North Dakota Medical Records Retention Laws (2026 Guide)

North Dakota hospitals must retain medical records for at least 10 years from the date of last treatment under NDAC 33-07-01.1-20. For minor patients, records must be kept until the patient turns 21 or for 10 years after last treatment, whichever is later. Physicians, resident physicians, and physician assistants licensed in the state must retain all medical records for at least seven years from the last date of service under NDCC 43-17-27.2.

North Dakota has specific rules governing how long hospitals, physicians, and other healthcare providers must keep patient medical records. Two separate state authorities set the core periods: North Dakota Administrative Code (NDAC) Section 33-07-01.1-20 covers licensed hospitals, and North Dakota Century Code (NDCC) Section 43-17-27.2 covers physicians, resident physicians, and physician assistants. Federal regulations from HIPAA and CMS add additional layers that all North Dakota providers must follow.

This guide breaks down every requirement so patients, healthcare providers, and administrators can understand their obligations and rights under North Dakota law.

Hospital Medical Records Retention Requirements

North Dakota's hospital records retention rules are found in NDAC 33-07-01.1-20, which governs medical records services for licensed hospitals including general acute, primary care, and specialized facilities.

The 10-Year Retention Rule

Hospitals must preserve patient medical records for at least the tenth anniversary of the date the patient was last treated at the facility. Records may be kept in their original form or preserved through any accepted method, including microfilm, digital scanning, or electronic health record (EHR) systems.

This 10-year clock resets each time a patient receives treatment. If a patient was last seen in 2020, the hospital must retain that patient's complete medical record until at least 2030.

Records for Minor Patients

North Dakota provides extended protections for the medical records of minors. Under NDAC 33-07-01.1-20, if a patient was under 18 years of age at the time of their last treatment, the hospital must retain the record until the later of these two dates:

• The patient's 21st birthday
• 10 years from the date of the patient's last treatment

For example, if a child was last treated at age 5, the hospital must keep that record until the child turns 21 (16 years later). If a 16-year-old was last treated in 2024, the 10-year period (2034) extends beyond the 21st birthday (2029), so the record must be kept until 2034.

This extended retention period ensures that young adults can access their childhood medical history when they reach the age of majority.

Litigation Hold Requirements

Hospitals may not destroy any medical record that relates to a matter involved in active litigation, regardless of how much time has passed. If a hospital is aware that a lawsuit, claim, or legal proceeding involves a particular patient's records, those records must be preserved until the litigation is fully resolved.

This applies even if the standard 10-year retention period has expired. The litigation hold takes priority over all other timelines.

Records With Ongoing Research or Legal Value

The hospital's governing body has a responsibility to identify records that hold research, legal, or medical value beyond the standard retention period. These records must be preserved until the governing body determines they no longer serve that purpose.

This provision recognizes that some records contribute to long-term medical research, public health studies, or ongoing legal matters that extend well beyond 10 years.

Physician and Private Practice Requirements

North Dakota sets a separate statutory retention period for licensed practitioners, and it is shorter than the hospital rule. Under NDCC 43-17-27.2, a licensee must retain all medical records for at least seven years from the last date of service for each patient, unless the records are appropriately transferred to another licensee or entity, and except as otherwise required by law.

The NDAC 33-07-01.1-20 10-year rule applies to licensed hospitals. The seven-year statute applies to the individual practitioner, which is what governs an ordinary physician office, clinic, or private practice.

The Seven-Year Licensee Rule

NDCC 43-17-01 defines a licensee as a physician, resident physician, or physician assistant licensed to practice in North Dakota, including a physician assistant privileged to practice under chapter 43-17.5. The same section defines physician to include both medical doctors (M.D.) and osteopathic physicians (D.O.). The seven-year floor therefore reaches the great majority of practitioners working outside a hospital setting.

Two features of the statute matter in day-to-day practice:

• Transfer is an alternative to holding the file. The seven-year duty applies unless the records are appropriately transferred to another licensee or entity, so a practitioner who properly hands records off is not separately obliged to keep a duplicate.
• Other law can require longer. The phrase "except as otherwise required by law" preserves longer periods imposed elsewhere, including the hospital rule, CMS program requirements, and any litigation hold.

NDCC 43-17-27.2 also authorizes the North Dakota Board of Medicine to adopt rules implementing record retention and the transfer of medical records in situations where a licensee sells the medical practice, departs from the practice, or dies, becomes incapacitated, or retires. A practitioner winding down or selling a practice should check the Board's current rules in addition to the statutory floor.

Best Practice Standards

The American Medical Association (AMA) recommends that physicians retain medical records for at least 10 years from the date of last treatment. That is a best practice standard sitting above North Dakota's seven-year statutory floor, not a substitute for it. A practice that follows the AMA guidance comfortably satisfies NDCC 43-17-27.2; a practice that disposes of records at seven years still meets the statute but gives up the longer cushion.

The North Dakota Board of Medicine administers the seven-year requirement through its licensing and disciplinary authority under chapter 43-17, and the statute expressly lets the Board add rules governing what happens to records when a practice changes hands or a licensee stops practicing.

Malpractice Statute of Limitations

North Dakota's medical malpractice statute of limitations is an important consideration. Under NDCC 28-01-18, the general statute of limitations for medical malpractice actions is two years from the date the patient knew or should have known of the injury. For minors, this period may be tolled until the child reaches the age of majority.

Because malpractice claims can arise years after treatment, many legal advisers recommend that physicians in North Dakota retain records well past the seven-year minimum, and longer still for pediatric patients.

Federal Requirements That Apply in North Dakota

North Dakota healthcare providers must also comply with federal medical records requirements. These regulations create a baseline that applies in addition to state rules.

HIPAA and Medical Records Retention

Contrary to common belief, the HIPAA Privacy Rule does not establish a specific retention period for medical records. According to the U.S. Department of Health and Human Services (HHS), HIPAA defers to state laws on how long medical records must be kept.

What HIPAA does require is that covered entities maintain their privacy policies, privacy practices notices, and related compliance documentation for six years from the date of creation or the date they were last in effect, whichever is later.

HIPAA also requires that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for the entire period that the records are maintained. This means that whether a hospital keeps records for 10 years or 30 years, HIPAA protections apply for the full duration.

CMS Conditions of Participation

The Centers for Medicare and Medicaid Services (CMS) sets its own retention requirements for hospitals and providers that participate in Medicare and Medicaid programs.

Under 42 CFR 482.24, hospitals participating in Medicare must retain medical records in their original or legally reproduced form for a period of at least five years. This is shorter than North Dakota's 10-year state requirement for hospitals, so the state rule controls in practice.

For Medicare Managed Care organizations, the retention period increases to 10 years under 42 CFR 422.504. Medicare Accountable Care Organizations (ACOs) must also retain records for 10 years under 42 CFR 425.314.

In North Dakota, hospitals that accept Medicare patients must meet both the CMS five-year minimum and the state's 10-year requirement. Because the state period is longer, North Dakota hospitals effectively operate under a 10-year minimum.

Patient Access to Medical Records

North Dakota law provides patients with the right to access and obtain copies of their medical records. What the provider may charge depends on where the records are going.

Free Copies When Transferring Your Care

NDCC 23-12-14(1) requires a health care provider, on the request of the patient or any person the patient authorizes, to provide a free copy of the patient's health care records to a health care provider the patient designates, when the records are requested for the purpose of transferring that patient's health care to another provider for the continuation of treatment.

That covers the most common real-world request: moving to a new doctor and having your file follow you. The statute defines health care provider for this purpose as a licensed individual or licensed facility providing health care services.

Fees for Other Copy Requests

Under NDCC 23-12-14, requests outside the free-transfer situation are subject to a fee schedule. Subsection 2 begins with the words "Except as provided in subsection 1," so these charges cannot be applied to a continuation-of-treatment transfer. With the patient's signed authorization, the provider must furnish medical records and any associated medical bills at no more than:

Paper or Fax Copies:

• First 25 pages: Up to $20.00 total
• Each additional page beyond 25: Up to $0.75 per page

Electronic, Digital, or Computerized Format:

• First 25 pages: Up to $30.00 total
• Each additional page beyond 25: Up to $0.25 per page

These amounts include any administration fee, retrieval fee, and postage expense, so a provider cannot add those on top of the capped charge.

HIPAA Right of Access

Under the HIPAA Privacy Rule, patients have a federal right to inspect, review, and receive a copy of their medical records and billing records held by covered entities. Providers must respond to access requests within 30 days (with a possible 30-day extension if necessary).

HIPAA requires that copies be provided in the format requested by the patient when it is readily producible. If the patient requests an electronic copy and the provider maintains electronic records, the provider must supply an electronic copy.

The fee for copies under HIPAA must be limited to the cost of labor for copying, supplies, and postage. HHS has also established a flat fee option of $6.50 per request as a safe harbor that providers may use instead of calculating actual costs.

Consent for Release

Under NDAC 33-07-01.1-20, written consent of the patient must be presented as authority for the release of medical information from hospital records. Medical records may not leave hospital premises except by court order or subpoena.

Exceptions exist for authorized healthcare personnel who need access for treatment, payment, or healthcare operations purposes as defined under HIPAA.

Medical Records Destruction Requirements

When the retention period has passed, North Dakota providers must still follow proper procedures before destroying medical records.

Hospital Closure and Records

NDAC 33-07-01.1-20 contains specific requirements for hospitals that close or discontinue operations:

1. Notify the State: The hospital must inform the North Dakota Department of Health and Human Services where its records will be stored
2. Store for 10 Years: Records must be placed in a facility that offers retrieval services for at least 10 years after the closure date
3. Public Notice Before Destruction: Before destroying records, the former hospital must provide public notice in at least two forms, including a legal notice and a display advertisement in a newspaper of general circulation in the area the hospital formerly served
4. Allow Patients to Claim Records: Former patients or their authorized representatives must be given the opportunity to claim their own records before destruction occurs

For an individual practitioner rather than a facility, the parallel authority is NDCC 43-17-27.2, which lets the North Dakota Board of Medicine set rules for transferring records when a licensee sells or leaves a practice or dies, becomes incapacitated, or retires.

HIPAA-Compliant Destruction Methods

When the time comes to destroy medical records, all North Dakota providers must follow HIPAA disposal requirements to protect patient privacy. Acceptable destruction methods include:

Paper Records:

• Cross-cut shredding
• Burning or incineration
• Pulping or pulverizing

Electronic Records:

• Clearing (overwriting data on the media)
• Purging (degaussing or using a strong magnetic field)
• Physical destruction of media through pulverization, melting, or incineration

The key standard is that protected health information must be rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed." Providers may not simply delete electronic files or place paper records in standard trash receptacles or recycling bins accessible to the public.

If using a third-party shredding or destruction service, the provider should obtain a Business Associate Agreement (BAA) and request a certificate of destruction as documentation.

Special Considerations

North Dakota Health Information Network (NDHIN)

North Dakota operates the North Dakota Health Information Network (NDHIN), a statewide health information exchange. The NDHIN allows authorized healthcare providers to electronically access patient health information across facilities.

The NDHIN operates under both HIPAA and state privacy requirements outlined in NDCC 23-12-19. Appropriate safeguards must be used to prevent unauthorized use or disclosure of protected health information transmitted through the network.

Substance Use Disorder Records

Medical records related to substance use disorder treatment receive additional federal protections under 42 CFR Part 2. These records cannot be used or disclosed without the patient's written authorization except in limited circumstances defined by federal law.

A final rule issued in 2024 updated 42 CFR Part 2 to better align it with HIPAA, with full compliance required by February 16, 2026. North Dakota providers who handle substance use disorder records must follow both the updated Part 2 regulations and standard HIPAA requirements.

Record Authentication Standards

NDAC 33-07-01.1-20 requires that all entries in a hospital medical record be authenticated by the individual who made them. Telephone and verbal orders must be reduced to writing, dated, timed, and signed within 48 hours unless the hospital has established read-back verification procedures.

Electronic signatures are permitted when a hospital adopts a policy that includes unique identifiers, confidentiality safeguards, and periodic monitoring of the electronic signature system.

Record Completion Timelines

For hospitals, the regulation requires that:

• A patient's history and physical examination must be completed within 24 hours following admission
• All medical reports must be completed within a period consistent with current medical practice and no longer than 30 days following discharge

Summary of North Dakota Retention Periods

Frequently Asked Questions

How long do hospitals in North Dakota keep medical records?

North Dakota hospitals must retain patient medical records for at least 10 years from the date of the patient's last treatment, as required by NDAC 33-07-01.1-20. For patients who were under 18 at their last visit, records must be kept until the patient turns 21 or for 10 years after last treatment, whichever date is later.

Does North Dakota have a medical records retention law for physician offices?

Yes. NDCC 43-17-27.2 requires every North Dakota licensee, meaning a physician, resident physician, or physician assistant, to retain all medical records for at least seven years from the last date of service for each patient, unless the records are appropriately transferred to another licensee or entity. Hospitals are covered separately by NDAC 33-07-01.1-20, which sets a 10-year period. The American Medical Association recommends 10 years for physicians, but that is a best practice above the seven-year statutory floor rather than a replacement for it.

How much can a North Dakota provider charge for copies of medical records?

Nothing, if the records are going to a new provider for the continuation of your treatment: NDCC 23-12-14(1) requires a free copy in that situation. For other requests, the same statute lets providers charge up to $20 for the first 25 pages in paper or fax format plus $0.75 per additional page, or up to $30 for the first 25 pages in an electronic format plus $0.25 per additional page. Those amounts include administration, retrieval, and postage costs.

What happens to medical records when a North Dakota hospital closes?

When a hospital discontinues operations, NDAC 33-07-01.1-20 requires it to notify the state health department where records are stored. Records must be maintained in a facility with retrieval services for at least 10 years after closure. Before any records are destroyed, the hospital must publish public notice and allow former patients to claim their records.

Does HIPAA require medical records to be kept for a specific number of years?

No. The HIPAA Privacy Rule does not set a minimum retention period for medical records. According to the U.S. Department of Health and Human Services, HIPAA defers to state laws on record retention. However, HIPAA does require that covered entities maintain compliance documentation (privacy policies, notices, and related records) for at least six years.