS Medicare Medical Record Maintenance Requirements
14. U.S. Department of Health and Human Services, HIPAA Disposal of Protected Health Information FAQ (hhs.gov)