South Dakota Medical Records Retention Laws (2026 Guide)

South Dakota licensed healthcare facilities must retain medical records for a minimum of 10 years from the date of service under ARSD 44:75:09:06. Records for minor patients must be kept until the patient turns 20 or for 10 years from the visit date, whichever period is longer.

South Dakota law requires licensed healthcare facilities to retain medical records for a minimum of 10 years from the date of service. This requirement is established under the South Dakota Administrative Rules (ARSD) and applies to hospitals, critical access hospitals, nursing facilities, and other licensed institutions.

Whether you are a healthcare provider managing compliance, a patient seeking access to your records, or a practice administrator planning for records storage, understanding South Dakota's retention framework is essential. This guide covers the state-specific rules, federal overlays from HIPAA and CMS, patient access rights, and proper destruction procedures.

South Dakota Medical Records Retention Requirements

South Dakota does not have a single overarching statute that spells out a universal retention period for all healthcare providers. Instead, the state relies on administrative rules tied to facility licensing. The primary authority comes from SDCL 34-12-13, which empowers the South Dakota Department of Health to promulgate rules necessary to protect the health and safety of patients in licensed healthcare facilities.

Hospital and Licensed Facility Requirements

Under ARSD 44:75:09:06, hospitals, specialized hospitals, and critical access hospitals must retain medical records for a minimum of 10 years from the actual visit date of service or patient care. This rule took effect on November 27, 2023.

Key details of the hospital rule include:

• The 10-year period runs from each individual visit date of service
• Later visits to the same facility do not reset or extend the retention clock for earlier records
• The rule applies to both inpatient and outpatient records
• Storage requirements are further addressed in ARSD 44:75:09:07

Nursing Facility Requirements

Nursing facilities in South Dakota follow a parallel retention rule under ARSD 44:73:09:06. This rule also mandates a 10-year minimum from the date resident care was established. The nursing facility rule took effect on November 11, 2024.

Initial, annual, and significant-change resident assessment records required by ARSD 44:73:06:10 must also be retained for the full 10-year period from the date of established resident care.

Assisted Living Centers

Assisted living centers in South Dakota operate under a shorter retention window for adult records. Under ARSD 44:70:08:03, these facilities must retain care records for a minimum of five years from the actual visit date of service or resident care, and later visit dates do not affect that five-year period.

The same rule sets a much longer floor for children. Records of minors must be retained until the minor reaches the age of majority plus an additional two years, but no less than 10 years from the actual visit date of service or resident care. An assisted living center cannot destroy a minor's care record at the five-year mark.

Once the applicable period has run, records may be destroyed under ARSD 44:70:08:05, but the facility must first prepare and retain a resident index or abstract containing the name, date of birth, summary of visit dates, name of the attending or admitting physician (or physician assistant or nurse practitioner), and diagnosis.

Private Physician Practice Requirements

South Dakota's retention landscape for private physician practices is notably less defined than for licensed facilities. The state does not impose a specific statutory retention period on individual physicians or small practices operating outside the licensed facility framework.

The general guidance from the South Dakota Board of Medical and Osteopathic Examiners is that physicians should retain records for patients who are active or whose whereabouts are known to the physician. This standard is deliberately broad and can result in records being held indefinitely in some cases.

Given this ambiguity, most healthcare attorneys and professional organizations in South Dakota recommend that private physicians follow the 10-year minimum established for licensed facilities as a practical baseline. This approach provides consistency with the state's regulatory framework and offers greater legal protection in the event of a malpractice claim.

Retention Rules for Minor Patients

South Dakota provides explicit protections for the medical records of minors. Under both ARSD 44:75:09:06 (hospitals) and ARSD 44:73:09:06 (nursing facilities), records of minor patients must be retained until the minor reaches the age of majority plus an additional two years, but no less than 10 years from the actual visit date of service.

Assisted living centers are held to the same floor. Even though their general retention period is five years, ARSD 44:70:08:03 requires records of minors to be kept until the age of majority plus two years, and no less than 10 years from the visit date.

In South Dakota, the age of majority is 18 years old. This means the minimum retention period for a minor's records extends until the patient turns 20 years old.

How the Minor Rule Works in Practice

The practical effect is that for children treated before age 10, the age-of-majority-plus-two rule extends the retention period beyond the standard 10 years. For children treated at age 10 or older, the 10-year rule provides the longer retention window.

Federal Requirements That Affect South Dakota Providers

South Dakota's state rules do not operate in isolation. Federal regulations from HIPAA and CMS create additional obligations that healthcare providers must follow alongside state law.

HIPAA Requirements

The HIPAA Privacy Rule does not establish a specific retention period for medical records. According to the U.S. Department of Health and Human Services, state laws govern how long medical records must be retained.

However, HIPAA does require covered entities to maintain certain administrative documentation for six years. Under 45 CFR 164.530(j), covered entities must retain the following for six years from the date of creation or the date when the document was last in effect, whichever is later:

• Privacy policies and procedures
• Privacy practices notices
• Disposition of complaints
• Other actions, activities, and designations required to be documented under the Privacy Rule

This six-year requirement applies to HIPAA compliance documentation, not to patient medical records themselves.

CMS and Medicare Requirements

Healthcare providers that participate in Medicare must comply with the Conditions of Participation (CoPs) established by the Centers for Medicare and Medicaid Services.

Under 42 CFR 482.24, hospitals must retain medical records in their original or legally reproduced form for a minimum of five years. Key CMS requirements include:

• Medical records must be maintained for each inpatient and outpatient
• Records must be accurately written, promptly completed, properly filed and retained, and accessible
• The hospital must have procedures ensuring the confidentiality of patient records
• Original medical records may only be released in accordance with federal or state laws, court orders, or subpoenas

Because South Dakota's 10-year state requirement exceeds the federal five-year CMS minimum, South Dakota providers must follow the longer state standard of 10 years.

South Dakota Medicaid Requirements

Providers who bill South Dakota Medicaid face additional record-keeping obligations. Under the South Dakota Medicaid Billing and Policy Manual, providers must retain medical and financial records for at least five years from the date of the last service provided to a beneficiary, in accordance with ARSD 67:16:34.

For home health agencies specifically, ARSD 67:16:05:06.01 requires records to be retained for six years and made available upon request to the state department, the Medicaid fraud control unit of the Attorney General's Office, and representatives of the U.S. Department of Health and Human Services.

Patient Access to Medical Records in South Dakota

South Dakota law establishes clear rights for patients to access their medical records.

Right to Copies

South Dakota law gives patients the right to copies of their medical records under SDCL 36-2-16.2. Upon receiving a written request or a signed authorization for release, a health care provider or medical records company must provide a copy of the patient's medical record, if available, to the patient or to any person the patient has duly authorized to receive it. This provision replaced the older SDCL 36-2-16, which the legislature repealed and replaced with the current chain of sections, SDCL 36-2-16.1 through 36-2-16.8 (SL 2023, ch. 134). Patients also have federal access rights under HIPAA (see the HIPAA Access Rights section below).

Copy Fees

South Dakota law sets specific maximum fees providers and medical records companies may charge for medical record copies, under SDCL 36-2-16.4:

• For paper copies, the fee may not exceed $10 for the first 10 pages, plus $0.33 for each additional page
• For electronic copies, the fee may not exceed $0.25 per page
• For printed copies of X-rays, MRIs, or other medical imaging, the fee may not exceed $10
• For electronic copies of imaging, the fee may not exceed $15
• Providers may also charge the cost of postage, shipping, and applicable tax

If a patient directs the copy to a designee, or a third party requests the record under the patient's authorization, the provider may also charge a search fee of up to $18, regardless of whether a record is found (SDCL 36-2-16.5). A signed certification that the copy is accurate and complete may carry an additional fee of up to $10 (SDCL 36-2-16.6).

Fee Relief for Patients Who Cannot Pay

South Dakota's current medical records statutes contain no fee waiver or free-copy provision for indigent patients. The fee sections enacted in 2023, SDCL 36-2-16.4 through SDCL 36-2-16.7, set maximum charges but no exemption, and the health care facility copy provision, SDCL 34-12-15, allows a facility to require payment of the actual reproduction and mailing expense before delivering copies. The older section that previously governed medical record copies in this chapter, SDCL 36-2-16, was repealed in 2023 (SL 2023, ch. 134, section 9).

The remaining limit is federal. Under 45 CFR 164.524(c)(4), a covered entity responding to a patient's request for a copy of their own records may impose only a reasonable, cost-based fee, and that fee may include only copying labor, supplies for the paper copy or electronic media, postage when the patient asks for the records to be mailed, and preparing a summary or explanation the patient agreed to. Patients who cannot afford the charge should ask the provider directly about a reduced or waived fee, and legal aid organizations frequently request records on a client's behalf.

HIPAA Access Rights

In addition to state law, the HIPAA Privacy Rule grants patients the right to access and obtain copies of their protected health information maintained by covered entities. Under federal law, covered entities must respond to access requests within 30 days (with a possible 30-day extension).

Proper Destruction of Medical Records

Once the retention period has been satisfied, South Dakota providers may destroy medical records, but they must follow specific procedures.

State Requirements for Destruction

The index a facility has to keep before it destroys a record depends on its license type, and the required fields are not identical.

Hospitals, specialized hospitals, and critical access hospitals. Under ARSD 44:75:09:08, after the retention period in ARSD 44:75:09:06 the facility may destroy the medical record, but it must first prepare and retain a patient index or abstract containing the patient's:

• Name
• Medical record number
• Date of birth
• Summary of visit dates
• Attending or admitting physician
• Diagnosis or diagnosis code

Nursing facilities. ARSD 44:73:09:08 imposes a parallel six-field resident index: name, medical record number, date of birth, summary of care dates, attending or admitting physician (or physician assistant or nurse practitioner), and diagnosis or diagnosis code.

Assisted living centers. ARSD 44:70:08:05 requires a five-field resident index or abstract: name, date of birth, summary of visit dates, name of the attending or admitting physician (or physician assistant or nurse practitioner), and diagnosis.

Under all three rules, the facility must destroy the record in a way that maintains confidentiality.

HIPAA Destruction Standards

The HIPAA Privacy Rule requires covered entities to implement reasonable safeguards when disposing of protected health information. The HIPAA Security Rule further requires policies addressing the final disposition of electronic PHI and the hardware or electronic media on which it is stored.

Acceptable methods of destruction include:

Paper Records:

• Cross-cut shredding
• Burning
• Pulping
• Pulverizing

The goal is to render PHI "essentially unreadable, indecipherable, and otherwise cannot be reconstructed."

Electronic Records:

• Clearing (overwriting media with non-sensitive data using certified software)
• Purging (degaussing or exposing media to a strong magnetic field)
• Physical destruction (disintegration, pulverization, melting, incinerating, or shredding the media)

Covered entities may hire a business associate to handle record destruction, but a proper Business Associate Agreement must be in place.

Best Practices for Destruction

Healthcare providers in South Dakota should follow these steps when destroying records:

1. Verify that the applicable retention period has fully expired
2. Confirm no pending litigation, audits, or investigations require the records
3. Create the required permanent index or abstract before destruction
4. Maintain a destruction log documenting the patient name, record identifier, date of destruction, and the name of the person performing or witnessing the destruction
5. Use a certified destruction vendor or verified in-house methods
6. Retain the destruction log permanently

Practice Closure and Transfer of Ownership

South Dakota administrative rules address what must happen to medical records when a healthcare facility closes or changes ownership.

Closure Requirements

The notice period comes from the rule that governs the facility's license type, and the two periods are not the same:

• Hospitals, specialized hospitals, and critical access hospitals must notify the South Dakota Department of Health in writing at least 30 days before closure, under ARSD 44:75:09:09
• Nursing facilities must notify the department in writing at least 60 days before closure, under ARSD 44:73:09:09

Under both rules, the facility must also:

• Include provisions for the safe preservation of medical records and the records' location
• Publish notice in the nearest legal newspaper or on the facility's website describing the location and disposition arrangements for medical records

Options for Record Disposition

When a facility closes, it may handle records through any of these methods:

• Transfer to another facility of the same licensure classification for continued storage
• Transfer to another provider at the request of the patient or the patient's legal representative
• Release records directly to the patient or the patient's legal representative
• Arrange secure third-party storage with a vendor who provides secure storage of healthcare records

Transfer of Ownership

If ownership of a facility is transferred to a new owner, the new owner must maintain the medical records in accordance with all applicable retention rules. The transfer of ownership does not reset or shorten the required retention periods.

Interaction with the Statute of Limitations

South Dakota's medical malpractice statute of limitations is an important consideration for record retention planning. Under SDCL 15-2-14.1, a medical malpractice action must be filed within two years from the date the alleged malpractice occurred.

South Dakota applies an occurrence rule rather than a discovery rule. The clock starts running on the date the error was committed, not the date the patient discovered the injury. The South Dakota Supreme Court has consistently upheld this interpretation.

This two-year limitation period is well within the 10-year record retention window. However, providers should be aware that tolling exceptions exist for cases involving fraudulent concealment or continuing treatment, which could extend the filing deadline.

Given these potential extensions, the 10-year retention period provides a substantial safety margin for malpractice defense purposes.

Summary Table: South Dakota Retention Periods by Provider Type

Frequently Asked Questions

How long do hospitals in South Dakota have to keep medical records?

South Dakota hospitals must retain medical records for a minimum of 10 years from the actual visit date of service or patient care, under ARSD 44:75:09:06. This rule applies to hospitals, specialized hospitals, and critical access hospitals licensed by the South Dakota Department of Health. For minor patients, records must be kept until the patient reaches age 20 (age of majority plus two years) or for 10 years from the visit, whichever period is longer.

Does South Dakota have a medical records retention law for private physician offices?

South Dakota does not impose a specific statutory retention period on private physician practices operating outside the licensed facility framework. The South Dakota Board of Medical and Osteopathic Examiners provides general guidance that physicians should retain records for active patients or patients whose whereabouts are known. Because this standard is vague, most healthcare attorneys recommend that private practices follow the 10-year minimum established for licensed facilities as a best practice.

Can a South Dakota patient get copies of their medical records?

Yes. South Dakota law entitles patients to copies of their medical records under SDCL 36-2-16.2: upon a written request or signed authorization, a health care provider or medical records company must provide a copy of the record, if available. Providers may charge a fee capped at $10 for the first 10 pages plus $0.33 per additional page for paper copies, or $0.25 per page for electronic copies, under SDCL 36-2-16.4. South Dakota law does not provide a fee waiver for indigent patients, but under 45 CFR 164.524(c)(4) a provider responding to a patient's request for their own records may charge only a reasonable, cost-based fee covering copying labor, supplies, postage, and any summary the patient agreed to.

What happens to medical records when a South Dakota healthcare facility closes?

When a South Dakota healthcare facility closes, it must notify the Department of Health in writing before closure and publish notice in a legal newspaper or on the facility's website about the disposition of records. The notice period depends on the license type: at least 30 days for hospitals, specialized hospitals, and critical access hospitals under ARSD 44:75:09:09, and at least 60 days for nursing facilities under ARSD 44:73:09:09. The facility may transfer records to another facility of the same licensure type, transfer them to another provider at the patient's request, release them directly to the patient, or arrange secure third-party storage. If ownership transfers to a new entity, the new owner must maintain records according to all applicable retention rules.

Does HIPAA require a specific medical records retention period in South Dakota?

No. The HIPAA Privacy Rule does not establish a retention period for medical records. According to the U.S. Department of Health and Human Services, state laws govern how long medical records must be retained. HIPAA does require covered entities to maintain certain compliance documentation (privacy policies, complaint records, and related documents) for six years. HIPAA also requires proper safeguards when disposing of protected health information, including shredding paper records and clearing or destroying electronic media.