Nebraska Medical Records Retention Laws (2026 Guide)

Why Nebraska Is Different From Most States

Nebraska stands out among all 50 states for one reason that surprises many patients and providers alike: the state has no general mandatory retention period for medical records held by private physicians and clinics.

Most states set a clear statutory minimum. Some require 7 years, others require 10. Nebraska does not follow that approach. Instead, Neb. Rev. Stat. 71-8403(4) states plainly that the medical records access law "does not require the retention of records or impose liability for the destruction of records in the ordinary course of business prior to receipt of a request."

That language means a private practice physician in Nebraska has no state-level statute telling them exactly how many years they must hold onto your chart. The gap creates real consequences for patients who wait years before requesting old records. It also puts the burden on providers to look beyond state law for guidance.

This article breaks down what rules do exist, where federal requirements fill the gap, and what patients and providers should know to protect themselves.

What the Nebraska Statutes Actually Say

Nebraska's medical records laws are found in Neb. Rev. Stat. 71-8401 through 71-8407. These sections deal primarily with patient access rights, not retention periods.

Legislative Purpose (71-8401)

The Nebraska Legislature recognized that medical records "contain personal and sensitive information that if improperly used or released may do significant harm to a patient's interests." The law was designed to let patients access their own records so they can make informed health care decisions.

Patient Access Rights (71-8403)

Under Section 71-8403, patients may request copies of their medical records or ask to examine them in person. Key rules include:

• Copies must be provided within 30 days of a written request
• Examination access must be offered within 10 days, during regular business hours
• If records cannot be produced within 10 days, the provider must explain the delay and make them available within 21 days
• Written authorization is required for all requests
• Authorizations without expiration dates expire 12 months after they are signed

Mental health records may be withheld if a treating physician, psychologist, or mental health practitioner determines that release "would not be in the best interest of the patient," unless a court orders release.

The Critical Gap (71-8403(4))

Subsection (4) of the same statute creates the retention gap. It specifically states that the law does not require providers to keep records or create liability for destroying records "in the ordinary course of business" before a patient requests them. Once a request is received, the provider must respond. But nothing in the statute forces a specific holding period before that request arrives.

Copy Fees (71-8404)

When you request copies, Nebraska law caps what providers can charge under Neb. Rev. Stat. 71-8404:

• Handling fee: Up to $20
• Per-page copying fee: Up to $0.50 per page
• Special records (such as X-rays): Reasonable cost of duplication, including labor and materials

Fee Exemptions for Disability and Benefits (71-8405)

Under Section 71-8405, providers may not charge any copying or handling fees when a patient requests records to support:

• Social Security Disability Insurance (SSDI) applications or appeals
• Supplemental Security Income (SSI) applications or appeals
• Medicare benefits applications or appeals
• Medicaid applications or appeals
• Applications for state assistance for certain children

The request must include official documentation from the relevant agency confirming the application or appeal.

Hospital Retention Requirements Under State Regulation

While Nebraska statute does not set a general retention period for physicians, the state's administrative code does impose specific requirements on licensed hospitals.

175 NAC 9-006: Hospital Records

Under 175 Nebraska Administrative Code Section 9-006, licensed hospitals in Nebraska must retain medical records for at least 10 years following the patient's discharge. This is a regulatory requirement enforced by the Nebraska Department of Health and Human Services as part of hospital licensing.

Minor Patient Records at Hospitals

For patients who are minors at the time of treatment, Nebraska hospitals must keep records for 10 years after discharge or until 3 years after the patient reaches the age of majority, whichever period is longer.

Nebraska's age of majority is 19 under Neb. Rev. Stat. 43-2101, which states that "all persons under nineteen years of age are declared to be minors." This means a hospital record for a child treated at age 5 must be kept until at least age 22 (three years past age 19), while a record for a child treated at age 15 must be kept until at least age 25 (10 years after treatment).

Medicaid Provider Requirements

471 NAC 10-008: Medicaid Records

Providers participating in Nebraska's Medicaid program must follow 471 Nebraska Administrative Code Chapter 10, Section 008. This regulation requires:

• Medical records must be retained in their original or legally reproduced form for a minimum of 5 years
• Hospitals must maintain coding and indexing systems that allow retrieval by diagnosis and procedure
• Records must be "accurately written, promptly completed, properly filed and retained, and accessible"

This 5-year minimum applies specifically to Medicaid-enrolled providers and is enforced as a condition of Medicaid participation.

Federal Requirements That Fill the Gap

Because Nebraska lacks a blanket state retention period for private practices, federal rules become especially important. Three federal frameworks apply to most Nebraska health care providers.

HIPAA (Health Insurance Portability and Accountability Act)

The HIPAA Privacy Rule does not require covered entities to retain medical records for any specific period. The U.S. Department of Health and Human Services has stated this directly: "The HIPAA Privacy Rule does not include medical record retention requirements."

However, HIPAA does require that covered entities:

• Maintain HIPAA compliance documentation for at least 6 years after its creation or its last effective date
• Apply administrative, technical, and physical safeguards to protect health information for as long as it is maintained, including during disposal
• Implement policies for final disposition of electronic protected health information and the hardware it is stored on

So while HIPAA does not tell a Nebraska doctor how long to keep your chart, it does require safeguards on that chart for every day it exists.

CMS and Medicare Requirements

The Centers for Medicare and Medicaid Services (CMS) imposes retention requirements as conditions of participation in Medicare. These vary by provider type:

• Hospitals: Must retain records for at least 5 years under 42 CFR 482.24 (note: Nebraska's state regulation of 10 years exceeds this federal minimum)
• Physicians and eligible professionals: Must maintain records for 7 years from the date of service for Medicare patients
• Hospice providers: Must retain clinical records for 6 years after patient death or discharge
• Home health agencies: Generally required to retain records for 5 years

For Nebraska physicians who accept Medicare patients, the 7-year CMS requirement effectively serves as the default retention standard, even though state law does not mandate one.

False Claims Act Considerations

The federal False Claims Act has a 6-year statute of limitations (extendable to 10 years in some cases). Providers who destroy billing-related records too early may be unable to defend against allegations of improper billing. This creates a practical incentive to retain records for at least 6 to 10 years.

Records for Minor Patients

Nebraska's treatment of minor patient records deserves careful attention because different rules apply depending on the provider type.

Hospital Records for Minors

As noted above, Nebraska hospitals must keep records for 10 years after discharge or 3 years after the patient reaches age 19, whichever is longer. This means records for very young children may need to be retained for well over a decade.

Home Health Agency Records for Minors

Nebraska administrative regulations require home health agencies to retain records of minor patients for at least 5 years after the patient reaches the age of majority (age 19). A home health record for a 2-year-old patient would need to be kept until the patient turns 24.

Intermediate Care Facility Records for Minors

Intermediate care facilities must retain records for at least 5 years after the resident reaches the age of majority, or for 5 years after discharge, whichever period is longer.

Private Practice Records for Minors

Because Nebraska has no general statutory retention period for private physicians, there is no state-specific rule for how long a private doctor must keep a minor's records. Best practice recommendations from medical associations suggest retaining minor patient records until at least 3 years after the patient reaches the age of majority, which would be age 22 in Nebraska.

Medical Malpractice and the Statute of Limitations

Nebraska's statute of limitations for medical malpractice is directly relevant to how long providers should keep records, even if the law does not explicitly link the two.

Under Neb. Rev. Stat. 44-2828, a medical malpractice claim must be filed within 2 years of the alleged act or omission. However, two important exceptions extend that window:

• Discovery rule: If the injury was not and could not reasonably have been discovered within 2 years, the patient has 1 year from the date of discovery to file
• Absolute repose period: No claim may be filed more than 10 years after the date the professional services were rendered, regardless of when the injury was discovered

This 10-year repose period is a strong reason for Nebraska providers to retain records for at least 10 years, even though no statute explicitly requires it for private practices. Destroying records before the malpractice window closes could leave a provider unable to defend against a claim.

Proper Destruction of Medical Records

When records have been retained long enough and a provider decides to destroy them, both state and federal rules govern how destruction must occur.

HIPAA Destruction Standards

The HIPAA Security Rule requires covered entities to implement policies and procedures for the final disposition of protected health information. Acceptable destruction methods include:

For paper records:

• Shredding
• Burning
• Pulping
• Pulverizing

The goal is to render the information "essentially unreadable, indecipherable, and otherwise cannot be reconstructed."

For electronic records:

• Clearing (overwriting with non-sensitive data)
• Purging (degaussing or using strong magnetic fields)
• Physical destruction (disintegration, melting, incinerating, or shredding the media)

What is not permitted: Providers may not dispose of records containing protected health information in dumpsters, recycling bins, or trash receptacles accessible to the public or unauthorized persons.

Using a Business Associate for Destruction

Providers may hire a third-party vendor to handle record destruction, but must sign a Business Associate Agreement (BAA) that requires the vendor to safeguard the information through the destruction process.

What Happens When a Practice Closes

When a Nebraska physician retires or closes a practice, there is no state statute that specifically dictates the procedure for transferring or storing patient records. However, several obligations still apply:

• Patients must be given reasonable notice and an opportunity to obtain their records or transfer them to a new provider
• Records that are not claimed must still be stored securely in compliance with HIPAA
• If a provider dies or becomes incapacitated, the estate or a designated custodian becomes responsible for the records
• The American Medical Association and Nebraska Medical Association both recommend at least 90 days' written notice before closing

Providers who participate in Medicare must continue to meet the 7-year retention requirement for Medicare patient records even after closing. Medicaid providers must meet the 5-year minimum.

Patient Rights and How to Access Your Records

Nebraska patients have clear statutory rights to access their medical records under Neb. Rev. Stat. 71-8401 through 71-8407.

How to Request Records

1. Submit a written request to your health care provider
2. Include your full name, date of birth, and a description of the records you need
3. Sign and date the request (authorizations without expiration dates expire after 12 months)
4. Specify whether you want copies mailed or whether you want to examine records in person

Response Timeframes

• Copies: Provider must respond within 30 days
• Examination in person: Provider must offer access within 10 days (up to 21 days if a delay is explained)

If Your Request Is Denied

If a provider refuses to release your records, you have several options:

• Ask for a written explanation of the denial
• File a complaint with the HHS Office for Civil Rights if you believe your HIPAA rights were violated
• Consult a Nebraska health care attorney about your rights under state law

HIPAA complaints must be filed within 180 days of when you became aware of the violation.

Sources and References

• Neb. Rev. Stat. 71-8401: Legislative Findings on Medical Records
• Neb. Rev. Stat. 71-8403: Access to Medical Records
• Neb. Rev. Stat. 71-8404: Medical Record Access Charges
• Neb. Rev. Stat. 71-8405: Fee Exemptions for Disability and Benefits
• Neb. Rev. Stat. 43-2101: Age of Majority
• Neb. Rev. Stat. 44-2828: Medical Malpractice Statute of Limitations
• 175 Nebraska Administrative Code: Health Care Facilities Licensing
• 471 Nebraska Administrative Code Ch. 10 Section 008: Medicaid Medical Records
• HIPAA Privacy Rule Summary (HHS.gov)
• HIPAA Disposal of Protected Health Information (HHS.gov)
• 42 CFR 482.24: Medicare Conditions of Participation for Medical Records
• CMS Medical Record Maintenance and Access Requirements
• Filing a HIPAA Complaint (HHS.gov)