Nebraska Medical Records Retention Laws (2026 Guide)

Nebraska hospitals and other licensed health care facilities must retain patient records for at least 7 years from each service date under 175 NAC Chapter 1, Section 008.03, while Medicaid providers must keep records for 5 years under 471 NAC 10-008.01(B). Private physician offices face no general state retention period; Neb. Rev. Stat. 71-8403(4) explicitly exempts them from any mandatory holding requirement.

Why Nebraska Is Different From Most States

Nebraska stands out among all 50 states for one reason that surprises many patients and providers alike: the state has no general mandatory retention period for medical records held by private physicians and clinics.

Most states set a clear statutory minimum. Some require 7 years, others require 10. Nebraska does not follow that approach. Instead, Neb. Rev. Stat. 71-8403(4) states plainly that the medical records access law "does not require the retention of records or impose liability for the destruction of records in the ordinary course of business prior to receipt of a request."

That language means a private practice physician in Nebraska has no state-level statute telling them exactly how many years they must hold onto your chart. The gap creates real consequences for patients who wait years before requesting old records. It also puts the burden on providers to look beyond state law for guidance.

This article breaks down what rules do exist, where federal requirements fill the gap, and what patients and providers should know to protect themselves.

What the Nebraska Statutes Actually Say

Nebraska's medical records laws are found in Neb. Rev. Stat. 71-8401 through 71-8407. These sections deal primarily with patient access rights, not retention periods.

Legislative Purpose (71-8401)

The Nebraska Legislature recognized that medical records "contain personal and sensitive information that if improperly used or released may do significant harm to a patient's interests." The law was designed to let patients access their own records so they can make informed health care decisions.

Patient Access Rights (71-8403)

Under Section 71-8403, patients may request copies of their medical records or ask to examine them in person. Key rules include:

• Copies must be provided within 30 days of a written request
• Examination access must be offered within 10 days, during regular business hours
• If records cannot be produced within 10 days, the provider must explain the delay and make them available within 21 days
• Written authorization is required for all requests
• Authorizations without expiration dates expire 12 months after they are signed

Mental health records may be withheld if a treating physician, psychologist, or mental health practitioner determines that release "would not be in the best interest of the patient," unless a court orders release.

The Critical Gap (71-8403(4))

Subsection (4) of the same statute creates the retention gap. It specifically states that the law does not require providers to keep records or create liability for destroying records "in the ordinary course of business" before a patient requests them. Once a request is received, the provider must respond. But nothing in the statute forces a specific holding period before that request arrives.

Copy Fees (71-8404)

When you request copies, Nebraska law caps what providers can charge under Neb. Rev. Stat. 71-8404:

• Handling fee: Up to $20
• Per-page copying fee: Up to $0.50 per page
• Special records (such as X-rays): Reasonable cost of duplication, including labor and materials

Fee Exemptions for Disability and Benefits (71-8405)

Under Section 71-8405, providers may not charge any copying or handling fees when a patient requests records to support:

• Social Security Disability Insurance (SSDI) applications or appeals
• Supplemental Security Income (SSI) applications or appeals
• Medicare benefits applications or appeals
• Medicaid applications or appeals
• Applications for state assistance for certain children

The request must include official documentation from the relevant agency confirming the application or appeal.

Hospital Retention Requirements Under State Regulation

While Nebraska statute does not set a general retention period for physicians, the state's administrative code does impose a specific requirement on licensed hospitals and other Title 175 facilities.

175 NAC Chapter 1, Section 008.03: Retention and Preservation

Under 175 Nebraska Administrative Code Chapter 1, Section 008.03, licensed hospitals in Nebraska must retain patient records for a minimum of 7 years beginning with each service date. Section 001 of that chapter sets its reach: it governs credentials issued to the health care facilities and health care services set out in Neb. Rev. Stat. 71-401 to 71-475, except for assisted-living facilities and pharmacies. Hospitals fall inside that scope, and the rule is enforced by the Nebraska Department of Health and Human Services as part of facility licensing. Nebraska's hospital-specific regulations (175 NAC Chapter 9) do not set a separate retention period, so hospitals fall under this general 7-year rule.

Minor Patient Records at Hospitals

Nebraska's general facility retention rule (175 NAC Ch. 1, Section 008.03) does not include a longer period for minor patients; hospital records for minors are subject to the same 7-year-from-service-date minimum as adult records.

Nebraska's age of majority is 19 under Neb. Rev. Stat. 43-2101, which states that "all persons under nineteen years of age are declared to be minors." Because Nebraska has no rule extending hospital retention based on that age, providers who want to protect against a future claim involving a minor patient typically look to the medical malpractice statute of limitations discussed below rather than to a records-retention rule.

Medicaid Provider Requirements

471 NAC 10-008: Medicaid Records

Providers participating in Nebraska's Medicaid program must follow 471 Nebraska Administrative Code Chapter 10, Section 008. This regulation requires:

• Medical records must be retained in their original or legally reproduced form for a minimum of 5 years
• Hospitals must maintain coding and indexing systems that allow retrieval by diagnosis and procedure
• Records must be "accurately written, promptly completed, properly filed and retained, and accessible"

This 5-year minimum applies specifically to Medicaid-enrolled providers and is enforced as a condition of Medicaid participation.

Federal Requirements That Fill the Gap

Because Nebraska lacks a blanket state retention period for private practices, federal rules become especially important. Three federal frameworks apply to most Nebraska health care providers.

HIPAA (Health Insurance Portability and Accountability Act)

The HIPAA Privacy Rule does not require covered entities to retain medical records for any specific period. The U.S. Department of Health and Human Services has stated this directly: "The HIPAA Privacy Rule does not include medical record retention requirements."

However, HIPAA does require that covered entities:

• Maintain HIPAA compliance documentation for at least 6 years after its creation or its last effective date
• Apply administrative, technical, and physical safeguards to protect health information for as long as it is maintained, including during disposal
• Implement policies for final disposition of electronic protected health information and the hardware it is stored on

So while HIPAA does not tell a Nebraska doctor how long to keep your chart, it does require safeguards on that chart for every day it exists.

CMS and Medicare Requirements

The Centers for Medicare and Medicaid Services (CMS) imposes retention requirements as conditions of participation in Medicare. These vary by provider type:

• Hospitals: Must retain records for at least 5 years under 42 CFR 482.24 (note: Nebraska's state regulation of 7 years also exceeds this federal minimum)
• Physicians and eligible professionals who order, certify, refer, or prescribe: Under 42 CFR 424.516(f), a physician or, when permitted, an eligible professional who orders, certifies, refers, or prescribes Part A or Part B services, items, or drugs must maintain the documentation related to those orders for 7 years from the date of service. The same 7-year duty falls on the provider or supplier that furnished the ordered service or item. CMS frames this as a documentation and access rule tied to orders, certifications, referrals, and prescriptions, not as a blanket requirement to keep every Medicare patient's full chart for 7 years.
• Hospice providers: Must retain clinical records for 6 years after patient death or discharge
• Home health agencies: Generally required to retain records for 5 years

For a Nebraska physician who orders, certifies, refers, or prescribes for Medicare patients, that 7-year rule sets a practical floor for the records behind those orders, even though state law sets no floor at all. It does not by itself reach the rest of the chart, which is why most practices adopt a single retention policy built around the longest period that applies to them.

False Claims Act Considerations

The federal False Claims Act has a 6-year statute of limitations (extendable to 10 years in some cases). Providers who destroy billing-related records too early may be unable to defend against allegations of improper billing. This creates a practical incentive to retain records for at least 6 to 10 years.

Records for Minor Patients

Nebraska's treatment of minor patient records deserves careful attention because different rules apply depending on the provider type.

Hospital Records for Minors

As noted above, Nebraska's general facility retention rule does not extend the hospital retention period for minors; hospital records must be kept for at least 7 years from each service date regardless of the patient's age at treatment.

Home Health Agency and Intermediate Care Facility Records for Minors

Home health agencies are licensed health care services under Neb. Rev. Stat. 71-417, and intermediate care facilities are named in the definition of a health care facility at Neb. Rev. Stat. 71-413. Both sit inside the range of credentials that 175 NAC Chapter 1 governs, and neither is one of that chapter's two exceptions, so the Section 008.03 rule reaches them: records for a minor patient or resident are kept for at least 7 years from each service date, the same as for an adult. Chapter 1 sets no age-of-majority extension. Providers should still check the individual 175 NAC chapter for their own license type, because a facility-specific chapter can add requirements on top of the general rule.

Private Practice Records for Minors

Because Nebraska has no general statutory retention period for private physicians, there is no state-specific rule for how long a private doctor must keep a minor's records. Best practice recommendations from medical associations suggest retaining minor patient records until at least 3 years after the patient reaches the age of majority, which would be age 22 in Nebraska.

Medical Malpractice and the Statute of Limitations

Nebraska's statute of limitations for medical malpractice is directly relevant to how long providers should keep records, even if the law does not explicitly link the two.

Under Neb. Rev. Stat. 44-2828, a medical malpractice claim must be filed within 2 years of the alleged act or omission. However, two important exceptions extend that window:

• Discovery rule: If the injury was not and could not reasonably have been discovered within 2 years, the patient has 1 year from the date of discovery to file
• Absolute repose period: No claim may be filed more than 10 years after the date the professional services were rendered, regardless of when the injury was discovered

This 10-year repose period is a strong reason for Nebraska providers to retain records for at least 10 years, even though no statute explicitly requires it for private practices. Destroying records before the malpractice window closes could leave a provider unable to defend against a claim.

Proper Destruction of Medical Records

When records have been retained long enough and a provider decides to destroy them, both state and federal rules govern how destruction must occur.

HIPAA Destruction Standards

The HIPAA Security Rule requires covered entities to implement policies and procedures for the final disposition of protected health information. Acceptable destruction methods include:

For paper records:

• Shredding
• Burning
• Pulping
• Pulverizing

The goal is to render the information "essentially unreadable, indecipherable, and otherwise cannot be reconstructed."

For electronic records:

• Clearing (overwriting with non-sensitive data)
• Purging (degaussing or using strong magnetic fields)
• Physical destruction (disintegration, melting, incinerating, or shredding the media)

What is not permitted: Providers may not dispose of records containing protected health information in dumpsters, recycling bins, or trash receptacles accessible to the public or unauthorized persons.

Using a Business Associate for Destruction

Providers may hire a third-party vendor to handle record destruction, but must sign a Business Associate Agreement (BAA) that requires the vendor to safeguard the information through the destruction process.

What Happens When a Practice Closes

When a Nebraska physician retires or closes a practice, there is no state statute that specifically dictates the procedure for transferring or storing patient records. However, several obligations still apply:

• Patients must be given reasonable notice and an opportunity to obtain their records or transfer them to a new provider
• Records that are not claimed must still be stored securely in compliance with HIPAA
• If a provider dies or becomes incapacitated, the estate or a designated custodian becomes responsible for the records
• The American Medical Association and Nebraska Medical Association both recommend at least 90 days' written notice before closing

A physician who ordered, certified, referred, or prescribed Part A or Part B services for Medicare patients must still be able to produce the documentation behind those orders for 7 years from the date of service after the practice closes. Medicaid providers must still meet the 5-year minimum.

Patient Rights and How to Access Your Records

Nebraska patients have clear statutory rights to access their medical records under Neb. Rev. Stat. 71-8401 through 71-8407.

How to Request Records

1. Submit a written request to your health care provider
2. Include your full name, date of birth, and a description of the records you need
3. Sign and date the request (authorizations without expiration dates expire after 12 months)
4. Specify whether you want copies mailed or whether you want to examine records in person

Response Timeframes

• Copies: Provider must respond within 30 days
• Examination in person: Provider must offer access within 10 days (up to 21 days if a delay is explained)

If Your Request Is Denied

If a provider refuses to release your records, you have several options:

• Ask for a written explanation of the denial
• File a complaint with the HHS Office for Civil Rights if you believe your HIPAA rights were violated
• Consult a Nebraska health care attorney about your rights under state law

HIPAA complaints must be filed within 180 days of when you became aware of the violation.

Frequently Asked Questions

How long must private doctors in Nebraska keep medical records?

Nebraska has no general state statute requiring private physicians or clinics to retain medical records for a specific period. Neb. Rev. Stat. 71-8403(4) explicitly states that the law does not require retention or impose liability for destruction in the ordinary course of business before a request is received. A physician who orders, certifies, refers, or prescribes Part A or Part B services for Medicare patients must keep the documentation behind those orders for 7 years from the date of service under 42 CFR 424.516(f), and the 10-year medical malpractice repose period under Neb. Rev. Stat. 44-2828 provides a strong practical reason to keep records for at least a decade.

How long do Nebraska hospitals keep medical records?

Nebraska hospitals must retain patient records for a minimum of 7 years from each service date under 175 Nebraska Administrative Code Chapter 1, Section 008.03. That chapter governs credentials issued to the health care facilities and services set out in Neb. Rev. Stat. 71-401 to 71-475, except assisted-living facilities and pharmacies, so hospitals are covered by it. The rule does not carve out a longer period for minor patients. Medicare conditions of participation also require hospitals to retain records for at least 5 years, but Nebraska's state regulation exceeds this minimum.

Does HIPAA require medical records to be kept for a certain number of years?

No. The HIPAA Privacy Rule does not include medical record retention requirements. HIPAA defers to state laws for retention periods. However, HIPAA does require that covered entities maintain their compliance documentation (privacy policies, complaint records, notices) for at least 6 years. HIPAA also mandates safeguards to protect health information for as long as it is maintained and during disposal.

What should Nebraska patients do if their medical records have been destroyed?

If your records were destroyed before you requested them, the provider may have no legal liability under Nebraska law since Neb. Rev. Stat. 71-8403(4) does not impose liability for destruction in the ordinary course of business. You can try contacting other providers who may have received copies, requesting records from hospitals or labs that may have separate records, or checking with your health insurer for claims data that may document your treatment history.

How much can a Nebraska provider charge for copies of medical records?

Under Neb. Rev. Stat. 71-8404, Nebraska providers may charge a maximum handling fee of $20 and a per-page copying fee of up to $0.50. Special records like X-rays may be charged at the reasonable cost of duplication. Importantly, under Neb. Rev. Stat. 71-8405, providers may not charge any fees when records are requested to support applications for Social Security Disability, SSI, Medicare, Medicaid, or certain state assistance programs.