South Dakota Medical Records Retention Laws (2026 Guide)

South Dakota law requires licensed healthcare facilities to retain medical records for a minimum of 10 years from the date of service. This requirement is established under the South Dakota Administrative Rules (ARSD) and applies to hospitals, critical access hospitals, nursing facilities, and other licensed institutions.

Whether you are a healthcare provider managing compliance, a patient seeking access to your records, or a practice administrator planning for records storage, understanding South Dakota's retention framework is essential. This guide covers the state-specific rules, federal overlays from HIPAA and CMS, patient access rights, and proper destruction procedures.

South Dakota Medical Records Retention Requirements

South Dakota does not have a single overarching statute that spells out a universal retention period for all healthcare providers. Instead, the state relies on administrative rules tied to facility licensing. The primary authority comes from SDCL 34-12-13, which empowers the South Dakota Department of Health to promulgate rules necessary to protect the health and safety of patients in licensed healthcare facilities.

Hospital and Licensed Facility Requirements

Under ARSD 44:75:09:06, hospitals, specialized hospitals, and critical access hospitals must retain medical records for a minimum of 10 years from the actual visit date of service or patient care. This rule took effect on November 27, 2023.

Key details of the hospital rule include:

• The 10-year period runs from each individual visit date of service
• Later visits to the same facility do not reset or extend the retention clock for earlier records
• The rule applies to both inpatient and outpatient records
• Storage requirements are further addressed in ARSD 44:75:09:07

Nursing Facility Requirements

Nursing facilities in South Dakota follow a parallel retention rule under ARSD 44:73:09:06. This rule also mandates a 10-year minimum from the date resident care was established. The nursing facility rule took effect on November 11, 2024.

Initial, annual, and significant-change resident assessment records required by ARSD 44:73:06:10 must also be retained for the full 10-year period from the date of established resident care.

Assisted Living Centers

Assisted living centers in South Dakota operate under a shorter retention window. Under ARSD 44:70:08:05, these facilities must retain care records for a minimum of five years from the actual visit date of care. After this period, records may be destroyed, but the facility must first prepare and maintain a resident index or abstract containing the patient's name, date of birth, summary of visit dates, name of the attending or admitting physician (or physician assistant or nurse practitioner), and diagnosis.

Private Physician Practice Requirements

South Dakota's retention landscape for private physician practices is notably less defined than for licensed facilities. The state does not impose a specific statutory retention period on individual physicians or small practices operating outside the licensed facility framework.

The general guidance from the South Dakota Board of Medical and Osteopathic Examiners is that physicians should retain records for patients who are active or whose whereabouts are known to the physician. This standard is deliberately broad and can result in records being held indefinitely in some cases.

Given this ambiguity, most healthcare attorneys and professional organizations in South Dakota recommend that private physicians follow the 10-year minimum established for licensed facilities as a practical baseline. This approach provides consistency with the state's regulatory framework and offers greater legal protection in the event of a malpractice claim.

Retention Rules for Minor Patients

South Dakota provides explicit protections for the medical records of minors. Under both ARSD 44:75:09:06 (hospitals) and ARSD 44:73:09:06 (nursing facilities), records of minor patients must be retained until the minor reaches the age of majority plus an additional two years, but no less than 10 years from the actual visit date of service.

In South Dakota, the age of majority is 18 years old. This means the minimum retention period for a minor's records extends until the patient turns 20 years old.

How the Minor Rule Works in Practice

Patient Age at Visit	Minimum Retention (10-Year Rule)	Minimum Retention (Age of Majority + 2)	Required Retention Period
Newborn (age 0)	10 years after visit	Until age 20	Until age 20 (longer)
5 years old	10 years after visit	Until age 20	Until age 20 (longer)
10 years old	10 years after visit (age 20)	Until age 20	Until age 20 (equal)
14 years old	10 years after visit (age 24)	Until age 20	Until age 24 (10-year rule is longer)
17 years old	10 years after visit (age 27)	Until age 20	Until age 27 (10-year rule is longer)

The practical effect is that for children treated before age 10, the age-of-majority-plus-two rule extends the retention period beyond the standard 10 years. For children treated at age 10 or older, the 10-year rule provides the longer retention window.

Federal Requirements That Affect South Dakota Providers

South Dakota's state rules do not operate in isolation. Federal regulations from HIPAA and CMS create additional obligations that healthcare providers must follow alongside state law.

HIPAA Requirements

The HIPAA Privacy Rule does not establish a specific retention period for medical records. According to the U.S. Department of Health and Human Services, state laws govern how long medical records must be retained.

However, HIPAA does require covered entities to maintain certain administrative documentation for six years. Under 45 CFR 164.530(j), covered entities must retain the following for six years from the date of creation or the date when the document was last in effect, whichever is later:

• Privacy policies and procedures
• Privacy practices notices
• Disposition of complaints
• Other actions, activities, and designations required to be documented under the Privacy Rule

This six-year requirement applies to HIPAA compliance documentation, not to patient medical records themselves.

CMS and Medicare Requirements

Healthcare providers that participate in Medicare must comply with the Conditions of Participation (CoPs) established by the Centers for Medicare and Medicaid Services.

Under 42 CFR 482.24, hospitals must retain medical records in their original or legally reproduced form for a minimum of five years. Key CMS requirements include:

• Medical records must be maintained for each inpatient and outpatient
• Records must be accurately written, promptly completed, properly filed and retained, and accessible
• The hospital must have procedures ensuring the confidentiality of patient records
• Original medical records may only be released in accordance with federal or state laws, court orders, or subpoenas

Because South Dakota's 10-year state requirement exceeds the federal five-year CMS minimum, South Dakota providers must follow the longer state standard of 10 years.

South Dakota Medicaid Requirements

Providers who bill South Dakota Medicaid face additional record-keeping obligations. Under the South Dakota Medicaid Billing and Policy Manual, providers must retain medical and financial records for at least five years from the date of the last service provided to a beneficiary, in accordance with ARSD 67:16:34.

For home health agencies specifically, ARSD 67:16:05:06.01 requires records to be retained for six years and made available upon request to the state department, the Medicaid fraud control unit of the Attorney General's Office, and representatives of the U.S. Department of Health and Human Services.

Patient Access to Medical Records in South Dakota

South Dakota law establishes clear rights for patients to access their medical records.

Right to Copies

Under SDCL 36-2-16, any licensee of the healing arts must provide copies of all medical records, reports, and X-rays pertinent to the patient's health upon receipt of a written request signed by the patient or the patient's designee.

A violation of this requirement is classified as a Class 2 misdemeanor under South Dakota law.

Copy Fees

South Dakota law permits providers to charge reasonable fees for medical record copies:

• Providers may require the patient to pay the actual reproduction and mailing expense before delivering copies (SDCL 36-2-16)
• For printed copies of X-rays, MRIs, or other medical imaging, the fee may not exceed $10 (SDCL 36-2-16.4)
• For electronic copies of imaging, the fee may not exceed $15 (SDCL 36-2-16.4)
• Providers may also charge the cost of postage, shipping, and applicable tax

Exceptions for Indigent Patients

South Dakota requires hospitals to provide medical records at no charge for indigent patients who need records to support a claim or appeal under any provision of the Social Security Act. The request must be accompanied by a copy of a recent application for or decision denying Social Security benefits. Patients represented by legal aid organizations or attorneys participating in an affiliated pro bono program are presumed indigent.

HIPAA Access Rights

In addition to state law, the HIPAA Privacy Rule grants patients the right to access and obtain copies of their protected health information maintained by covered entities. Under federal law, covered entities must respond to access requests within 30 days (with a possible 30-day extension).

Proper Destruction of Medical Records

Once the retention period has been satisfied, South Dakota providers may destroy medical records, but they must follow specific procedures.

State Requirements for Destruction

Under ARSD 44:70:08:05, before destroying records, a facility must prepare and maintain a permanent resident index or abstract containing:

• Patient name
• Date of birth
• Summary of visit dates
• Name of attending or admitting physician, physician assistant, or nurse practitioner
• Diagnosis

The facility must destroy the care record in a way that maintains confidentiality.

HIPAA Destruction Standards

The HIPAA Privacy Rule requires covered entities to implement reasonable safeguards when disposing of protected health information. The HIPAA Security Rule further requires policies addressing the final disposition of electronic PHI and the hardware or electronic media on which it is stored.

Acceptable methods of destruction include:

Paper Records:

• Cross-cut shredding
• Burning
• Pulping
• Pulverizing

The goal is to render PHI "essentially unreadable, indecipherable, and otherwise cannot be reconstructed."

Electronic Records:

• Clearing (overwriting media with non-sensitive data using certified software)
• Purging (degaussing or exposing media to a strong magnetic field)
• Physical destruction (disintegration, pulverization, melting, incinerating, or shredding the media)

Covered entities may hire a business associate to handle record destruction, but a proper Business Associate Agreement must be in place.

Best Practices for Destruction

Healthcare providers in South Dakota should follow these steps when destroying records:

1. Verify that the applicable retention period has fully expired
2. Confirm no pending litigation, audits, or investigations require the records
3. Create the required permanent index or abstract before destruction
4. Maintain a destruction log documenting the patient name, record identifier, date of destruction, and the name of the person performing or witnessing the destruction
5. Use a certified destruction vendor or verified in-house methods
6. Retain the destruction log permanently

Practice Closure and Transfer of Ownership

South Dakota administrative rules address what must happen to medical records when a healthcare facility closes or changes ownership.

Closure Requirements

Under ARSD 44:73:09:09 (nursing facilities) and the parallel provisions for hospitals, facilities must take the following steps:

• Notify the South Dakota Department of Health in writing at least 60 days before closure
• Include provisions for the safe preservation of medical records and the records' location
• Publish notice in the nearest legal newspaper or on the facility's website describing the location and disposition arrangements for medical records

Options for Record Disposition

When a facility closes, it may handle records through any of these methods:

• Transfer to another facility of the same licensure classification for continued storage
• Transfer to another provider at the request of the patient or the patient's legal representative
• Release records directly to the patient or the patient's legal representative
• Arrange secure third-party storage with a vendor who provides secure storage of healthcare records

Transfer of Ownership

If ownership of a facility is transferred to a new owner, the new owner must maintain the medical records in accordance with all applicable retention rules. The transfer of ownership does not reset or shorten the required retention periods.

Interaction with the Statute of Limitations

South Dakota's medical malpractice statute of limitations is an important consideration for record retention planning. Under SDCL 15-2-14.1, a medical malpractice action must be filed within two years from the date the alleged malpractice occurred.

South Dakota applies an occurrence rule rather than a discovery rule. The clock starts running on the date the error was committed, not the date the patient discovered the injury. The South Dakota Supreme Court has consistently upheld this interpretation.

This two-year limitation period is well within the 10-year record retention window. However, providers should be aware that tolling exceptions exist for cases involving fraudulent concealment or continuing treatment, which could extend the filing deadline.

Given these potential extensions, the 10-year retention period provides a substantial safety margin for malpractice defense purposes.

Summary Table: South Dakota Retention Periods by Provider Type

Provider Type	Minimum Retention Period	Authority
Hospitals and critical access hospitals	10 years from date of service	ARSD 44:75:09:06
Nursing facilities	10 years from date of established care	ARSD 44:73:09:06
Assisted living centers	5 years from date of care	ARSD 44:70:08:05
Private physician practices	No specific statute (10-year best practice)	Guidance from SDBMOE
Minor patient records (hospitals/nursing)	10 years or until age 20, whichever is longer	ARSD 44:75:09:06, ARSD 44:73:09:06
Medicaid providers	5 years from last service date	ARSD 67:16:34
Home health agencies (Medicaid)	6 years	ARSD 67:16:05:06.01
Medicare hospitals (federal)	5 years (state law supersedes)	42 CFR 482.24
HIPAA compliance documents	6 years from creation or last effective date	45 CFR 164.530(j)

Sources and References

• ARSD 44:75:09:06 - Retention of medical records (Hospitals)
• ARSD 44:73:09:06 - Retention of medical records (Nursing Facilities)
• ARSD 44:70:08:05 - Destruction of care records (Assisted Living)
• ARSD 67:16:05:06.01 - Medical records (Home Health Medicaid)
• SDCL 34-12-13 - Rules to protect patients' health and safety
• SDCL 36-2-16 - Medical records released to patient or designee on request
• SDCL 15-2-14.1 - Statute of limitations for medical malpractice
• HHS - Does HIPAA require covered entities to keep medical records?
• HHS - HIPAA Privacy Rule Summary
• 42 CFR 482.24 - Conditions of Participation: Medical Record Services
• South Dakota Medicaid Billing Manual - Documentation and Records
• South Dakota Department of Health - Statutes and Rules
• South Dakota Board of Medical and Osteopathic Examiners