Iowa Medical Records Retention Laws (2026 Guide)

Iowa law sets specific timeframes for how long physicians and hospitals must keep patient medical records. The primary rule for physicians comes from Iowa Administrative Code 653-13.7, which requires a minimum 7-year retention period from the last date of service. Hospital requirements are governed by Iowa Administrative Code 481, Chapter 51, which ties retention to the statute of limitations found in Iowa Code Chapter 614.

Understanding these rules is important whether you are a healthcare provider managing compliance, a patient trying to access old records, or an administrator handling practice transitions. This guide covers every major retention requirement in Iowa, including federal rules that overlap with state law.

Physician Medical Records Retention in Iowa

Iowa Administrative Code 653-13.7 establishes the baseline retention requirement for physicians licensed by the Iowa Board of Medicine. Under this rule, a physician must retain all medical records for at least 7 years from the last date of service for each patient.

This rule applies to all patient records that have not been appropriately transferred to another physician or healthcare entity. The 7-year period begins on the date of the patient's most recent visit or treatment, not the date the record was first created.

What Records Must Be Retained

The retention requirement covers all documentation generated during the course of patient care. This includes:

• Patient history and physical examination notes
• Diagnostic test results and lab reports
• Treatment plans and progress notes
• Prescription records and medication logs
• Referral letters and consultation reports
• Imaging studies and radiology reports
• Surgical and procedural records
• Informed consent forms
• Correspondence related to patient care

Physicians are expected to maintain these records in a manner that allows timely retrieval when needed for continuity of care, legal proceedings, or patient requests.

Records for Minor Patients

Iowa law provides extended retention periods for records of minor patients. Under Iowa Code 614.8, the statute of limitations for minors is tolled (paused) until the minor reaches the age of majority, which is 18 in Iowa.

The minor then has 1 year after turning 18 to bring a legal action. Because of this, physicians must keep medical records for minor patients for at least 1 year after the patient reaches age 18. In practice, many Iowa healthcare providers retain pediatric records until the patient turns 19 to provide a safe margin.

If the standard 7-year retention period would extend beyond the minor's 19th birthday, the longer period applies. For example, if a physician last treats a 16-year-old patient, the 7-year clock would run until the patient is 23, which is longer than the age-of-majority requirement. In that case, the physician should retain the records for 7 years.

Hospital Medical Records Retention in Iowa

Iowa hospitals are regulated under Iowa Administrative Code 481, Chapter 51, which sets licensing standards administered by the Iowa Department of Inspections, Appeals, and Licensing.

Under these rules, hospital medical records must be filed and stored in an accessible manner and retained in accordance with the statute of limitations specified in Iowa Code Chapter 614.

How the Statute of Limitations Affects Hospital Retention

Iowa Code Chapter 614 contains several provisions that directly affect how long hospitals should keep records:

Provision	Timeframe	Application
General personal injury (Iowa Code 614.1)	2 years	Standard negligence claims
Medical malpractice (Iowa Code 614.1)	2 years from discovery	From when the patient knew or should have known of the injury
Statute of repose (Iowa Code 614.1)	6 years	Absolute outer limit from the date of the act or omission
Minors (Iowa Code 614.8)	1 year after turning 18	Extended filing period for patients who were minors

Because malpractice claims can be filed up to 6 years after the incident (statute of repose), and the discovery rule may delay the start of the 2-year limitation period, most Iowa hospitals retain adult patient records for at least 7 to 10 years to account for the full range of potential legal exposure.

For records of patients treated as minors, hospitals typically retain records until at least 2 years after the patient turns 18, since the statute of repose runs from the date of the act and the minor's tolling provisions add additional time.

Hospital vs. Physician Requirements: Key Differences

While both hospitals and physicians must retain records, their governing rules differ:

• Physicians have a clear, fixed rule: 7 years from the last date of service (Iowa Admin. Code 653-13.7)
• Hospitals must retain records in accordance with the statute of limitations (Iowa Admin. Code 481-51), which creates a variable period depending on the type of claim and the patient's age at the time of treatment
• Hospitals face additional federal requirements through Medicare Conditions of Participation that physicians in private practice may not

Federal Requirements That Apply in Iowa

Iowa healthcare providers must comply with both state and federal records retention requirements. When federal and state rules overlap, the longer retention period applies.

HIPAA Documentation Requirements

The HIPAA Privacy Rule does not require covered entities to retain medical records for any specific period of time. The U.S. Department of Health and Human Services (HHS) has stated this directly.

However, HIPAA does require covered entities to retain HIPAA-related documentation for 6 years. Under 45 CFR 164.530(j), covered entities must keep the following for 6 years from the date of creation or the date when last in effect, whichever is later:

• Privacy policies and procedures
• Patient authorization forms for disclosure of protected health information (PHI)
• Notice of Privacy Practices
• Accounting of disclosures logs
• Business Associate Agreements
• Training records for workforce members
• Complaint and resolution documentation

This 6-year HIPAA documentation requirement is separate from and runs parallel to Iowa's state medical records retention rules. Providers must satisfy both.

CMS and Medicare Conditions of Participation

Hospitals that participate in Medicare must comply with the Conditions of Participation under 42 CFR 482.24. These federal regulations require that:

• Medical records be retained in their original or legally reproduced form for at least 5 years
• Records be accurately written, promptly completed, properly filed, and accessible
• The hospital maintain confidentiality procedures for all patient records
• Original records only be released pursuant to federal or state law, court orders, or subpoenas

Because Iowa's state retention requirements (7 years for physicians, statute-of-limitations-based for hospitals) generally exceed the CMS 5-year minimum, Iowa providers who follow state law will typically satisfy the CMS requirement as well. However, providers should be aware of both standards and apply the longer period.

Patient Access to Medical Records in Iowa

Iowa patients have a legal right to access and obtain copies of their medical records. This right is established under both state and federal law.

State Law: Iowa Code Chapter 135D

Under Iowa law, healthcare providers must furnish copies of a patient's health care records within 30 days of receiving a proper authorization. If records cannot be provided within that timeframe, the provider must explain why.

Iowa Code Chapter 135D sets specific limits on the fees providers may charge for copies:

Fee Component	Maximum Amount
Supplies and labor	$15
Photocopies (first 250 pages)	$0.50 per page
Photocopies (pages 251+)	$0.35 per page
Non-photocopiable records	Reasonable fee

A provider may withhold records only if the provider reasonably believes that releasing them would cause substantial harm to the patient or another person.

Federal Law: HIPAA Right of Access

Under 45 CFR 164.524, patients have the right to access and obtain a copy of their protected health information held by covered entities. HIPAA requires that providers respond to access requests within 30 days, with one 30-day extension permitted if the provider notifies the patient in writing.

HIPAA also limits the fees a provider may charge to a reasonable, cost-based amount. Where Iowa's fee schedule under Chapter 135D provides more specific protections, those state provisions control as the more protective standard.

Authorization Requirements

A valid authorization to release medical records in Iowa must include:

• The patient's name, address, and date of birth
• A description of the specific records to be released
• The name of the person or entity authorized to receive the records
• An expiration date or event for the authorization
• The patient's signature (or that of a legally authorized representative)

Providers should retain copies of all authorizations as part of their HIPAA documentation.

Medical Records Destruction in Iowa

Once the applicable retention period has expired, Iowa healthcare providers may destroy medical records. However, destruction must be carried out in a manner that protects patient privacy.

HIPAA Destruction Standards

The HIPAA Privacy Rule requires that covered entities apply appropriate safeguards when disposing of protected health information. PHI must be rendered essentially unreadable, indecipherable, and unable to be reconstructed.

Acceptable methods for destroying paper records include:

• Cross-cut shredding
• Burning or incineration
• Pulping or pulverizing

For electronic records, acceptable destruction methods include:

• Clearing (overwriting data on the media)
• Purging (degaussing or using cryptographic erasure)
• Physical destruction of the storage media (pulverizing, melting, or incinerating)

Best Practices for Iowa Providers

Iowa does not have a state-specific statute that goes beyond HIPAA for records destruction. However, providers should follow these practices:

• Document all destruction activities. Maintain a log that includes the date of destruction, a description of the records destroyed, the method used, and the name of the person who performed or supervised the destruction.
• Use a certified vendor when outsourcing. If using a third-party shredding or destruction service, execute a Business Associate Agreement (BAA) and obtain a Certificate of Destruction (COD) for your compliance files.
• Never dispose of records in regular trash or recycling. Intact paper records placed in unsecured disposal containers violate HIPAA.
• Retain destruction logs indefinitely. Even after the records themselves are destroyed, the documentation of their destruction should be kept as proof of compliance.

Practice Closure, Retirement, and Physician Death

Iowa has specific rules governing what happens to medical records when a physician closes a practice, retires, or dies. These rules are found in Iowa Administrative Code 653-13.7.

Designating a Successor

Since July 1, 2023, every Iowa-licensed physician must appoint another Iowa-licensed physician or a qualified representative to serve as the custodian of medical records in the event of the physician's death or incapacitation. The appointed successor must meet the same standards of confidentiality as the physician.

The Iowa Board of Medicine may request proof of this appointment at any time. Physicians who fail to designate a successor may face disciplinary action.

Transfer Requirements

When a physician retires, sells a practice, or otherwise ceases practicing, the following requirements apply:

1. All medical records must be transferred to another physician or entity that agrees to serve as custodian and is held to the same confidentiality standards.
2. All active patients must be notified that their records are being transferred and told the identity of the new custodian.
3. Patients must be given the option to have their records sent to a different physician of their choosing.
4. The transferring physician or representative must ensure records remain accessible and confidential throughout the transition.

What Happens When a Physician Dies Without a Plan

The Iowa Board of Medicine has noted that it receives regular inquiries from patients and families who cannot locate records after a physician dies unexpectedly or abandons a practice. In these situations, patients may contact the Iowa Board of Medicine for guidance on locating their records.

The 2023 successor designation requirement was created specifically to address this problem. Patients who cannot find their records should also check with local hospitals, health systems, or other providers who may have received transferred records.

Iowa Medical Records Retention at a Glance

The following table summarizes the key retention periods that apply to Iowa healthcare providers:

Provider Type	Retention Period	Governing Law
Physicians (adults)	7 years from last date of service	Iowa Admin. Code 653-13.7
Physicians (minors)	7 years or 1 year after patient turns 18, whichever is longer	Iowa Admin. Code 653-13.7; Iowa Code 614.8
Hospitals (adults)	Per statute of limitations (typically 7-10 years recommended)	Iowa Admin. Code 481-51; Iowa Code Ch. 614
Hospitals (minors)	Until at least 2 years after patient turns 18	Iowa Admin. Code 481-51; Iowa Code 614.8
HIPAA documentation	6 years from creation or last effective date	45 CFR 164.530(j)
Medicare-participating hospitals	At least 5 years	42 CFR 482.24

Sources and References

• Iowa Administrative Code 653, Chapter 13: Standards of Practice - Iowa Legislature
• Iowa Administrative Code 481, Chapter 51: Hospitals - Iowa Legislature
• Iowa Code Chapter 614: Limitations of Actions - Iowa Legislature
• Iowa Code 614.8: Minors and Persons with Mental Illness - Iowa Legislature
• Iowa Code Chapter 135D: Iowa Health Information Network - Iowa Legislature
• HHS FAQ: Does HIPAA Require Covered Entities to Keep Medical Records? - U.S. Department of Health and Human Services
• 45 CFR 164.530: Administrative Requirements - Legal Information Institute
• 42 CFR 482.24: Conditions of Participation: Medical Record Services - Electronic Code of Federal Regulations
• HIPAA Privacy Rule: Disposal of PHI - U.S. Department of Health and Human Services
• Iowa Board of Medicine - Iowa Department of Inspections, Appeals, and Licensing