Florida Medical Records Retention Laws (2026 Guide)

Florida law creates a layered system for medical records retention. Different rules apply depending on whether the provider is a hospital, a physician in private practice, a nursing home, or a hospice. Federal rules under Medicare add another layer on top of the state requirements.

This guide breaks down every applicable statute, regulation, and federal rule so you know exactly how long your records must be kept and what rights you have as a patient.

Physician Records: 5 Years From Last Contact

The most commonly cited retention rule in Florida comes from the Florida Board of Medicine. Under Florida Administrative Code Rule 64B8-10.002, a licensed physician must maintain "the full and total responsibility for and control of all files and records relating to his patients and his medical practice for a period of at least five years from the last patient contact."

This is the baseline. The five-year clock starts from the date of the last patient contact, not from the date the record was created.

What "Last Patient Contact" Means

The phrase "last patient contact" refers to the most recent instance when the physician provided care to or communicated with the patient about their treatment. This could be an office visit, a phone consultation, a prescription refill, or any documented interaction related to the patient's care.

If a patient sees a physician in January 2024 and never returns, the five-year retention period runs until January 2029. If that same patient returns for a follow-up in June 2025, the clock resets and the records must be kept until at least June 2030.

The 5-Year Minimum Is a Floor, Not a Ceiling

The Board of Medicine itself warns that the five-year minimum "may well be less than the length of time necessary for protecting the physician." The rule explicitly states that physicians should consider community standards for retention, specific patient needs, and the advice of legal counsel or malpractice insurance carriers when deciding how long to keep records.

Many malpractice insurers and legal advisors in Florida recommend keeping records for at least seven years because of the medical malpractice statute of limitations.

Hospital Records: A Different Framework

Florida Statute § 395.3025 governs patient records at licensed facilities including hospitals and ambulatory surgical centers. However, this statute focuses primarily on patient access rights and confidentiality rather than establishing a specific retention period.

What § 395.3025 Actually Requires

The statute requires licensed facilities to:

• Furnish copies of all patient records, including X-rays and insurance information, upon written request after discharge
• Provide records "in a timely manner, without delays for legal review"
• Maintain patient record confidentiality
• Allow patients to examine original records under reasonable terms

Medicare Conditions of Participation

Most Florida hospitals participate in Medicare. Under 42 CFR 482.24, Medicare-participating hospitals must retain medical records for at least 5 years after the date of discharge. This federal regulation effectively sets the minimum for the vast majority of Florida hospitals.

For general Medicare providers (including [hospitals), CMS guidelines require records to be maintained for 7 years from the date of service under 42 CFR 424.516(f). Since 7 years is longer than 5 years, the 7-year standard is the one most hospitals follow in practice.

Provider Type	Minimum Retention Period	Legal Authority
Physicians (private practice)	5 years from last patient contact	Fla. Admin. Code R. 64B8-10.002
Hospitals (Medicare)	5 years after discharge / 7 years from date of service	42 CFR 482.24 / CMS guidelines
Nursing homes	No specific statutory period (follow Medicare 7-year rule)	Fla. Stat. § 400.145 (access only)
Hospice providers	6 years after termination of services	Fla. Stat. § 400.611
Medicare Part D sponsors	10 years from date of service	CMS guidelines

Records for Minor Patients

Florida law provides extended retention protections for records involving minors. The clearest statutory language appears in the hospice context under Fla. Stat. § 400.611, which states that for a patient who is a minor, the retention period "shall begin on the date the patient reaches or would have reached the age of majority."

In Florida, the age of majority is 18. This means that for a minor patient, the retention clock does not start ticking until the patient turns 18.

Practical Example

A child receives treatment at age 5. Under the hospice statute's 6-year rule, the records must be kept until the child turns 24 (age 18 plus 6 years). While this specific provision is codified for hospice providers, the same principle is widely applied across healthcare settings as a best practice.

Why the Malpractice Statute of Limitations Matters for Minors

Under Fla. Stat. § 95.11, medical malpractice actions must generally be filed within 2 years of discovery, with an absolute outer limit of 4 years from the incident (7 years if fraud or concealment is involved). However, these outer limits do not bar an action brought on behalf of a minor "on or before the child's eighth birthday."

This means a child injured at age 2 could potentially have a claim filed until age 8, well beyond the normal 4-year window. Providers treating minor patients should factor this extended exposure into their retention decisions.

HIPAA and Medical Records Retention

One of the most widespread misconceptions in healthcare is that HIPAA requires providers to keep medical records for a specific number of years. It does not.

What HIPAA Actually Requires

According to the U.S. Department of Health and Human Services, "the HIPAA Privacy Rule does not include medical record retention requirements." State laws control how long patient medical records must be kept.

What HIPAA does require is that covered entities retain HIPAA-related administrative documentation for 6 years from the date of creation or last effective date. This includes:

• Privacy policies and procedures
• Privacy practices notices
• Complaint records and disposition
• Training documentation
• Business associate agreements

This 6-year rule applies to compliance paperwork, not to patient charts or clinical records.

HIPAA's Role in Record Security

While HIPAA does not dictate retention periods, it does govern how records are stored and protected for as long as they exist. All protected health information (PHI) must be safeguarded against unauthorized access, whether in paper or electronic form, throughout the entire retention period and during the destruction process.

CMS and Medicare Requirements

Federal Medicare requirements create a second layer of retention obligations for any Florida provider that participates in Medicare or Medicaid.

Standard Medicare Retention

CMS requires all Medicare providers to maintain medical records for 7 years from the date of service. This applies to physicians, non-physician practitioners, hospitals, and other suppliers as specified in 42 CFR 424.516(f).

Providers who fail to produce documentation when requested may face revocation of their Medicare enrollment under 42 CFR 424.535(a)(10).

Medicare Part D

Medicare Part D sponsors have an even longer requirement. Federal regulation mandates 10 years of records retention for Part D programs. If a Part D sponsor is discontinued, merged, or acquired, the gaining sponsor must provide access to the prior contract's documents for the full 10-year period.

Which Rule Wins?

The stricter requirement always applies. A Florida physician who participates in Medicare must keep records for at least 7 years (the Medicare standard), even though the state Board of Medicine only requires 5 years. The state minimum serves as the floor, but federal participation agreements often push the effective minimum higher.

Patient Access Rights in Florida

Florida law gives patients robust rights to access their medical records through several overlapping statutes.

Hospital Records (§ 395.3025)

Under Fla. Stat. § 395.3025, hospitals and ambulatory surgical centers must provide patients with copies of all records, including X-rays and insurance information, upon written request after discharge. The statute requires that records be provided "in a timely manner, without delays for legal review."

Patients also have the right to examine original records, including microforms, under reasonable terms set by the facility.

Physician Records (§ 456.057)

Under Fla. Stat. § 456.057, health care practitioners must furnish copies of all reports and records relating to examination or treatment upon patient request. This includes X-rays and insurance information.

For psychiatric and psychological records, practitioners may provide an examination report instead of complete records, though patients can request that full records be sent directly to a subsequent treating psychiatrist.

Nursing Home Records (§ 400.145)

Under Fla. Stat. § 400.145, nursing homes must provide copies within 14 working days for current residents and 30 working days for former residents. Records of deceased residents may be requested by court-appointed estate representatives, persons designated in a self-proved will, or surviving spouses, children, or parents.

HIPAA Right of Access

Under the federal HIPAA Privacy Rule, patients have the right to access their medical records within 30 days of a written request. Providers may extend this by an additional 30 days with written notice. Electronic copies must be provided if the records are maintained electronically and the patient requests an electronic format.

Copy Fees in Florida

Florida law sets specific caps on what providers can charge for copies of medical records.

Hospital Copy Fees

Under Fla. Stat. § 395.3025, the maximum charges for hospital record copies are:

Fee Type	Maximum Amount
Paper records	$1.00 per page
Nonpaper records (CDs, digital)	$2.00 per item
Search fee (per year of records)	$1.00 per year
Sales tax and postage	Actual cost

There is one important exception: a patient whose records are copied or searched for the purpose of continuing to receive medical care cannot be charged any copying or search fees.

Physician Copy Fees

Under Florida Administrative Code Rule 64B8-10.003, the maximum charges for physician office record copies are:

Fee Type	Maximum Amount
First 25 pages	$1.00 per page
Each additional page	$0.25 per page
X-rays and special records	Actual duplication cost (materials + labor)

Nursing Home Copy Fees

Under Fla. Stat. § 400.145, the fee structure mirrors the physician schedule: $1.00 per page for the first 25 pages and $0.25 per page for each additional page. Residents may also choose to examine original records at the facility instead of requesting copies.

HIPAA Fee Limits

Under HIPAA, providers may charge a reasonable, cost-based fee for copies. HHS has established a flat fee option of $6.50 for electronic copies of records maintained electronically, regardless of the number of pages. Florida's state fee caps apply to paper records, while the HIPAA limit typically governs electronic copy requests.

Record Destruction Requirements

When the retention period has passed and a provider decides to destroy records, both state and federal rules govern the process.

Physician Record Destruction

Under Florida Administrative Code Rule 64B8-10.001, when a physician dies, the executor or representative must retain patient records for at least 2 years from the date of death. Within one month of death, they must publish notices in local newspapers indicating where records are available. After 22 months, they must publish notices for four consecutive weeks announcing that records will be destroyed one month later.

For physicians who are closing or relocating their practice, Rule 64B8-10.002 requires:

• Publishing notice once weekly for four consecutive weeks in newspapers of greatest circulation in the counties where they practiced
• Including the termination date and the address where records may be obtained
• Submitting a copy of the notice to the Board of Medicine within one month

HIPAA Destruction Standards

Under the HIPAA Privacy Rule, covered entities must implement reasonable safeguards when disposing of protected health information. Acceptable methods include:

• Paper records: Shredding, burning, or pulping so that PHI is rendered unreadable, indecipherable, and unable to be reconstructed
• Electronic media: Clearing, purging, or destroying the media so that PHI cannot be retrieved
• Third-party disposal: Providers may hire business associates to handle destruction, but must have a business associate agreement in place

Records may never be placed in dumpsters, recycling bins, or other receptacles accessible to the public or unauthorized persons without first being properly destroyed.

Practice Closure and Relocating Physicians

When a Florida physician closes a practice, relocates, or retires, Fla. Stat. § 456.057 and § 456.058 impose specific obligations:

Required Steps

1. Notify patients: Place an advertisement in a local newspaper or send written notice to patients, informing them of the closure and offering the opportunity to obtain copies of their records
2. Notify the Board: Contact the appropriate board office, specifying who the new records owner is and where medical records can be found
3. Transfer records responsibly: When records are transferred to a new owner, that new owner assumes full responsibility for providing copies upon written request
4. Maintain for 5 years minimum: Even during closure, the 5-year retention period from last patient contact still applies

Deceased Physician Records

Under Rule 64B8-10.001, when a physician dies, the executor or personal representative must:

• Retain records for at least 2 years from the date of death
• Publish newspaper notices within one month of death
• Publish destruction notices for four consecutive weeks beginning at 22 months after death
• Allow records to be destroyed no sooner than one month after the final destruction notice

If a practitioner becomes incapacitated or abandons their practice, the appropriate board may appoint a custodian for the records under Fla. Stat. § 456.057(20).

Electronic Health Records in Florida

Florida addresses electronic health records under Fla. Stat. § 408.051. The statute defines an "electronic health record" as a record of medical treatment created by a licensed health care provider and stored in an interoperable and accessible digital format.

Key Requirements for EHR

• All patient information stored in offsite physical or virtual environments (including cloud computing services) must be physically maintained in the continental United States
• Providers must comply with HIPAA Security Rule requirements in addition to state law
• Electronic records are subject to the same retention periods as paper records
• Providers may accept authorization forms in electronic or paper format, or both

Digital Scanning and Copy Fees

Under Fla. Stat. § 456.057, practitioners who make records available for digital scanning may charge "no more than the actual cost of copying, including reasonable staff time," or the amount specified in administrative rules by the appropriate board.

Frequently Asked Questions

How long must a Florida doctor keep my medical records?

Florida physicians must keep your medical records for at least 5 years from your last patient contact under Florida Administrative Code Rule 64B8-10.002. If the physician participates in Medicare, federal rules require records to be kept for 7 years from the date of service. The longer period always applies, so most physicians in practice keep records for 7 years or more.

Does Florida have a different retention period for hospital records?

Fla. Stat. § 395.3025 does not specify a retention period for hospital records. However, Medicare-participating hospitals must retain records for at least 5 years after discharge under 42 CFR 482.24, and CMS guidelines require 7 years from date of service for general Medicare providers. Most Florida hospitals follow the 7-year standard.

How long are records kept for children in Florida?

For hospice providers, Fla. Stat. § 400.611 provides that the retention period for minor patients does not begin until the patient reaches or would have reached age 18. While this specific provision applies to hospice, the principle is widely applied across all healthcare settings. A child treated at age 5 would have records retained until at least age 23 (age 18 plus the 5-year physician minimum).

Can a Florida provider charge me for copies of my records?

Yes, but fees are capped by law. Hospitals may charge up to $1 per page under § 395.3025. Physician offices may charge $1 per page for the first 25 pages and $0.25 per page after that under Rule 64B8-10.003. However, if you need copies for continuing medical care, the hospital cannot charge you anything.

What happens to my records if my doctor retires or dies?

If your doctor retires or closes their practice, Fla. Stat. § 456.057 requires them to notify you by advertisement or direct written notice and offer you the opportunity to obtain copies. If your doctor dies, Rule 64B8-10.001 requires the estate to keep records for at least 2 years and publish newspaper notices so patients can retrieve their records before destruction.

Sources and References

• Fla. Stat. § 395.3025 - Patient and Personnel Records (2025)
• Fla. Stat. § 456.057 - Ownership and Control of Patient Records (2025)
• Fla. Stat. § 456.058 - Disposition of Records of Deceased Practitioners (2025)
• Fla. Stat. § 400.145 - Nursing Home Records Access (2025)
• Fla. Stat. § 400.611 - Hospice Records Retention (2025)
• Fla. Stat. § 95.11 - Statute of Limitations (2025)
• Fla. Stat. § 408.051 - Electronic Health Records (2025)
• Fla. Admin. Code R. 64B8-10.001 - Deceased Physician Records
• Fla. Admin. Code R. 64B8-10.002 - Physician Records Retention
• Fla. Admin. Code R. 64B8-10.003 - Costs of Reproducing Records
• HHS - Does HIPAA Require Records Retention?
• HHS - HIPAA Disposal Requirements
• CMS - Medical Record Maintenance and Access Requirements
• 42 CFR 482.24 - Hospital Conditions of Participation: Medical Record Services