Kansas Medical Records Retention Laws (2026 Guide)

Kansas has clear rules governing how long hospitals, physicians, and other health care providers must keep patient medical records. The primary regulations come from the Kansas Department of Health and Environment (KDHE) for hospitals and the Kansas State Board of Healing Arts (KSBHA) for physicians. Understanding these requirements is essential for providers, administrators, and patients who need access to their health care records.

This guide covers the specific retention periods for different provider types, rules for minor patients, federal requirements from HIPAA and CMS, patient access rights, record destruction procedures, and what happens when a practice closes.

Hospital Medical Records Retention in Kansas

Kansas Administrative Regulation K.A.R. 28-34-9a establishes the medical records retention requirements for hospitals licensed in the state. This regulation is administered by the Kansas Department of Health and Environment.

Standard 10-Year Retention Period

Hospitals must preserve medical records for 10 years after the date of the patient's last discharge. This applies to all patients, whether they were admitted for inpatient care, emergency treatment, or outpatient services.

The 10-year clock resets each time the patient is discharged. If a patient was discharged in 2020 and then readmitted and discharged again in 2023, the hospital must retain the complete record until at least 2033.

Extended Retention for Minor Patients

For patients who were minors at the time of treatment, the retention period is the longer of:

• 10 years after the date of last discharge, or
• One year beyond the date the minor patient reaches the age of majority

The age of majority in Kansas is 18. This means that if a child received hospital treatment at age 5 and was discharged in 2020, the standard 10-year window would end in 2030. However, that child turns 18 in 2033, so the hospital must keep the records until at least 2034 (one year past the child's 18th birthday).

In practice, hospitals should calculate both dates for every minor patient and retain the record until the later date passes.

Record Destruction Documentation

When a hospital destroys medical records after the retention period expires, K.A.R. 28-34-9a requires the hospital to maintain a summary of the destroyed records for at least 25 years. That summary must include:

• The patient's name, age, and date of birth
• Other identifying information about the patient
• The name of the nearest relative
• Names of attending practitioners
• Surgical procedures performed and their dates
• Final diagnoses

This 25-year summary requirement means that some record of the patient's hospital stay persists long after the original chart is destroyed.

Medical Records Service Organization

Kansas law requires each hospital to have a medical records service directed by a qualified professional. The director must be a Registered Health Information Administrator (RHIA) or a Registered Health Information Technician (RHIT) certified by the American Health Information Management Association (AHIMA). If a hospital cannot employ a full-time director, it may hire a part-time consultant under a written contract.

All medical record entries must be dated and authenticated by the person who made them. Verbal orders must be recorded and verified by the prescriber within 72 hours of discharge or 30 days, whichever comes first. Completed records must be filed within 30 days following the patient's discharge.

Hospital Record Ownership and Access

Under Kansas regulations, medical records are the property of the hospital. They must be treated as confidential and may only be accessed by authorized personnel and licensing agency representatives. Records cannot be removed from the hospital premises except with approval from the governing body or for litigation purposes when authorized by Kansas law or court order.

Physician Medical Records Retention in Kansas

The Kansas State Board of Healing Arts governs record retention for licensed physicians through K.A.R. 100-24-1 and K.A.R. 100-24-2.

10-Year Retention From Last Treatment

Physicians must maintain patient records for 10 years from the date of last treatment. This requirement applies to all patients, including minors and deceased individuals. There is no separate extended retention rule for minor patients in the physician context, unlike the hospital regulations.

The Kansas Medical Society confirms this 10-year requirement in its guidance on record retention.

What Physician Records Must Contain

Under K.A.R. 100-24-1, physician medical records must include:

• Terms and abbreviations comprehensible to similar licensees
• Adequate patient identification
• Dates of all professional services provided
• Pertinent information about the patient's condition
• Examinations, vital signs, and tests obtained, performed, or ordered, with findings and results
• Initial diagnosis and the patient's initial reason for seeking services
• Medications prescribed, dispensed, or administered, including quantity and strength
• Treatment performed or recommended
• Patient progress during the course of treatment
• Records received from other health care providers that formed the basis for treatment decisions

Record Storage Options for Physicians

K.A.R. 100-24-2 allows physicians to store patient records using several methods:

• Paper files maintained at the practice location
• Electronic data systems (electronic health records)
• Microfilm or similar photographic means

A physician may destroy original paper records after converting them to electronic or microfilm format, but only if the stored record can be reproduced without alteration from the original.

Physicians may also designate another entity, physician, or health care facility to maintain records on their behalf, as long as the records remain accessible and confidentiality is preserved.

Hospital vs. Physician Retention: Key Differences

While both hospitals and physicians in Kansas follow a 10-year baseline retention period, there are important differences between the two sets of regulations.

Requirement	Hospitals (K.A.R. 28-34-9a)	Physicians (K.A.R. 100-24-1/2)
Base retention period	10 years from last discharge	10 years from last treatment
Minor patient extension	1 year past age 18 (whichever is longer)	No separate minor extension
Destruction summary required	Yes, retained for 25 years	Not specified in regulation
Governing body	KDHE	KSBHA
Record ownership	Property of the hospital	Maintained by physician/designee
Clock starts from	Date of last discharge	Date of last treatment

The most significant practical difference involves minor patients. A hospital treating a newborn must keep records until the child turns 19. A physician's office treating that same newborn follows the standard 10-year rule from the date of last treatment, though many physicians choose to retain pediatric records longer as a risk management practice.

Federal Requirements That Apply in Kansas

Kansas providers must comply with both state and federal medical records requirements. When federal law sets a longer retention period, the longer period controls.

HIPAA Requirements

The Health Insurance Portability and Accountability Act (HIPAA) does not set a specific retention period for patient medical records. The U.S. Department of Health and Human Services confirms that state laws generally govern how long medical records must be retained.

However, HIPAA does require covered entities to retain HIPAA compliance documentation for six years. This includes:

• Privacy policies and procedures
• Notice of privacy practices
• Disposition of complaints
• Other actions and designations required by the Privacy Rule

HIPAA also requires that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for the entire period the information is maintained, including during disposal.

CMS and Medicare Requirements

Providers participating in Medicare must meet additional federal retention requirements set by the Centers for Medicare and Medicaid Services (CMS).

Under 42 CFR 482.24, hospitals participating in Medicare must retain medical records for at least five years. Kansas's 10-year state requirement is longer, so Kansas hospitals must follow the state rule.

For Medicare fee-for-service providers, CMS requires records to be maintained for at least seven years from the date of service. Medicare Managed Care providers (such as Medicare Advantage plans) must retain records for 10 years.

Kansas providers should follow whichever retention period is longest among state law, HIPAA documentation requirements, and CMS participation requirements. In most cases, Kansas's 10-year state requirement meets or exceeds federal minimums.

Patient Access to Medical Records in Kansas

Kansas law guarantees patients the right to access and obtain copies of their medical records. Several state statutes and federal regulations govern this right.

State Law: K.S.A. 65-6836

Under K.S.A. 65-6836, health care providers must furnish copies of medical records within 30 days of receiving a written authorization from the patient or their authorized representative.

The written authorization must include:

• The patient's identifying information
• A description of the records being requested
• The name of the person or entity designated to receive the records
• An expiration date not exceeding one year

If a provider fails to comply without just cause, the patient may pursue legal action. Courts must award costs to the prevailing party and order the records produced without charge.

A provider may withhold copies only if the provider reasonably believes that releasing the records would cause substantial harm to the patient or another person.

Copying Fees

Kansas previously set specific copying fee limits under K.S.A. 65-4971. That statute's fee schedule was repealed by the Kansas Legislature in 2011. As a result, federal HIPAA rules now govern copying fees for non-workers' compensation records.

Under HIPAA, a covered entity may charge only reasonable, cost-based fees for providing copies of medical records. Allowable charges include the cost of copying (supplies and labor) and postage if the patient requests mailed copies. Providers cannot charge search or retrieval fees when a patient requests their own records under the HIPAA right of access.

HIPAA Right of Access

Under the HIPAA Privacy Rule, patients have the right to access and obtain a copy of their protected health information maintained in a designated record set. Providers must respond within 30 days of the request (with a possible 30-day extension if they notify the patient in writing of the reasons for the delay).

Patients may request records in electronic format if the provider maintains them electronically, and the provider must accommodate the request if it is readily producible in the requested format.

Refusal to Transfer Records

It is considered unprofessional conduct under Kansas law for a physician to refuse to transfer medical records to another provider when requested by a patient or the patient's representative. Records must be copied and sent promptly. The Kansas Board of Healing Arts can take disciplinary action against providers who fail to comply.

Medical Records Destruction Requirements

When the retention period has passed and a provider decides to destroy medical records, both Kansas state law and federal HIPAA regulations impose specific requirements.

Kansas Destruction Rules for Hospitals

As noted above, Kansas hospitals must maintain a summary of destroyed records for 25 years under K.A.R. 28-34-9a. The summary must document the patient's name, identifying information, attending practitioners, surgical procedures, and final diagnoses.

HIPAA Destruction Standards

The HHS Office for Civil Rights requires that covered entities implement reasonable safeguards when disposing of protected health information (PHI).

For paper records, acceptable destruction methods include:

• Shredding (cross-cut shredding preferred)
• Burning
• Pulping
• Pulverizing

The goal is to render PHI unreadable, indecipherable, and impossible to reconstruct.

For electronic media, acceptable methods include:

• Clearing (overwriting media with non-sensitive data using certified software)
• Purging (degaussing or exposing media to a strong magnetic field)
• Physical destruction (disintegration, pulverization, melting, incinerating, or shredding the media)

Any workforce member involved in disposing of PHI or supervising others who dispose of PHI must receive training on proper disposal procedures.

Best Practices for Destruction

Providers should consider these steps before destroying records:

1. Verify that the retention period has fully expired under both state and federal law
2. Check whether any pending litigation, audit, or investigation requires the records to be preserved
3. Document the destruction process, including the date, method, and records destroyed
4. Use a HIPAA-compliant shredding service or certified electronic destruction vendor
5. Retain hospital destruction summaries for the required 25-year period

Practice Closure and Medical Records

When a physician retires, relocates, or closes a practice in Kansas, specific rules govern what must happen with patient medical records.

Board Notification Requirement

Under K.A.R. 100-24-3, a physician must notify the Kansas State Board of Healing Arts within 30 days of closing a practice. The notification must include:

• The location where patient records will be stored
• The name, address, and telephone number of the individual or entity designated to maintain the records
• The date the records are scheduled to be destroyed

Designating a Records Custodian

A physician may designate another physician, entity, or health care facility to maintain patient records after the practice closes. The Kansas Medical Society recommends developing a written agreement with the custodian that addresses storage, access, confidentiality, and the eventual destruction of records.

The designated custodian must maintain the records in a manner that allows patient access and preserves confidentiality, as required by K.A.R. 100-24-2.

Patient Notification

Although the Kansas Healing Arts Act does not specify a required notice period for patients, the Kansas Medical Society guidance recommends:

• Sending a letter to all active patients with the closing date and custodian contact information
• Placing an announcement in the local newspaper
• Providing sufficient time for patients to arrange record transfers

Additional Notifications

Beyond the Board of Healing Arts, closing physicians should also notify:

• Their professional liability carrier
• The state and county medical societies
• The Drug Enforcement Administration (DEA)
• Insurance companies
• Local hospitals and nursing facilities
• The U.S. Post Office (for mail forwarding)

Death of a Physician

When a physician dies unexpectedly, the practice's administrators or the physician's estate must still comply with K.A.R. 100-24-3. A custodian must be designated, records must be secured, and the Board must be notified. The Kansas Medical Society provides guidance for handling this situation.

Nursing Facilities and Long-Term Care

Kansas nursing homes and adult care facilities licensed under Article 39 of the Kansas Administrative Regulations must also maintain patient records. Under K.A.R. 28-39-147, adult care homes must ensure that personal and clinical records are maintained confidentially.

Facilities must obtain a signed release from the resident or the resident's legal representative before releasing records to anyone outside the facility, except when transferring the resident to another health care institution or when required by law.

Nursing facilities participating in Medicare must also comply with the CMS conditions of participation, which impose their own documentation and retention standards.

Frequently Asked Questions