Missouri Medical Records Retention Laws (2026 Guide)

Missouri medical records retention laws establish specific timeframes that hospitals, physicians, and other healthcare providers must follow when storing patient health information. These rules come from multiple sources, including Missouri state statutes, the Missouri Code of State Regulations, and federal requirements under CMS and HIPAA.

This guide breaks down every requirement by provider type, explains your rights as a patient, and covers what happens when records must be destroyed or a practice closes.

Last verified: March 2026. This page reflects current Missouri Revised Statutes and applicable federal regulations.

Hospital Medical Records Retention in Missouri

Missouri's hospital licensing regulations require all licensed hospitals to maintain patient medical records for a minimum of 10 years. This requirement applies to every individual evaluated or treated in the hospital.

For patients who are minors, the retention period extends further. Hospitals must keep a minor patient's medical record until the patient's 20th birthday or for 10 years, whichever period is longer. This means if a child is treated at age 8, the hospital must retain that record until the child turns 20 (12 years), because that is longer than the standard 10-year minimum.

Storage and Security Requirements

Hospital medical records must be maintained to safeguard against loss, defacement, unauthorized access, and tampering. They must also be protected from fire and water damage. Missouri law permits hospitals to preserve records in the original paper format, on microfilm, or through other electronic media.

Hospitals may also extend their preservation of medical records beyond the minimum period for clinical, educational, statistical, or administrative purposes.

What Hospital Records Must Contain

Missouri regulations require hospital medical records to include information that identifies the patient along with complete clinical information. At a minimum, records must document:

• Patient identification details
• Medical history and physical examination findings
• Admitting diagnosis
• Results of consultations
• Complications that occurred during treatment
• Informed consent documentation
• Practitioner orders
• Treatment reports and progress notes
• Medication records
• Laboratory and diagnostic test results
• Discharge summaries with final diagnoses

The discharge summary must be completed within 30 days after discharge.

Primary Source: Missouri Secretary of State, Hospital Licensing Regulations

Physician Medical Records Retention in Missouri

Under RSMo 334.097, licensed physicians in Missouri must retain patient records for a minimum of 7 years from the date the last professional service was provided. This applies to all patient records that remain under the care, custody, and control of the licensee or the licensee's designee.

The 7-year clock resets each time a physician provides a service to that patient. If a patient last visited in January 2020, the physician must keep that record at least until January 2027.

What Physician Records Must Include

RSMo 334.097 spells out the minimum documentation that adequate medical records must contain:

• Patient identification, including name, date of birth, address, and phone number
• Dates of all patient visits
• Current patient status and reason for each visit
• Relevant physical examination findings
• Diagnostic assessment and clinical impressions
• Treatment plan, including any consultations or diagnostic testing ordered
• Names and dosages of medications prescribed
• Documentation of informed consent for office procedures

Electronic Records

Physicians may maintain their records in electronic format, but those electronic records must be capable of being printed for review by the Missouri Board of Registration for the Healing Arts if requested.

Amending Records

Changes made to a medical record more than 48 hours after the final entry must be clearly marked and identified as an amendment. The amendment must include the date and time of the change, the name of the person making the modification, and the reason for the alteration.

Primary Source: RSMo 334.097, Missouri Revisor of Statutes

Long-Term Care Facility Records Retention

Missouri's long-term care facility law, RSMo 198.052, sets different retention requirements for nursing homes and residential care facilities.

Each facility must retain the medical records of each resident for 5 years after the resident leaves the facility. For residents who are minors (under age 21), the facility must keep records for 5 years after the resident reaches age 21, meaning records are retained until the former resident turns 26.

Medicare and Medicaid Override

These state timeframes do not apply when longer retention periods are required under federal Medicare or Medicaid certification standards. Facilities certified under Title XVIII (Medicare) or Title XIX (Medicaid) must follow the longer federal requirements when they exceed Missouri's minimums.

Transfer of Records

When a resident transfers to another facility, the sending facility must ensure a copy of the medical record accompanies the resident during the transfer.

Change of Ownership

If a new operator takes over a facility, the original medical records of residents must remain at the facility. The departing operator cannot remove patient records when leaving.

Financial Records

In addition to medical records, long-term care facilities in Missouri must retain all financial information, data, and records relating to the operation and reimbursement of the facility for at least 7 years.

Primary Source: RSMo 198.052, Missouri Revisor of Statutes

Federal Requirements That Apply in Missouri

Missouri providers must also comply with federal medical records retention rules when they participate in Medicare, Medicaid, or handle protected health information under HIPAA.

HIPAA Documentation Requirements

A common misconception is that HIPAA requires providers to keep patient medical records for a specific number of years. HIPAA does not set a retention period for patient medical records. State law controls how long the actual patient records must be kept.

What HIPAA does require is that covered entities retain HIPAA-related administrative documentation for 6 years from the date of creation or the date it was last in effect, under 45 CFR 164.530(j). This includes:

• Privacy policies and procedures
• Employee training records
• Business associate agreements
• Complaint records and disposition documentation
• Risk assessments

CMS Conditions of Participation

The Centers for Medicare and Medicaid Services (CMS) set separate federal minimums through the Conditions of Participation:

Provider Type	Minimum Retention Period	Federal Authority
Hospitals (Medicare)	5 years after discharge	42 CFR 482.24
General Medicare providers	7 years from date of service	CMS guidelines
Medicare Part D sponsors	10 years from date of service	CMS guidelines

Since Missouri's 10-year hospital retention requirement exceeds the federal 5-year minimum, Missouri hospitals must follow the state's longer timeframe.

Missouri Medicaid (MO HealthNet)

MO HealthNet providers must retain fiscal and medical records that document services billed to Missouri Medicaid for 6 years from the date of service. Nursing homes, CSTAR programs, and Community Psychiatric Rehabilitation Programs must retain records for 7 years.

This obligation continues even if the provider stops participating in MO HealthNet, changes ownership, or changes management. Failure to maintain adequate documentation can result in recovery of payments and sanctions.

Which Law Controls?

The stricter requirement always applies. Missouri's 10-year hospital requirement overrides the federal 5-year CMS minimum. For physicians, the state's 7-year requirement matches the general CMS guideline, so both are satisfied simultaneously.

Patient Access to Medical Records in Missouri

Under RSMo 191.227, all physicians, chiropractors, hospitals, dentists, and other licensed practitioners in Missouri must furnish copies of a patient's health records upon written request from the patient, a guardian, or a legally authorized representative.

Timeline

Providers must furnish records within a reasonable time after receiving the written request. Missouri law does not define a specific number of days, but HIPAA provides a backstop: covered entities must respond within 30 days of a request, with one possible 30-day extension.

Fees Providers May Charge

Missouri law permits providers to charge the following fees (adjusted annually based on the medical care component of the Consumer Price Index, effective February 1 of each year):

Fee Type	Maximum Amount
Search and retrieval	Up to $24.85
Copying (per page)	$0.57
Off-site storage retrieval	Up to $23.26
Electronic delivery (total cap)	$108.88
Postage	Actual cost
Notarization (if requested)	Up to $2.00

These are the maximum amounts. Providers cannot charge more than these limits.

Records of Deceased Patients

For deceased patients, records may be released to the executor or administrator of the estate, or to a person acting under a valid power of attorney. When no estate representative has been appointed, Missouri law establishes a priority order:

1. Surviving spouse
2. Adult children
3. Parents
4. Siblings
5. Guardians or guardians ad litem of minor children

Each must submit an affidavit to obtain the records.

Liability Protection

Providers who release records in good faith under RSMo 191.227 are not liable to the patient or any other person for consequences resulting from the disclosure.

Primary Source: RSMo 191.227, Missouri Revisor of Statutes

Destruction of Medical Records

Missouri does not prescribe a single mandatory method for destroying medical records, but both state and federal guidelines require that records containing protected health information be rendered unreadable and unrecoverable.

Paper Records

HHS guidance on disposal of protected health information requires that paper records be destroyed using methods such as:

• Shredding
• Burning
• Pulping
• Pulverizing

The key standard is that the information must be rendered essentially unreadable, indecipherable, and otherwise unable to be reconstructed.

Electronic Records

Electronic media containing protected health information must be cleared, purged, or physically destroyed. Acceptable methods include:

• Clearing (overwriting with non-sensitive data using approved software)
• Purging (degaussing or exposing media to a strong magnetic field)
• Physical destruction (disintegration, pulverization, melting, incinerating, or shredding the media)

Security During Disposal

Records scheduled for destruction must remain secured against unauthorized access until the destruction process is complete. The Missouri Secretary of State's retention schedules specify that record series marked for secure destruction contain confidential data and must be destroyed under the supervision of a designated competent person.

Practice Closure and Record Transfer

When a healthcare provider closes their practice in Missouri, specific rules govern what happens to patient records.

Hospital Closure

If a hospital ceases to be licensed, it must make arrangements for the disposition of patient medical records with one of the following:

• A nearby hospital
• The patients' treating physicians
• A reliable storage company

The hospital must notify the Missouri Department of Health and Senior Services about the disposition plan for the records.

Physician Retirement or Practice Closure

Under RSMo 334.097, physicians must maintain records for 7 years from the last service date, regardless of whether the practice remains open. When a physician retires, dies, or closes their practice, the records must still be preserved for the full retention period.

Best practices recommended by the Missouri Board of Registration for the Healing Arts include:

• Notifying patients in advance so they can request record transfers
• Publishing a notice in a local newspaper of general circulation
• Arranging for a custodian physician or secure storage facility to hold records
• Filing a retirement affidavit with the Board, as referenced under RSMo 334.410
• Keeping records accessible throughout the remaining retention period

Long-Term Care Facility Closure

When a long-term care facility changes operators, the original medical records must remain at the facility under the new operator's custody, per RSMo 198.052. The departing operator cannot take the records.

Retention Periods at a Glance

Provider Type	Minimum Retention Period	Minors	Authority
Hospitals	10 years	Until 20th birthday or 10 years (whichever is longer)	MO Hospital Licensing Regulations
Physicians	7 years from last service	Not specifically extended by statute	RSMo 334.097
Long-term care facilities	5 years after discharge	5 years after age 21 (until age 26)	RSMo 198.052
MO HealthNet (Medicaid)	6 years from date of service	Same	MMAC Policy
MO HealthNet (nursing homes)	7 years from date of service	Same	MMAC Policy
CMS hospitals (Medicare)	5 years after discharge	N/A	42 CFR 482.24
HIPAA admin documentation	6 years from creation	N/A	45 CFR 164.530(j)

Pharmacy Records in Missouri

Under RSMo 338.100, every licensed pharmacy in Missouri must preserve prescription records for at least 5 years. This includes the original or order of each drug or biological product that has been compounded or dispensed. Pharmacies may use a book, file, or electronic record-keeping system to meet this requirement.

Frequently Asked Questions

How long do Missouri hospitals keep medical records?

Missouri hospitals must keep patient medical records for a minimum of 10 years. For patients treated as minors, the hospital must retain records until the patient's 20th birthday or for 10 years, whichever period is longer. These requirements come from Missouri's hospital licensing regulations.

Does HIPAA require doctors to keep records for a set number of years?

No. HIPAA does not establish a retention period for patient medical records. HIPAA requires covered entities to retain administrative compliance documentation (policies, training records, business associate agreements) for 6 years. The actual retention period for patient records is determined by state law, which in Missouri means 7 years for physicians and 10 years for hospitals.

Can I get copies of my medical records in Missouri?

Yes. Under RSMo 191.227, you have the right to request copies of your medical records from any licensed healthcare provider in Missouri. Submit a written request, and the provider must furnish copies within a reasonable time. The provider may charge up to $24.85 for search and retrieval plus $0.57 per page for copies, or a maximum of $108.88 total for electronic delivery.

What happens to medical records when a Missouri doctor retires?

When a physician retires or closes their practice, the medical records must still be retained for the full 7-year period required under RSMo 334.097. The physician should notify patients, arrange for a custodian to hold the records, and file a retirement affidavit with the Missouri Board of Registration for the Healing Arts. Patients should request copies of their records before the practice closes.

How must medical records be destroyed in Missouri?

Missouri requires that medical records containing protected health information be rendered unreadable and unrecoverable. For paper records, acceptable methods include shredding, burning, pulping, or pulverizing. For electronic records, providers must use clearing, purging, or physical destruction methods. Records must remain secured until the destruction process is complete.

Sources and References

The information in this guide is drawn from Missouri state statutes, federal regulations, and official government guidance documents. Key sources include:

• RSMo 334.097 (Physician medical records requirements)
• RSMo 198.052 (Long-term care facility records)
• RSMo 191.227 (Patient access to medical records)
• RSMo 338.100 (Pharmacy records retention)
• Missouri Hospital Licensing Regulations, 19 CSR 30-20
• MO HealthNet Medicaid Record Retention Policy
• HHS HIPAA FAQ on Medical Records Retention
• 42 CFR 482.24, CMS Conditions of Participation
• 45 CFR 164.530, HIPAA Administrative Requirements
• HHS Guidance on Disposal of Protected Health Information
• Missouri Secretary of State, Records Retention Schedules