Indiana Medical Records Retention Laws (2026 Guide)

Last verified: March 2026. This page reflects current Indiana Code Title 16, Article 39 and Indiana Administrative Code Title 410, Article 15.

Table of Contents

• [Overview of Indiana Medical Records Retention Laws](#overview)
• How Long Must Providers Keep Medical Records in Indiana
• Hospital vs. Physician Retention Requirements
• Retention Rules for Minor Patients' Records
• X-Ray, Mammogram, and Imaging Record Retention
• Federal Requirements: HIPAA and CMS
• Patient Access to Medical Records in Indiana
• Copying Fees for Medical Records
• Proper Destruction of Medical Records
• Practice Closure and Record Transfer Requirements
• Indiana's Abandoned Health Records Act
• Penalties for Non-Compliance
• Frequently Asked Questions
• Sources and References

Overview of Indiana Medical Records Retention Laws

Indiana law sets clear minimum periods for how long healthcare providers must keep patient medical records. The primary statute governing retention is Indiana Code 16-39-7-1, which applies to hospitals, physicians, dentists, nurses, and all other licensed healthcare providers in the state.

The law requires providers to maintain original health records or microfilm copies for at least seven years. This requirement applies across the board to every type of licensed healthcare provider operating in Indiana, whether they run a large hospital system or a solo medical practice.

Indiana also imposes additional requirements through the Indiana Administrative Code (410 IAC 15-1.5-4), which governs hospital licensure and medical record services. These administrative rules work alongside the state statutes to form a comprehensive regulatory framework for medical records management.

Providers who fail to meet these retention requirements face disciplinary sanctions from their licensing boards. In addition, federal laws including HIPAA and CMS participation requirements may impose additional obligations on top of Indiana's state law minimums.

How Long Must Providers Keep Medical Records in Indiana

Indiana Code 16-39-7-1(b) requires all healthcare providers to maintain the original health records or microfilms of those records for a minimum of seven (7) years. This is the baseline retention period that applies to all provider types.

The seven-year clock typically begins from the date of the patient's last treatment or encounter. However, several situations require longer retention.

Standard Retention Periods in Indiana:

Record Type	Minimum Retention	Governing Law
General health records	7 years	IC 16-39-7-1
X-ray films	5 years	IC 16-39-7-2
Mammograms (ongoing care)	5 years	IC 16-39-7-2
Mammograms (no follow-up)	10 years	IC 16-39-7-2
Minor patient records	Until age 21 or 7 years, whichever is longer	IC 16-39-7-1
Medicaid records	7 years from date of service	405 IAC 1-1.4-2
Medicare records	7 years from date of service	42 CFR 424.516(f)

Providers should note that if a patient requests their records during the retention period, the provider must accommodate that request within 30 days under IC 16-39-1-1. Transferring records to a patient or another provider does not relieve the original provider of their retention obligations for any copies they retain.

Hospital vs. Physician Retention Requirements

While the seven-year minimum under IC 16-39-7-1 applies to both hospitals and individual physicians, these two provider types face different regulatory frameworks that create distinct compliance obligations.

Hospital Requirements

Hospitals licensed in Indiana must comply with 410 IAC 15-1.5-4, which governs medical record services as part of hospital licensure. This regulation requires:

• Medical record services directed by a Registered Health Information Administrator (RHIA) or Registered Health Information Technician (RHIT)
• Records retained in their original or legally reproduced form as required by federal and state law
• Patient identification data, diagnostic and therapeutic orders, and authentication of all entries
• Discharge summaries authenticated by the attending physician
• Procedures for releasing records only to authorized individuals under federal and state law

Hospitals that participate in Medicare must also meet the federal Conditions of Participation under 42 CFR 482.24, which requires maintaining a medical record for every inpatient and outpatient. These records must be accurately written, promptly completed, properly filed and retained, and accessible.

Physician Requirements

Physicians in private practice are subject to the same seven-year retention requirement under IC 16-39-7-1. They are also regulated by the Indiana Medical Licensing Board under 844 IAC 5-2, which sets professional standards for medical record keeping.

Physicians must maintain records that contain sufficient information to identify the patient, support the diagnosis, justify the treatment, and document the course and results of care. Solo practitioners and small practices bear full responsibility for establishing secure storage systems and ensuring records remain accessible throughout the entire retention period.

Both hospitals and physicians must ensure their records are legible, complete, and authenticated by the responsible provider. Electronic health records (EHR) systems are acceptable, but providers must have procedures to ensure accurate and complete reproduction of original documents.

Retention Rules for Minor Patients' Records

Indiana law provides special protections for the medical records of children and adolescents. Providers must retain records for minor patients until the patient reaches the age of 21 or for seven years after the date of the last service, whichever period is longer.

This extended retention period recognizes two important legal realities. First, minors cannot bring legal actions on their own behalf. Second, Indiana's medical malpractice statute of limitations under IC 34-18-7-1 allows minors under the age of six to file claims until their eighth birthday. Retaining records through at least age 21 ensures documentation remains available through the period when a former minor patient could potentially bring a claim.

Practical Examples:

• A child seen at age 2 in 2026 would have records retained until at least 2045 (age 21)
• A child seen at age 16 in 2026 would have records retained until at least 2033 (7 years after service, since that extends past age 21)
• A child seen at age 10 in 2026 would have records retained until at least 2037 (age 21, since that is longer than 7 years from service)

Healthcare providers who treat pediatric patients should implement tracking systems to manage these variable retention deadlines. Many facilities use EHR systems that automatically flag records approaching their retention expiration dates.

X-Ray, Mammogram, and Imaging Record Retention

Indiana Code 16-39-7-2 establishes separate retention requirements for diagnostic imaging records.

X-Ray Films

Providers must retain x-ray films for a minimum of five years from the date they were taken. At the time the x-ray is performed, the provider is required to inform the patient in writing that the films will be kept on file for at least five years and that the patient may request a copy during that time at the provider's actual cost.

Mammogram Films

Mammogram retention requirements are more nuanced. Providers must maintain original mammogram films and reports for at least five years. However, if the provider performs no additional mammograms on the patient after the initial films, the retention period extends to ten years from the date the original films were taken.

This longer retention period for final mammograms reflects the diagnostic importance of baseline imaging for breast cancer screening. Having historical mammograms available for comparison can be critical for detecting changes over time.

Digital Imaging

Modern healthcare facilities increasingly store imaging records in digital formats such as DICOM files in Picture Archiving and Communication Systems (PACS). Indiana law permits digital storage as long as the system can produce accurate and complete reproductions of the original records. The same minimum retention periods apply regardless of storage format.

Federal Requirements: HIPAA and CMS

Indiana providers must comply with federal requirements in addition to state law. When federal and state requirements differ, the stricter standard applies.

HIPAA Documentation Requirements

Contrary to a common misconception, HIPAA does not mandate specific retention periods for medical records. According to the U.S. Department of Health and Human Services, the HIPAA Privacy Rule defers to state law on how long medical records must be retained.

However, HIPAA does require covered entities to retain HIPAA-related documentation for six years. Under 45 CFR 164.530(j), this includes privacy policies, procedures, patient authorizations, training records, complaints, and breach notifications. This is a documentation retention requirement, not a medical record retention requirement.

Because Indiana's seven-year requirement exceeds HIPAA's six-year documentation standard, Indiana providers who follow state law will automatically satisfy the HIPAA documentation timeline as well.

CMS and Medicare Requirements

Providers who participate in Medicare or Medicaid face additional federal requirements. Under 42 CFR 424.516(f), Medicare providers must maintain medical records for seven years from the date of service.

For hospitals, CMS Conditions of Participation (42 CFR 482.24) require maintaining a complete medical record for every inpatient and outpatient. Records must be accurately written, promptly completed, properly filed and retained, and accessible for authorized use.

Failure to maintain adequate medical records can result in revocation of Medicare enrollment under 42 CFR 424.535(a)(10), which would prevent the provider from billing Medicare for any services.

Indiana Medicaid similarly requires providers to maintain records for at least seven years from the date of service under 405 IAC 1-1.4-2. These records must fully describe the scope and extent of treatment provided.

Patient Access to Medical Records in Indiana

Indiana Code 16-39-1-1 grants patients the right to access their own medical records. Upon written request and reasonable notice, a provider must supply the patient with their health records.

Providers must fulfill the request within 30 days of receiving it. If the provider needs additional time, they may seek an extension of up to 30 additional days, but must notify the patient of the extension within the initial 30-day window.

Patients may request either their complete health record or only the portions relating to a specific condition. The provider must accommodate the patient's preference.

For records of minor patients, IC 16-39-1-7 grants both custodial and noncustodial parents equal access to a child's medical records, unless a court order restricts that access.

Under HIPAA's Right of Access provision (45 CFR 164.524), patients also have the right to obtain copies of their protected health information in electronic format when records are maintained electronically. Providers who deny access without a valid legal reason may face enforcement action from the HHS Office for Civil Rights.

Copying Fees for Medical Records

Indiana Code 16-39-9 sets maximum fees that providers and medical records companies may charge for copies of medical records.

Maximum Per-Page Fees:

Pages	Maximum Fee Per Page
Pages 1 through 10	$1.00
Pages 11 through 50	$0.50
Pages 51 and above	$0.25

Additional Permitted Charges:

• Labor fee: Up to $20.00 (if charged, the first 10 pages of copies are provided at no per-page cost)
• Mailing costs: Actual postage and shipping expenses
• Expedited processing: $10.00 for delivery within two business days
• Record certification: $20.00 for certified copies

The Indiana Department of Insurance has authority to adjust these fee amounts by rule. Providers should verify current rates periodically to ensure compliance.

These state fee limits apply specifically to patient requests. Providers responding to subpoenas, insurance company requests, or attorney requests may be subject to different fee structures depending on the context.

Proper Destruction of Medical Records

Once records reach the end of their required retention period, Indiana providers must still follow specific protocols for destruction to protect patient privacy.

HIPAA requires that all protected health information (PHI) be destroyed in a manner that renders it unreadable, indecipherable, and impossible to reconstruct. The HHS Office for Civil Rights recommends the following destruction methods:

For Paper Records:

• Shredding using cross-cut or micro-cut shredders
• Burning in a controlled environment
• Pulping or pulverizing

For Electronic Records:

• Clearing (overwriting data on the media)
• Purging (degaussing or using secure erase commands)
• Physical destruction (pulverizing, melting, or incinerating storage media)

Providers who use third-party destruction services must execute a HIPAA Business Associate Agreement (BAA) with the vendor before handing over any records containing PHI. The vendor must certify that destruction was completed in compliance with HIPAA standards.

Indiana providers should maintain a destruction log documenting the date of destruction, the method used, the types of records destroyed, and the name of the person or company that performed the destruction. While Indiana law does not explicitly require such a log, it serves as important evidence of compliance during any regulatory audit.

Practice Closure and Record Transfer Requirements

When a physician retires, relocates, or otherwise closes a practice, 844 IAC 5-2-16 imposes specific obligations to protect patients' access to their records.

Patient Notification

Physicians must notify all active patients of the practice closure. The regulation defines an "active patient" as someone the physician examined, treated, cared for, or consulted with during the two years before the discontinuation.

Notification must occur through one of two methods:

• Direct written notice to each active patient, or
• Publication once a week for three consecutive weeks in a newspaper of general circulation in the area where the practice is located

The notification must encourage patients to seek care from another provider and explain how patients can obtain or transfer their records.

Record Transfer Restrictions

Indiana law prohibits physicians from selling, conveying, or transferring patient records for valuable consideration. Records are not a commercial asset that can be monetized during a practice sale.

However, records may be transferred to another physician holding an unlimited license to practice medicine or osteopathic medicine who is assuming the practice. Written notice to patients must be provided when this type of transfer occurs.

Custodian Arrangements

When no successor practitioner is available, the closing physician must make reasonable arrangements for record storage and access. This often involves contracting with a medical records custodian company. Any custodian agreement must include:

• Compliance with HIPAA and state privacy and security laws
• A complete inventory of transferred records
• Description of safeguarding services and response procedures
• A term that satisfies Indiana's retention requirements
• An executed HIPAA Business Associate Agreement

Providers who fail to make adequate arrangements for patient records after closing a practice may face disciplinary action from the Indiana Medical Licensing Board and potential enforcement by the Indiana Attorney General.

Indiana's Abandoned Health Records Act

Indiana Code 4-6-14 gives the Indiana Attorney General authority to intervene when healthcare providers abandon medical records.

Under the statute, records are considered "abandoned" when a provider has voluntarily surrendered, relinquished, or disclaimed them with no intention of reclaiming possession. A 2017 amendment expanded the definition to include records that are recklessly or negligently treated such that an unauthorized person could gain access.

Attorney General's Powers

When the Attorney General determines that records have been abandoned, the AG may:

• Take possession of the abandoned records
• Store, maintain, transfer, and protect the records
• Deliver records to patients or individuals identified in them
• Destroy records after required retention periods have passed
• File a court action to recover costs from the provider who abandoned the records

The Attorney General must make reasonable efforts to notify patients whose records have been taken into state custody. The notice must explain how patients can obtain copies or have their records sent to a new treating provider.

Maintenance and Destruction Timeline

The Attorney General must maintain abandoned records for the shorter of three years from acquisition or the remaining balance of the applicable retention period under IC 16-39-7-1 (seven years for health records) or IC 16-39-7-2 (five years for x-rays and mammograms).

Financial Accountability

If a court finds that a provider intentionally or negligently abandoned records, the court may order the provider to reimburse the state for all costs incurred in securing, storing, and managing the abandoned records.

Penalties for Non-Compliance

Indiana law provides multiple enforcement mechanisms for providers who fail to maintain medical records as required.

Licensing Board Discipline: Under IC 16-39-7-1(c), a provider who violates the seven-year retention requirement commits an offense for which the applicable licensing board may impose disciplinary sanctions. These sanctions can range from a letter of reprimand to license suspension or revocation, depending on the severity and circumstances.

CMS Enrollment Revocation: Providers participating in Medicare may have their enrollment revoked under 42 CFR 424.535(a)(10) for failing to maintain required medical records. Loss of Medicare enrollment eliminates the provider's ability to bill for Medicare services.

HIPAA Enforcement: Improper destruction or disposal of records containing PHI can result in HIPAA enforcement action under 45 CFR Part 160. Civil penalties range from $100 to $50,000 per violation, with annual maximums reaching $1.5 million per violation category.

Attorney General Action: Under the Abandoned Health Records Act (IC 4-6-14), the Attorney General may take possession of abandoned records and pursue cost recovery against negligent providers.

Disaster Exception: Indiana law does provide one important exception. Under IC 16-39-7-1, a provider is immune from civil liability for destroying or failing to maintain a health record if the loss occurred in connection with a disaster emergency declared by the governor or another disaster, unless the loss resulted from the provider's own negligence.

Frequently Asked Questions

Sources and References

• Indiana Code 16-39-7-1: Maintenance of Health Records by Providers - Indiana General Assembly
• Indiana Code 16-39-7-2: Maintenance of X-Rays by Providers; Mammograms - Indiana General Assembly
• Indiana Code 16-39-1-1: Right of Access; Written Requests - Indiana General Assembly
• Indiana Code 16-39-9: Charges Permitted for Copies of Medical Records - Indiana General Assembly
• Indiana Code 4-6-14: Health Records and Identifying Information Protection - Indiana General Assembly
• Indiana Code 34-18-7-1: Medical Malpractice Statute of Limitations - Indiana General Assembly
• 410 IAC 15-1.5-4: Medical Record Services - Indiana Administrative Code
• 844 IAC 5-2-16: Discontinuance of Practice - Indiana Administrative Code
• 42 CFR 482.24: Condition of Participation: Medical Record Services - U.S. Government Publishing Office
• CMS Medical Record Maintenance and Access Requirements - Centers for Medicare and Medicaid Services
• HHS FAQ: Does HIPAA Require Record Retention? - U.S. Department of Health and Human Services
• HHS: Disposal of Protected Health Information - U.S. Department of Health and Human Services