New Hampshire Medical Records Retention Laws (2026 Guide)

New Hampshire has specific laws governing how long hospitals, physicians, and other healthcare providers must retain patient medical records. These requirements come from a combination of state administrative rules, statutes, and federal regulations.

This guide covers every major retention rule that applies in the Granite State, including the differences between hospital and physician requirements, federal standards under HIPAA and Medicare, patient access rights, record destruction rules, and what happens when a practice closes.

Last verified: March 2026. This page reflects current New Hampshire Revised Statutes Annotated, Administrative Rules He-P 802, and Board of Medicine Rules Med 501.

Hospital Medical Records Retention (He-P 802.20)

New Hampshire hospitals licensed by the Department of Health and Human Services must follow the retention rules in Administrative Rule He-P 802.20. This rule sets the baseline for how long patient records must be stored.

Adult Patient Records

Hospitals must retain patient records for a minimum of 7 years after discharge. This applies to all inpatient and outpatient records created during the course of treatment at the facility.

The 7-year clock starts on the date of the patient's last discharge, not the date of admission or the date of a specific procedure.

Minor Patient Records

For patients who are minors at the time of treatment, He-P 802.20 requires hospitals to retain records until at least 1 year after the patient reaches age 18. However, in no case may the records be kept for fewer than 7 years after discharge.

This means a hospital must calculate both timelines and use whichever period is longer. For example, if a child is treated at age 10, the hospital would need to keep the records until the child turns 19 (1 year after age 18), which is 9 years. Since that exceeds the standard 7-year minimum, the 19th birthday controls.

If a child is treated at age 16, the hospital would keep the record until age 19 (3 years). Since that is shorter than the standard 7-year requirement, the hospital must keep the record for 7 years from discharge instead.

Electronic Records

He-P 802.20 requires that electronic medical records be maintained according to current HIPAA regulations. This includes maintaining appropriate access controls, audit trails, and backup systems to protect the integrity and availability of patient information.

Hospital Closure

If a hospital ceases operation, He-P 802.20 requires the licensee to arrange for the storage of and access to medical records for the full 7-year retention period. The hospital must identify a custodian or storage facility that will maintain the records and respond to patient requests during this time.

Physician Medical Records Retention (Med 501.02)

New Hampshire physicians are regulated by the Board of Medicine through the Office of Professional Licensure and Certification (OPLC). The Board's administrative rules establish separate retention requirements for physician practices.

Standard Retention Period

Under Board of Medicine Rule Med 501.02, licensed physicians must maintain complete and accurate medical records for all patients for 7 years. Records must contain a history, examination, diagnosis, treatment plan appropriate to the physician's specialty, and documentation of all drug prescriptions.

Response to Patient Requests

A physician must honor requests made by a patient or the patient's authorized agent for copies of the patient's medical record within 30 days of the request. A physician may require written authorization before releasing medical records.

Record Content Requirements

The Board of Medicine requires that physician records include, at minimum:

• Patient history and physical examination findings
• Diagnosis and treatment plan
• Documentation of all drug prescriptions
• Progress notes
• Test results and imaging reports
• Referral information
• Informed consent documentation

Federal Requirements That Apply in New Hampshire

New Hampshire's 7-year retention period interacts with several federal rules. When state and federal requirements conflict, the stricter standard applies.

HIPAA Does Not Set a Retention Period

A common misconception is that HIPAA requires providers to keep medical records for a specific number of years. It does not. The HIPAA Privacy Rule does not include medical record retention requirements.

HIPAA does require covered entities to retain administrative documentation (privacy policies, training records, complaint logs, and business associate agreements) for 6 years from the date of creation or last effective date under 45 CFR 164.530(j). This applies to compliance paperwork, not to patient medical records.

State law determines how long actual patient records must be kept. In New Hampshire, that means 7 years.

CMS Conditions of Participation

Hospitals that participate in Medicare or Medicaid must also comply with federal retention requirements set by the Centers for Medicare and Medicaid Services (CMS).

Provider Type	Federal Minimum	Authority
Hospitals (Medicare)	5 years after discharge	42 CFR 482.24
Medicare providers (general)	7 years from date of service	CMS guidelines
Medicare Part D sponsors	10 years from date of service	CMS guidelines

Since New Hampshire state law already requires 7 years, hospitals and physicians in the state will meet the CMS hospital minimum of 5 years by default. However, general Medicare providers must still track the 7-year-from-service-date requirement independently, as it may extend beyond the state discharge-based calculation in some cases.

Which Law Controls?

The stricter requirement always wins. For a New Hampshire hospital participating in Medicare, the state 7-year rule and the federal 5-year rule overlap, but the state rule is longer and therefore controls. For physicians accepting Medicare, the federal 7-year-from-service-date rule and the state 7-year rule are roughly equivalent, though the starting points differ slightly.

Patient Access Rights Under RSA 332-I

New Hampshire RSA Chapter 332-I governs patient access to medical records. This statute establishes that patients own their medical information and have a right to obtain copies.

Who Can Request Records

Under RSA 332-I, any patient or the patient's authorized representative (called a "requestor") can request copies of medical records from any health care provider. The statute defines "health care provider" broadly to include any person, corporation, facility, or institution licensed by the state or otherwise lawfully providing health care services. This covers physicians, hospitals, clinics, dentists, nurses, pharmacists, mental health professionals, and others.

Copy Fees

RSA 332-I:1 sets maximum fees that providers may charge for record copies:

Format	Maximum Fee
Electronic copies	$50.00 for all records and related services
Paper copies (first 30 pages)	$15.00 flat fee or $0.50 per page, whichever is greater
Paper copies (over 30 pages)	$0.50 per page
Filmed records (x-rays, sonograms)	Reasonable cost

Providers must furnish records within the timeframe established under 45 CFR 164.524(b)(2), which is 30 days from the date of request, with one possible 30-day extension if the provider notifies the patient in writing.

Records of Deceased Patients

RSA 332-I:13 provides access to medical records for the surviving spouse or next of kin of a deceased patient, unless the deceased specifically indicated or a court ordered that those individuals should not have access.

Where there is no estate administration, the requestor must provide:

• A notarized affidavit confirming authorization to access the records
• A HIPAA-compliant authorization form
• A copy of the death certificate

Next of kin is defined in order of priority: surviving spouse first, then adult children (by blood or adoption), then parents. If two or more relatives in the same category qualify, each is considered a personal representative.

Patients' Bill of Rights (RSA 151:21)

RSA 151:21 establishes the Patients' Bill of Rights for individuals admitted to licensed health facilities. Among other protections, this statute guarantees patients the right to access their medical records and to receive copies upon request.

Record Destruction Requirements

When the retention period expires, New Hampshire providers must follow proper destruction procedures to protect patient privacy.

HIPAA Destruction Standards

The HHS Office for Civil Rights requires that protected health information be disposed of in a manner that renders it unreadable and indecipherable. Acceptable destruction methods include:

For paper records:

• Cross-cut shredding
• Burning
• Pulping
• Pulverizing

For electronic records:

• Clearing (overwriting with non-sensitive data)
• Purging (degaussing or exposing media to a strong magnetic field)
• Physical destruction (disintegration, pulverization, melting, incinerating, or shredding of media)

Simply deleting files or placing paper records in a regular trash bin does not satisfy HIPAA requirements. Providers who improperly dispose of records face civil penalties ranging from $100 to $50,000 per violation, with annual penalties capped at $1.5 million.

Documentation of Destruction

Healthcare providers should maintain a permanent destruction log that includes:

• The date records were destroyed
• A description of the records
• The method of destruction used
• A certificate of destruction from the vendor (if using a third-party service)

These destruction logs help demonstrate compliance during audits and should be kept indefinitely.

Practice Closure and Record Custody

When a physician retires or a practice closes in New Hampshire, specific obligations apply to protect patient access to their records.

Physician Notification Requirements

The New Hampshire Board of Medicine expects physicians who are closing a practice to:

• Send written notice to all active patients at least 30 days before the closure date
• Inform patients of their right to obtain copies of their records or transfer them to another provider
• Provide the name and contact information of the custodian who will store records after closure
• Specify the date the practice will stop seeing patients

Appointing a Records Custodian

A physician who is closing a practice must arrange for a custodian to manage patient records for the remainder of the retention period. Options include:

• Another physician or practice that agrees to accept the records
• A hospital willing to store the records
• A commercial medical records storage company
• A professional records custodian service

The custodian must maintain the records securely, respond to patient requests for copies, and comply with all HIPAA privacy and security requirements.

Hospital Closure

As noted above, He-P 802.20 requires hospitals to arrange for 7 years of storage and access to records if the facility ceases operation. The New Hampshire Department of Health and Human Services oversees compliance with this requirement.

Retention Summary Table

Provider Type	Adult Retention	Minor Retention	Key Authority
Hospitals	7 years after discharge	1 year after age 18 (min 7 years)	He-P 802.20
Physicians	7 years	7 years	Med 501.02
Medicare hospitals	5 years after discharge	Same as adult	42 CFR 482.24
Medicare providers	7 years from date of service	Same as adult	CMS guidelines
HIPAA admin docs	6 years from creation	N/A	45 CFR 164.530(j)

Frequently Asked Questions

Sources and References