North Carolina Medical Records Retention Laws (2026 Guide)

North Carolina hospitals must retain adult patient medical records for at least 11 years after discharge and minor patient records until the patient turns 30, under 10A NCAC 13B .3903. Nursing facilities follow a shorter rule of 5 years for adult records under 10A NCAC 13D .2402.

North Carolina has some of the most detailed medical records retention requirements in the country. The state regulates how long hospitals, nursing facilities, ambulatory surgical centers, and clinics must keep patient records. These rules are found primarily in the North Carolina Administrative Code (NCAC), enforced by the NC Division of Health Service Regulation.

If you are a healthcare provider, compliance officer, or patient trying to understand your rights, this guide breaks down every retention requirement that applies in North Carolina.

Hospital Medical Records Retention in North Carolina

The primary regulation governing hospital records in North Carolina is 10A NCAC 13B .3903, titled "Preservation of Medical Records." This rule falls under Subchapter B of the NC Medical Care Commission regulations, which covers hospital licensing.

Adult Patient Records

Hospitals must maintain medical records for a minimum of 11 years following the discharge of an adult patient. This applies whether records are stored in their original paper form, on computer media, or in digital archives.

The 11-year requirement is notably longer than many other states, and also exceeds the federal floor: the Medicare Conditions of Participation under 42 CFR 482.24 require hospitals to retain medical records in their original or legally reproduced form for a period of at least five years.

Minor Patient Records

North Carolina requires hospitals to retain records of minor patients until the patient's 30th birthday. This is the longest minor patient retention requirement in the United States.

The reason for this extended period ties directly to North Carolina's statute of limitations framework. Under N.C. Gen. Stat. 1-17(c), the general minority tolling rule is overridden for medical malpractice claims: if the ordinary limitations period would expire before the minor turns 10, the action may still be brought until the minor's 10th birthday. The retention period through age 30 provides a substantial buffer beyond that floor to account for discovery rules, delayed injury recognition, and litigation timelines.

For a patient treated at a hospital as a newborn, this means records could be retained for up to 30 years.

What Records Are Covered

The regulation applies to the complete medical record as maintained by the hospital's medical records service. This includes:

• Admission and discharge documentation
• Physician and nursing notes
• Laboratory and diagnostic test results
• Surgical and procedure reports
• Medication administration records
• Consent forms
• Patient identification information

The manager of the medical records service is responsible for ensuring compliance with these retention periods.

Physician and Private Practice Records

North Carolina does not have a specific statute that sets a mandatory retention period for physician office or private practice records. This is a notable gap compared to the detailed hospital and facility regulations.

However, the North Carolina Medical Board has issued a position statement on medical records that provides guidance. The Board states that "patient interests related to present and future healthcare needs should be a licensee's primary consideration" when deciding how long to retain records.

The Board recommends that physicians:

• Notify patients about how long records will be retained
• Give patients an opportunity to claim records or have them transferred before destruction
• Destroy records in a HIPAA-compliant manner
• Respond promptly to patient requests for access or copies

Most healthcare attorneys in North Carolina advise private practices to follow the hospital standard of 11 years for adults and until age 30 for minors. This conservative approach reduces legal exposure, particularly given the state's malpractice statute of limitations.

Nursing Facility Records

Nursing homes and skilled nursing facilities in North Carolina follow a separate regulation: 10A NCAC 13D .2402, "Preservation of Medical Records."

Retention Periods for Nursing Facilities

The 5-year period for nursing facility adult records is significantly shorter than the 11-year hospital requirement. This reflects the different risk profiles and typical patient populations of these facilities.

For minors in nursing facilities, the records must be kept until the patient's 19th birthday. For malpractice claims specifically, G.S. 1-17(c), not the general (b) tolling rule, governs and sets a floor of age 10.

Facility Closure Rules for Nursing Homes

When a nursing facility discontinues operation, the licensee must inform the NC Division of Health Service Regulation where records are stored. Records must be placed with a business offering medical record storage and retrieval services for at least 5 years after the closure date.

Ambulatory Surgical Centers and Clinics

Ambulatory surgical facilities in North Carolina are regulated under 10A NCAC 13C, and individual patient records are covered by Section .1002.

Paragraph (d) of that rule ties the retention period to "the need for their use in continuing patient care and for legal, research, or educational purposes," then sets a floor: "This length of time shall not be less than 20 years."

That 20-year floor is longer than both the 11-year hospital rule and the 5-year nursing facility rule, making it the longest of the facility retention periods covered on this page. The rule does not set a separate or longer period for records created when the patient was a minor. If an ambulatory surgical facility ceases operation, 10A NCAC 13C .1002(e) requires an arrangement for preservation of the records and written notice to the Department.

Licensed Abortion Clinics

A separate subchapter, 10A NCAC 13S, is titled "Licensure of Suitable Facilities for the Performance of Surgical Abortions." It defines a "clinic" as a freestanding facility, neither attached to nor operated by a licensed hospital, that performs abortions completed during the first 12 weeks of pregnancy (10A NCAC 13S .0101(2)), and its authority is G.S. 131E-153.5.

Rule .0321 requires the records of such a clinic to:

• Be preserved in North Carolina for not less than 10 years from the date of the most recent discharge
• Be retained until 3 years after the patient's 18th birthday (age 21) where the patient was a minor
• Be covered by a written plan for destruction of records that ensures confidentiality
• Be preserved for at least 10 years, with written notice to the Division, if the clinic ceases operation

These periods apply to licensed abortion clinics. They are not a general retention rule for non-hospital clinics in North Carolina.

Federal Requirements That Apply in North Carolina

North Carolina providers must comply with both state and federal records retention rules. Where federal law requires a longer retention period than state law, the longer period applies.

HIPAA Requirements

The HIPAA Privacy Rule does not establish a specific retention period for medical records themselves. The U.S. Department of Health and Human Services has stated clearly that "the Privacy Rule does not include medical record retention requirements" and that "state laws generally govern how long medical records are to be retained."

However, HIPAA does impose a 6-year retention requirement for compliance documentation under 45 CFR 164.530(j). Covered entities must retain their privacy policies, procedures, notices of privacy practices, disposition of complaints, and other compliance actions for 6 years from the date of creation or the date when the document was last in effect, whichever is later.

This means that while HIPAA does not tell you how long to keep a patient's chart, it does require you to keep proof of your compliance activities for at least 6 years.

CMS and Medicare Requirements

Providers participating in Medicare must meet the Conditions of Participation under 42 CFR Part 482. For medical records, 42 CFR 482.24 requires hospitals to retain records in their original or legally reproduced form for a period of at least five years, a federal floor that North Carolina's state requirements already exceed.

Additional federal retention periods include:

For a North Carolina hospital that participates in Medicare, the state's 11-year rule for adult records already exceeds the five-year floor in 42 CFR 482.24. The seven-year period in 42 CFR 424.516(f) is a narrower, separate obligation: it applies to the written and electronic documentation relating to orders, certifications, referrals, prescriptions and requests for payment for Part A or B services, items or drugs, and it binds both the provider furnishing those items and the practitioner who ordered them. It is not a blanket seven-year rule for every Part A/B provider's patient charts. Hospitals with Medicare Advantage contracts should also be aware of the 10-year requirement under Part C.

Patient Access to Medical Records in North Carolina

Patients in North Carolina have a right to access their medical records under both state and federal law.

State Law on Patient Access

Under N.C. Gen. Stat. 90-411, healthcare providers may charge a reasonable fee to cover the costs of searching, handling, copying, and mailing medical records to a patient or the patient's designated representative:

• First 25 pages: Up to $0.75 per page
• Pages 26 through 100: Up to $0.50 per page
• Pages over 100: Up to $0.25 per page
• Minimum fee: Up to $10.00 (inclusive of copying costs)

These fee caps apply to general patient and representative record requests. G.S. 90-411 expressly excludes requests made by DHHS Disability Determination Services on behalf of a Social Security or SSI disability applicant, and workers' compensation records are billed separately under the NC Industrial Commission's fee schedule (G.S. 97-26.1). HIPAA's fee limitations also apply to general patient requests.

HIPAA Right of Access

Under the HIPAA Privacy Rule at 45 CFR 164.524, patients have a right to access their protected health information maintained in a designated record set. Providers must respond to access requests within 30 days (with one 30-day extension allowed). Under HIPAA, covered entities may only charge a reasonable, cost-based fee for copies.

Hospitals participating in Medicare must also comply with the CMS Conditions of Participation, which state that patients have a right to access their current medical records in the form and format requested, within a reasonable time frame.

Records Ownership in North Carolina

Under 10A NCAC 13B .3903, medical records are the property of the hospital. They remain the property of the hospital except through a court order. This means that while patients have a right to access and obtain copies, the original records belong to the facility.

This ownership principle applies to hospital records specifically. For physician practices, the general legal principle in North Carolina is similar: the provider owns the physical record, but the patient has a right to the information contained within it.

Hospital Closure and Records Preservation

North Carolina has specific requirements for what happens to medical records when a hospital closes. Under 10A NCAC 13B .3903:

Required Steps When a Hospital Closes

1. Notify the Division: The hospital's management must inform the NC Division of Health Service Regulation where records will be stored.

2. Arrange retrieval services: Records must be placed with a business offering medical record storage and retrieval services for at least 11 years after the closure date.

3. Maintain minor records: Records of minor patients must still be retained until the patient's 30th birthday, even after closure.

4. Maintain confidentiality: Under 10A NCAC 13B .3902(e), records must be stored so as to provide protection from loss, damage and unauthorized access.

These closure requirements protect patients who may need their records for ongoing care, insurance purposes, or legal matters long after a facility has shut down.

What Happens in Practice

When hospitals close in North Carolina, they typically contract with a medical records storage and retrieval company. These companies maintain the records, respond to authorized requests for copies, and ensure HIPAA-compliant security. The NC Division of Health Service Regulation maintains information about where closed facility records are stored.

If you need records from a closed North Carolina hospital, contact the Division of Health Service Regulation at the NC Department of Health and Human Services for assistance locating your records.

Proper Destruction of Medical Records

When medical records have met their retention period in North Carolina, they may be destroyed. However, destruction must follow specific protocols to protect patient privacy.

HIPAA Destruction Standards

The HHS Office for Civil Rights requires that covered entities implement reasonable safeguards when disposing of protected health information. Acceptable methods for paper records include:

• Shredding
• Burning
• Pulping
• Pulverizing

For electronic records, acceptable methods include:

• Clearing (overwriting data on media)
• Purging (degaussing or using cryptographic erase)
• Physical destruction of the storage media

Records may never be placed in dumpsters, recycling bins, or other receptacles accessible to unauthorized persons.

North Carolina Requirements

The NC Medical Care Commission hospital rules address one step before destruction. Under 10A NCAC 13B .3903(d), the original of a digitally archived medical record may not be destroyed until the medical records department has had an opportunity to review the digital record for content. Beyond that, Section .3900 of the hospital rules does not prescribe a destruction procedure, so a facility's own records policy and the HIPAA disposal standards above govern the rest of the process.

Digital Archiving and Electronic Records

North Carolina regulations permit digital archiving of medical records. Under 10A NCAC 13B .3903, the manager of medical records may authorize digital archiving on-site or off-site, provided that:

• The facility ensures confidentiality and safekeeping of records
• Original records are not destroyed until the medical records department has had an opportunity to review the digital record for content
• Digital records are maintained for the same retention periods as original records
• Access controls comply with both state law and HIPAA

Only personnel authorized under state law and HIPAA regulations may access records, whether in paper or electronic form. Patient authorizations for record release must be maintained in the original record as authority for the disclosure.

Statute of Limitations Connection

Understanding why North Carolina sets these retention periods requires looking at the state's statute of limitations for medical malpractice.

Under N.C. Gen. Stat. 1-15(c), applying the health care provider and medical malpractice action definitions in N.C. Gen. Stat. 90-21.11:

• Medical malpractice actions must be commenced within 3 years from the last act giving rise to the cause of action
• No action may be brought more than 4 years from the last act, regardless of discovery
• For foreign objects left in the body, the limit extends to 1 year after discovery but no more than 10 years from the last act

For minors, N.C. Gen. Stat. 1-17(c) governs medical malpractice claims specifically and overrides the general age-19 tolling rule in subsection (b). If the normal limitation period would otherwise expire before the minor turns 10, the action may still be brought until the minor's 10th birthday, with narrow extensions only where abuse, neglect, or state custody is involved.

The 11-year hospital retention period and the age-30 minor retention period both provide comfortable margins beyond these limitation periods. Records remain available not just for the duration of potential legal exposure but for years afterward.

Summary of North Carolina Medical Records Retention Periods

Frequently Asked Questions

How long do hospitals in North Carolina have to keep medical records?

North Carolina hospitals must retain adult patient medical records for a minimum of 11 years after discharge under 10A NCAC 13B .3903. For patients who were minors at the time of treatment, records must be kept until the patient turns 30. These are among the longest retention requirements in the country.

Can I get my medical records from a hospital that closed in North Carolina?

Yes. When a hospital closes in North Carolina, it is required to store records with a retrieval service provider for at least 11 years after the closure date. The hospital must notify the NC Division of Health Service Regulation where records are stored. Contact the Division or the NC Department of Health and Human Services for help locating your records.

Does HIPAA require medical records to be kept for a certain number of years?

No. The HIPAA Privacy Rule does not set a retention period for medical records. The U.S. Department of Health and Human Services has confirmed that state laws govern medical records retention. However, HIPAA does require covered entities to retain compliance documentation (policies, procedures, complaint records) for 6 years under 45 CFR 164.530(j).

How long must North Carolina physicians keep patient records?

North Carolina does not have a specific statute setting a mandatory retention period for private physician practices. The North Carolina Medical Board recommends that physicians prioritize patient healthcare needs when deciding retention periods. Most healthcare attorneys advise following the hospital standard of 11 years for adults and until age 30 for minors to minimize legal risk.

What are the rules for destroying medical records in North Carolina?

Medical records that have met their required retention period may be destroyed using HIPAA-compliant methods such as shredding, burning, pulping, or pulverizing for paper records, and clearing, purging, or physical destruction for electronic media. Under 10A NCAC 13B .3903(d), a hospital may not destroy the original of a digitally archived record until the medical records department has had an opportunity to review the digital record for content. The hospital rules in Section .3900 do not add a public notice step before destruction.