Hawaii Medical Records Retention Laws (2026 Guide)

Hawaii law sets clear requirements for how long hospitals, physicians, and other health care providers must keep patient [medical records. The primary statute governing this area is Hawaii Revised Statutes (HRS) Section 622-58, which establishes a minimum 7-year retention period for complete medical records and a 25-year retention](/medical-records-retention-laws-by-state) period for basic patient information.

Whether you are a patient trying to access old records, a physician planning for retirement, or a hospital administrator managing compliance, understanding these requirements is essential. This guide covers every aspect of Hawaii's medical records retention laws, including how they interact with federal regulations under HIPAA and CMS.

How Long Must Medical Records Be Kept in Hawaii?

Under HRS Section 622-58(a), health care providers in Hawaii must retain medical records in the original or reproduced form for a minimum of 7 years after the last data entry.

This 7-year clock starts from the date of the most recent entry in the patient's record, not from the date of the first visit or the date of discharge. If a patient returns for a follow-up visit years later, the retention period resets from that new entry date.

The statute permits records to be stored in several formats, including the original paper form, microfilm, digital scans, or any other photographic reproduction process. The only requirement is that the method used must create an unalterable record of the original.

Retention Rules for Minor Patients

Hawaii law provides extended protections for the records of minors. Under HRS Section 622-58(a), records for patients who are minors must be retained during the entire period of minority plus 7 years after the minor reaches the age of majority.

Since the age of majority in Hawaii is 18, this means a child's medical records must be kept until they turn 25 at minimum. For a newborn, this creates a retention obligation of up to 25 years. For a child who was 10 years old at the time of their last medical visit, the records must be kept for at least 15 years (8 years of remaining minority plus 7 years after turning 18).

This extended period exists because minors cannot bring their own legal claims. By the time they reach adulthood and could pursue a medical malpractice or other legal action, they need access to their childhood medical records.

Hospital vs. Physician Retention Requirements

While HRS Section 622-58 applies to all health care providers, the statute draws an important distinction between physicians/surgeons and health care facilities when it comes to what basic information must be preserved after the full record is destroyed.

Physician and Surgeon Requirements

Individual physicians and surgeons in private practice must follow the same 7-year minimum retention period for complete medical records. After that period, if a physician chooses to destroy the full record, they must retain the following basic information for 25 years after the last entry:

• Patient's name and date of birth
• A list of dated diagnoses and intrusive treatments
• A record of all drugs prescribed or given

This basic information requirement under HRS Section 622-58(d) ensures that even decades later, there is a core record of what care a patient received.

Hospital and Health Care Facility Requirements

Hospitals and other health care facilities (as defined in HRS Section 323D-2) have a more extensive basic information requirement. After destroying full records past the 7-year mark, facilities must preserve the following for 25 years:

• Patient's name and date of birth
• Dates of admission and discharge
• Names of attending physicians
• Final diagnosis
• Major procedures performed
• Operative reports
• Pathology reports
• Discharge summaries

This broader requirement reflects the typically more complex care delivered in hospital settings, where multiple providers may be involved and surgical or invasive procedures are common.

Imaging and Diagnostic Records

Under HRS Section 622-58(c), X-ray films, electroencephalogram (EEG) tracings, and similar imaging records must be retained for at least 7 years. After that period, the provider may either return the imaging records to the patient or destroy them.

This provision gives patients the opportunity to take possession of their own imaging records before destruction occurs.

Who Qualifies as a Health Care Provider Under This Law?

HRS Section 622-58(f) defines "health care provider" by reference to HRS Section 671-1, which is part of Hawaii's Medical Claims Conciliation statute. This definition is broad and includes:

• Physicians and surgeons
• Dentists
• Nurses and advanced practice registered nurses
• Psychologists
• Hospitals and medical centers
• Clinics and health care facilities
• Other licensed health care practitioners working within their scope of practice

Essentially, any licensed health care professional or facility that creates medical records in the course of providing patient care in Hawaii is bound by HRS Section 622-58.

Records Exempt from Retention Requirements

HRS Section 622-58(b) lists several categories of records that are exempt from the standard retention requirements:

• Public health mass screening records
• Pupils' health records and related school health room records
• Preschool screening program records
• Communicable disease reports
• Mass testing epidemiological projects and study records, including consents
• Topical fluoride application consents
• Psychological test booklets
• Laboratory copies of reports that are duplicated within the main medical record
• Pharmacy copies of prescriptions that are duplicated within the main medical record
• Patient medication profiles that are duplicated within the main medical record
• Hospital nutritionists' special diet orders that are duplicated within the main medical record
• Public health nurses' case records that do not contain any physician's direct notations
• Social workers' case records
• Diagnostic or evaluative studies for the Department of Education or other state agencies

The common thread among these exemptions is that the records either serve a different public health purpose, are duplicated within the main medical record, or do not contain direct physician involvement.

Federal Requirements: HIPAA and Medical Records Retention

Many patients and providers assume that HIPAA (the Health Insurance Portability and Accountability Act) sets a federal minimum for how long medical records must be kept. It does not.

According to the U.S. Department of Health and Human Services (HHS), the HIPAA Privacy Rule does not include medical record retention requirements. Instead, state laws govern how long records must be retained.

However, HIPAA does impose important requirements that affect records management in Hawaii:

HIPAA Privacy Rule Requirements

The HIPAA Privacy Rule (45 CFR Part 164) requires covered entities to:

• Apply appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information (PHI) for as long as records exist
• Implement reasonable safeguards to prevent unauthorized access
• Maintain documentation of HIPAA policies and procedures for 6 years from the date of creation or the date when the policy was last in effect, whichever is later

This 6-year HIPAA documentation requirement applies to the provider's own compliance records, not to patient medical records. Since Hawaii's 7-year retention period exceeds HIPAA's 6-year documentation requirement, providers who comply with Hawaii law will generally satisfy this federal obligation.

HIPAA Security Rule for Electronic Records

Providers storing medical records electronically must also comply with the HIPAA Security Rule, which requires:

• Access controls limiting who can view patient records
• Audit controls tracking who accessed records and when
• Encryption of electronic PHI during transmission and, where appropriate, at rest
• Regular risk assessments of electronic record systems

These security requirements apply throughout the entire retention period and during the destruction process.

CMS and Medicare Records Requirements

Health care providers who participate in Medicare must also comply with the Centers for Medicare and Medicaid Services (CMS) Conditions of Participation. Under 42 CFR Section 482.24, hospitals participating in Medicare must maintain a medical record for every patient evaluated or treated.

CMS requires Medicare providers to retain medical records for at least 7 years from the date of service. For Hawaii providers, this aligns with the state requirement, but with one key difference: the CMS clock runs from the date of service, while Hawaii's clock runs from the last data entry. In practice, the Hawaii requirement often results in a longer effective retention period.

Additionally, CMS requires that medical records be:

• Accurately written, promptly completed, and properly filed
• Accessible to authorized practitioners
• Protected against unauthorized access
• Organized to facilitate data retrieval for clinical, research, and administrative purposes

Patient Access to Medical Records in Hawaii

Patients in Hawaii have the right to obtain copies of their medical records under both state and federal law.

State Law: HRS Section 622-57

Under HRS Section 622-57, when a patient requests copies of their medical records, the provider must make those copies available unless the provider believes disclosure would be detrimental to the patient's health.

If a provider withholds records on that basis, the provider must inform the patient that the records can be released to the patient's attorney upon presentation of a proper written authorization signed by the patient.

When an attorney requests records with proper patient authorization, the provider must supply complete and accurate copies within 10 working days.

The patient or requesting party is responsible for the reasonable costs of copying.

Federal Law: HIPAA Right of Access

The HIPAA Privacy Rule at 45 CFR Section 164.524 provides patients with a broad right to access their protected health information in all designated record sets maintained by covered entities.

Key provisions of the HIPAA right of access include:

• Providers must act on a patient's access request within 30 days of receiving it
• Patients can request records in a specific format (such as electronic), and providers must comply if the format is readily producible
• Providers may charge only a reasonable, cost-based fee limited to labor, supplies, and postage
• There are limited exceptions, including psychotherapy notes and information compiled for legal proceedings

For Hawaii patients, HIPAA provides a stronger access right than state law in some respects, because it does not include the "detrimental to health" exception that HRS Section 622-57 allows.

Proper Destruction of Medical Records

When the retention period has expired, Hawaii law permits destruction of medical records, but with specific conditions.

State Requirements

Under HRS Section 622-58(d), medical records may be destroyed after the 7-year retention period in a manner that will preserve the confidentiality of the information in the record. The statute requires that the provider retain the basic information described above (patient name, diagnoses, treatments, medications for physicians; a broader set of data for facilities) for 25 years.

HIPAA Disposal Requirements

The HHS guidance on disposal of protected health information specifies that covered entities must use appropriate safeguards when destroying records:

For paper records:

• Shredding, burning, pulping, or pulverizing so that PHI is rendered unreadable and cannot be reconstructed
• Simply placing records in a trash receptacle accessible to the public is not an acceptable method

For electronic records:

• Clearing (overwriting media with non-sensitive data using certified software)
• Purging (degaussing or exposing media to a strong magnetic field)
• Physical destruction (disintegration, pulverization, melting, incinerating, or shredding of storage media)

Providers may hire a business associate to handle destruction, but they must have a signed Business Associate Agreement (BAA) that requires the associate to appropriately safeguard the PHI through the disposal process.

Practice Closure and Succession Requirements

Hawaii law places specific obligations on providers who close their practice, retire, or transfer their practice to another entity.

Before Ceasing Operations

Under HRS Section 622-58, before a health care provider ceases operations, the provider must make immediate arrangements, subject to the approval of the Hawaii Department of Health, for the retention and preservation of medical records consistent with the statute's requirements.

This means a physician cannot simply close their doors and leave records unattended. They must have an approved plan for records storage, patient notification, and continued access.

Successor Obligations

If a health care provider's practice is taken over by another entity, the burden of compliance transfers to the successor. The successor assumes full responsibility for:

• Maintaining complete records for the remainder of the 7-year period
• Preserving basic information for the full 25-year period
• Providing patient access to records upon request
• Properly destroying records when retention periods expire

Recommended Best Practices for Closing a Practice

While Hawaii law does not specify every detail of the notification process, widely accepted best practices include:

• Notifying patients at least 30 days before the practice closes
• Publishing a notice in a local newspaper
• Sending individual letters to active patients
• Arranging for a records custodian to maintain records for the required retention periods
• Filing the records preservation plan with the Hawaii Department of Health
• Notifying the Hawaii Medical Board of the practice closure

Penalties for Non-Compliance

Violating Hawaii's medical records retention laws can expose providers to several forms of liability:

• Malpractice claims: Missing records can create a presumption of negligent care, making it harder for providers to defend against malpractice lawsuits
• HIPAA penalties: The HHS Office for Civil Rights can impose fines ranging from $141 to $2,134,831 per violation category per year for HIPAA non-compliance, including improper disposal of records
• Professional discipline: The Hawaii Medical Board can take disciplinary action against licensed providers who fail to maintain records as required
• Loss of Medicare participation: CMS can terminate a provider's Medicare enrollment for failure to comply with Conditions of Participation, including medical records requirements

Summary of Hawaii Medical Records Retention Periods

Record Type	Minimum Retention Period	Authority
Complete medical records (adults)	7 years after last entry	HRS Section 622-58(a)
Complete medical records (minors)	Period of minority + 7 years after age 18	HRS Section 622-58(a)
Basic patient information	25 years after last entry	HRS Section 622-58(e)
X-rays, EEG tracings, imaging	7 years (then return to patient or destroy)	HRS Section 622-58(c)
HIPAA compliance documentation	6 years from creation or last effective date	45 CFR Section 164.530(j)
Medicare/CMS records	7 years from date of service	42 CFR Section 482.24

Sources and References

• Hawaii Revised Statutes Section 622-58: Retention of Medical Records - Hawaii State Legislature
• Hawaii Revised Statutes Section 622-57: Patient Access to Medical Records - Hawaii State Legislature
• HHS FAQ: Does HIPAA Require Records Retention? - U.S. Department of Health and Human Services
• HIPAA Privacy Rule Summary - U.S. Department of Health and Human Services
• Individuals' Right Under HIPAA to Access Health Information - U.S. Department of Health and Human Services
• HIPAA Disposal of Protected Health Information FAQ - U.S. Department of Health and Human Services
• 42 CFR Section 482.24: Conditions of Participation for Medical Record Services - Electronic Code of Federal Regulations
• CMS Medical Record Maintenance and Access Requirements - Centers for Medicare and Medicaid Services