Texas Medical Records Retention Laws (2026 Guide)

Texas physicians must retain medical records for at least 7 years from the date of last treatment under 22 TAC 163.2; hospitals may not dispose of a record until the 10th anniversary of last treatment under Texas Health and Safety Code Section 241.103. Minor patients get longer periods, and the physician and hospital rules are not the same.

Last verified: August 2026. This page reflects 22 TAC Chapter 163 (Texas Medical Board), Texas Health and Safety Code Chapter 241, 26 TAC Chapter 505 (hospital licensing), SB 1188 (89th Legislature), and the HHS civil money penalty amounts as currently adjusted at 45 CFR part 102.

Table of Contents

• Overview of Texas Medical Records Retention Laws
• Physician Retention Requirements
• Hospital Retention Requirements
• Records for Minor Patients
• Federal Requirements: HIPAA and CMS
• Texas SB 1188: EHR Storage in the United States
• Patient Access Rights and Copy Fees
• Proper Destruction of Medical Records
• Practice Closure and Record Transfer
• Penalties for Noncompliance
• Frequently Asked Questions
• Sources and References

Overview of Texas Medical Records Retention Laws

Texas medical records retention requirements come from multiple sources. Texas Medical Board rules set the minimum retention period for physicians. Hospitals answer to both a statute and a licensing rule: Health and Safety Code Section 241.103 sets the ten-year floor, and 26 TAC 505.41(j) adds the storage-format and imaging requirements that go with it. Federal rules from HIPAA and CMS add further layers, and since 2026 a new Texas law also dictates where electronic health records must be physically stored.

Healthcare providers in Texas must navigate all of these overlapping requirements. When state and federal rules conflict, the stricter standard applies. This guide breaks down each requirement so physicians, hospitals, and healthcare administrators can stay compliant.

Watch the rule numbers. The Texas Medical Board reorganized its medical records rules, moving them from 22 TAC Chapter 165 into 22 TAC Chapter 163. Separately, the hospital licensing rules moved out of 25 TAC Chapter 133 and into 26 TAC Chapter 505 under the Health and Human Services Commission. Older guides, form letters, and policy manuals still cite the retired numbers.

Primary Regulatory Sources:

• 22 TAC Chapter 163 (Texas Medical Board medical records rules for physicians)
• Texas Health and Safety Code Section 241.103 (Preservation of hospital records)
• Texas Health and Safety Code Section 241.1031 (20-year hold on sexual assault forensic examination records)
• 26 TAC Chapter 505 (Hospital licensing rules, HHSC)
• SB 1188, 89th Legislature (Electronic Health Records)

Physician Retention Requirements

Under 22 TAC 163.2(c)(1), the Texas Medical Board requires a physician to retain patient medical records for a minimum of seven years from the date of the last treatment by that physician, or longer if another federal or state law requires it.

The duty is not the individual physician's alone. Section 163.2(a) places the retention obligation on the physician or the physician's employer, and names group practices, professional associations, and non-profit health organizations. Section 163.2(b) then requires that providers maintain access to the records for the whole retention period, which matters when a practice changes vendors or an EHR contract lapses.

This seven-year period applies to adult patients. It covers the documentation in the medical record, including examination notes, test results, imaging reports, prescriptions, referrals, and correspondence.

The retention clock starts on the date of the patient's last visit or treatment. If a patient returns after a gap in care, the clock resets from that new date of service.

Key points for physicians:

• Minimum 7 years from the date of last treatment by that physician
• The obligation runs to the physician's employer as well, including group practices and professional associations
• Providers must maintain access to the records for the full retention period
• Longer retention is required when another federal or state law mandates it
• Records from a forensic medical examination for sexual assault follow a separate rule, 22 TAC 163.2(d), which points to Section 153.003 of the Medical Practice Act

Primary Source: 22 TAC Chapter 163, Texas Medical Board

Hospital Retention Requirements

Texas hospitals answer to a longer period than individual physicians, and the floor is set by statute. Under Texas Health and Safety Code Section 241.103(a), a hospital may authorize the disposal of a medical record only on or after the 10th anniversary of the date the patient was last treated in the hospital. The hospital licensing rules at 26 TAC 505.41(j) repeat the same periods and add the format requirements described below.

Three further provisions of the same section are easy to miss, and none of them is optional.

"The hospital may not destroy medical records that relate to any matter that is involved in litigation if the hospital knows the litigation has not been finally resolved." Texas Health and Safety Code Sec. 241.103(c)

That litigation hold has no expiry date attached to it. The ten-year clock does not release a record the hospital knows is tied to unresolved litigation.

Section 241.103(b) sets a minor-patient rule that differs from the Texas Medical Board's physician rule, covered in the next section.

Section 241.103(d) adds a notice duty that is often overlooked: a hospital must give the patient, or the patient's legally authorized representative as defined in Section 241.151, written notice that it may authorize disposal of the records after those periods. The notice must be provided no later than the date the patient is treated, except in an emergency treatment situation, where it must be provided as soon as is reasonably practicable afterward.

Sexual assault forensic records run far longer, and they sit in a different statute. Section 241.103 is not the only preservation rule in the chapter. Under Texas Health and Safety Code Section 241.1031(a), a hospital may not destroy a medical record from the forensic medical examination of a sexual assault victim, conducted under Subchapter G, Chapter 56A of the Code of Criminal Procedure, until the 20th anniversary of the date the record was created. That is double the ordinary hospital floor, and the licensing rules mirror it at 26 TAC 505.41(j)(10). Section 241.1031(b) allows the hospital to keep such a record in the same form it uses for its other medical records, so the longer period is about the calendar, not about separate storage.

Hospital retention summary:

• Medical records: no disposal before the 10th anniversary of last treatment (Sec. 241.103(a))
• Patients under 18 at last treatment: a separate and later trigger (Sec. 241.103(b))
• Records tied to known unresolved litigation: no destruction at all (Sec. 241.103(c))
• Advance written notice of the disposal policy must reach the patient (Sec. 241.103(d))
• Records from a sexual assault forensic medical examination: no destruction until the 20th anniversary of the date the record was created (Sec. 241.1031; mirrored at 26 TAC 505.41(j)(10))

A note on imaging and record format. Section 241.103 sets the ten-year floor but prescribes no storage format and no separate imaging period. Those sit in the hospital licensing rules, which moved from 25 TAC Chapter 133 to 26 TAC Chapter 505; the operational rule is Section 505.41, Hospital Functions and Services. Under 26 TAC 505.41(j)(9), hospital medical records (reports and printouts) must be retained in their original or legally reproduced form for at least ten years. A legally reproduced form is a record kept in hard copy, microform (microfilm or microfiche), or other electronic medium. Films, scans, and other image records must be retained for at least five years, which is a shorter period than the one that governs the rest of the chart.

Hospitals that accept Medicare or Medicaid must also comply with the CMS Conditions of Participation, which impose their own documentation and retention standards.

Primary Sources: Texas Health and Safety Code Sec. 241.103, Preservation of Records and 26 TAC 505.41, Hospital Functions and Services

Records for Minor Patients

Texas extends retention for children's records, but the physician rule and the hospital rule are different, and applying the wrong one is a common error. Ask first whose record it is.

For a physician's records, 22 TAC 163.2(c)(2) requires retention until the patient reaches age 21 or seven years from the date of last treatment, whichever is longer. If a physician last treats a 10-year-old, the records are kept until the child turns 21, which is 11 years. If the physician last treats a 16-year-old, the seven-year period runs to age 23 and controls, because it is longer than waiting until age 21.

For a hospital's records, Section 241.103(b) permits disposal on or after the patient's 20th birthday or on or after the 10th anniversary of last treatment, whichever date is later. A child last treated at age 5 reaches the 20th birthday well after the 10th anniversary, so the 20th birthday controls. A patient last treated at 16 hits the 10th anniversary at age 26, which is later than the 20th birthday, so the 10-year measure controls.

The two regimes can point to different years for the same child, which is why a records request should name the specific provider or facility rather than assume one statewide deadline.

These extended periods exist because minors cannot independently request or manage their own medical records. They also reflect the statute of limitations on medical malpractice claims, which is tolled during minority in Texas.

Watch out: These are the earliest dates a provider is permitted to dispose of records, not a promise the records still exist. A hospital may lawfully destroy a qualifying record the day the period ends. Imaging is the shortest window of all: under 26 TAC 505.41(j)(9), a hospital's films, scans, and other image records only have to be kept five years, not ten. If you may need childhood records or an old scan, request copies well before the window closes rather than after.

Parents and legal guardians may request copies of a minor's records on the child's behalf. Under SB 1188, parents of children age 17 and younger have complete and unrestricted access to their child's electronic health records unless restricted by law or court order.

Federal Requirements: HIPAA and CMS

HIPAA

The HIPAA Privacy Rule does not establish a specific retention period for medical records. According to the U.S. Department of Health and Human Services, the HIPAA Privacy Rule does not include medical record retention requirements, and state laws generally govern how long medical records are to be retained.

HIPAA does require covered entities to retain HIPAA-related documentation for six years. Under 45 CFR 164.316(b)(2)(i), required documentation must be retained for six years from the date of its creation or the date when it last was in effect, whichever is later. This covers administrative documents such as privacy policies, authorization forms, notices of privacy practices, and business associate agreements, not the patient medical records themselves.

HIPAA also governs how protected health information (PHI) must be handled during disposal, covered in the destruction section below.

Primary Source: HHS.gov - Does HIPAA Require Retention of Medical Records?

CMS/Medicare Requirements

Hospitals that participate in Medicare must meet the Centers for Medicare and Medicaid Services (CMS) Conditions of Participation at 42 CFR 482.24. The retention standard is short and unqualified: under 42 CFR 482.24(b)(1), medical records must be retained in their original or legally reproduced form for a period of at least 5 years. Part 482 is the hospital condition of participation, so it does not by itself set a period for physician offices and other non-hospital Medicare providers.

Texas's ten-year hospital floor and seven-year physician floor are both longer than the federal five years, so the state periods control for Texas providers.

CMS also requires that medical records be accurately written, promptly completed, properly filed and retained, and accessible. Hospitals must maintain a medical record for each inpatient and outpatient.

Primary Source: 42 CFR 482.24 - Condition of Participation: Medical Record Services

Texas SB 1188: EHR Storage in the United States

Senate Bill 1188, passed during the 89th Texas Legislature, introduced a significant new requirement for electronic health records in Texas. Starting January 1, 2026, all electronic health records under the control of a covered entity must be physically maintained on servers located in the United States or a U.S. territory.

This requirement applies regardless of when the record was originally created. Records prepared before January 1, 2026, must still be stored domestically after that date.

SB 1188 affects healthcare facilities, providers, and state agencies that maintain electronic health records. It also applies to third-party computing facilities and cloud services used to store EHR data.

Additional SB 1188 provisions:

• EHR systems must include a field for documenting biological sex at birth
• Practitioners may use AI for diagnostic purposes only if they review all AI-generated records and disclose AI use to patients
• EHR systems may not collect, store, or share information about a patient's credit score or voter registration status (Sec. 183.004)
• Parents of children 17 and younger receive complete and unrestricted access to their child's EHR
• Covered entities must implement reasonable and appropriate administrative, physical, and technical safeguards for record security

Enforcement: The Texas Attorney General may pursue injunctive relief and civil penalties for violations:

• Negligent violations: up to $5,000 per year
• Knowing or intentional violations: up to $25,000 per year
• Violations involving misuse of PHI for profit: up to $250,000

Primary Source: SB 1188 Enrolled Text, 89th Legislature

Patient Access Rights and Copy Fees

Texas patients have the right to obtain copies of their medical records. A patient submits a written request, and the Texas Medical Board's public guidance states that a physician has 15 business days to respond to a properly authorized request.

One wrinkle is worth knowing before you count days. The codified rule, 22 TAC 163.3(a), states the deadline as 15 days from the request, without the word "business." The Board's plain-language guidance for patients says 15 business days. If a deadline is close to mattering, work from the earlier of the two.

Patients may request records be sent to themselves, another provider, or an authorized third party. Written authorization is required for third-party transfers.

Maximum allowable fees for record copies:

Know which of these is a rule and which is guidance. The paper, electronic, affidavit, narrative, and postage caps are set by rule at 22 TAC 163.3(c). The $8 imaging-study cap and the fee waiver described below appear in the Texas Medical Board's published guidance for patients rather than in the current text of 163.3, so confirm both with the physician's office before relying on them. This is the same rule-versus-guidance gap as the 15-day question above.

Important exception: TMB guidance states that a physician may not charge a fee for a medical or mental health record when the request is related to a benefits or assistance claim based on the patient's disability. That is narrower than a general waiver for any benefits or assistance claim.

These limits apply to physicians. Hospitals may have separate fee schedules under Texas Health and Safety Code Section 241.154.

Primary Source: Texas Medical Board - Patient Information and Medical Records

Proper Destruction of Medical Records

Once the retention period expires, medical records containing protected health information (PHI) must be destroyed in a manner that renders the information unreadable and unable to be reconstructed.

Before destroying anything, confirm no hold applies. For hospitals, Section 241.103(c) bars destruction of any record relating to a matter in litigation the hospital knows is unresolved, and that bar overrides the ten-year clock.

Paper Records

HHS guidance describes shredding, burning, pulping, or pulverizing paper records so that the PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed. Organizations that shred in-house typically specify crosscut shredding and a particle size in their own records-management policy; confirm the standard your policy or your state agency requires rather than assuming a figure from an older compliance guide.

Simply placing records in a trash receptacle accessible to the public is a HIPAA violation, even if the retention period has expired.

Electronic Records

Electronic media containing PHI must be cleared, purged, or physically destroyed. Acceptable methods include:

• Clearing: Overwriting data with nonsensitive information
• Purging: Degaussing (exposing media to a strong magnetic field)
• Destruction: Disintegration, pulverization, melting, incinerating, or shredding the physical media

Using a Third Party

Healthcare providers may hire a business associate to handle record destruction. A Business Associate Agreement (BAA) must be in place that requires the associate to safeguard PHI through the destruction process. Providers should obtain a certificate of destruction for their records.

Primary Source: HHS.gov - Disposal of Protected Health Information

Practice Closure and Record Transfer

When a Texas physician retires, closes a practice, or leaves a group practice, specific rules govern what happens to patient records.

Notification Requirements

Under 22 TAC 163.4, a physician who retires, has employment terminated, or leaves a medical practice must give patients reasonable notice to obtain copies of their records or arrange a transfer, by:

• Sending a letter or email to each patient seen in the last two years by the departing physician, and
• Posting a notice in a conspicuous location in the practice office and on the practice website at least 30 days before the termination, departure, sale, or relocation

Required Notice Content

Under 22 TAC 163.4(b), the notification must include:

• The date of the termination, retirement, or departure
• Instructions for patients to obtain or transfer their records
• The name and location of the new practice (if applicable)
• The name of another licensed physician, practice, or custodian, if ownership of the records is changing

Physicians Exempt From the Notice Duty

Under 22 TAC 163.4(d), several categories of physician are exempt from providing notice to patients entirely:

• A locum tenens physician at a practice location for less than six months
• A physician who treated the patient only in a hospital, an emergency room, a birthing center, or an ambulatory surgery center
• A physician who provided only anesthesia, radiology, or pathology services

If your physician fell into one of these categories, do not expect a departure letter. Request the records from the facility or the practice that holds them instead.

License Surrender or Revocation

The timing changes, and it gets shorter rather than longer. Under 22 TAC 163.4(c), if a physician's license is surrendered or revoked, the notice required by that section must be provided immediately, not on the 30-day advance schedule that applies to a planned departure or sale.

Nothing in Chapter 163 requires a departing physician to obtain board approval of a custodian, and there is no separate 30-day deadline to name one. What the rules do instead is define who the custodian is and what that custodian owes patients. Under 22 TAC 163.5(a), the custodian is fixed by circumstance: on a physician's death it is the administrator, executor, or other court-appointed individual, unless the physician was part of a group practice or a prior appointment is already in place; on mental or physical incapacity it is the holder of a power of attorney, a court-appointed individual, or the physician's legally appointed representative; and in other circumstances, including abandonment of records, the custodian is determined case by case.

Once someone is appointed, 22 TAC 163.5(b) sets that person's duties:

• Maintain the confidentiality of the records
• Within 30 days of appointment, give notice of the custodianship to the Texas Medical Board and to patients, by posting in the practice office, on the practice website, or in the newspaper of greatest general circulation in the county where the practice was located
• Retain the records for at least 90 days before destroying any of them, in accordance with state and federal law, with the 30-day notice period counted inside that 90 days
• Include in the notice the custodian's name and contact information, how patients can obtain or transfer records, the applicable fees (which may include an additional $25 custodial fee), and a statement that the records may be destroyed after 90 days, with the destruction date

That 30-day clock is the custodian's notice deadline, measured from appointment. It is not a deadline for a departing physician to designate anyone, and the two are easy to confuse.

Primary Source: 22 TAC 163.5, Appointment of Record Custodian of a Physician's Records

Protection of Patient Rights

Section 163.4(e) divides the work between the departing physician and the practice left behind. The practice must provide a list of the patients that physician saw in the last two years, so the notices can actually be sent. No physician remaining at the group or practice may prevent or interfere with the departing physician's duty to give those notices. But the practice is not required to send the notices itself; if it agrees to, it must do so in accordance with the same section. Patients should therefore expect the notice to come from the departing physician, not from the practice.

Primary Source: 22 TAC 163.4, Physician Responsibilities when Leaving a Practice

Penalties for Noncompliance

Failing to comply with Texas medical records retention laws can result in disciplinary action by the Texas Medical Board, including:

• Formal reprimand or warning
• Administrative penalties
• License suspension or restriction
• License revocation in severe cases

For violations of the SB 1188 EHR storage requirements, the Texas Attorney General may seek civil penalties of up to $5,000 per negligent violation, up to $25,000 per knowing violation, and up to $250,000 for violations involving misuse of PHI for profit. Regulatory agencies may also suspend or revoke licenses for three or more violations.

HIPAA violations carry separate federal penalties administered by the HHS Office for Civil Rights. The tier structure is set by culpability at 45 CFR 160.404(b)(2), but the dollar figures printed in that section are nominal and are not what an entity actually pays. Section 160.404(a) says so directly: those amounts "were adjusted in accordance with the Federal Civil Monetary Penalty Inflation Adjustment Act of 1990" and "will be updated annually and published at 45 CFR part 102."

Compliance guides that quote the $100 and $50,000 figures straight out of 160.404 are quoting the un-adjusted numbers and understating real exposure by a wide margin. As currently adjusted at 45 CFR 102.3:

The cap for identical violations during a calendar year is $2,190,294, not the $1,500,000 printed in 160.404. Because these figures are re-adjusted every year, check the current table at 45 CFR 102.3 rather than relying on any published number, including this one.

Sources and References

1. 22 TAC Chapter 163 - Medical Records (Texas Medical Board)
2. 22 TAC 163.4 - Physician Responsibilities when Leaving a Practice
3. 22 TAC 163.5 - Appointment of Record Custodian of a Physician's Records
4. Texas Health and Safety Code Sec. 241.103 - Preservation of Records
5. Texas Health and Safety Code Sec. 241.1031 - Preservation of Record from Forensic Medical Examination
6. Texas Health and Safety Code Sec. 241.154 - Hospital Record Fees
7. 26 TAC Chapter 505 - Hospital Licensing (HHSC)
8. 26 TAC 505.41 - Hospital Functions and Services
9. SB 1188, 89th Texas Legislature - Electronic Health Records
10. SB 1188 Bill Analysis - Senate Research Center
11. HHS.gov - Does HIPAA Require Retention of Medical Records?
12. 45 CFR 164.316 - Policies and Procedures and Documentation Requirements
13. 42 CFR 482.24 - CMS Conditions of Participation: Medical Record Services
14. 45 CFR 160.404 - Amount of a Civil Money Penalty
15. 45 CFR 102.3 - Penalty Adjustment and Table (current adjusted HHS penalty amounts)
16. HHS.gov - Disposal of Protected Health Information
17. Texas Medical Board - Patient Information and Medical Records
18. HHS.gov - HIPAA Privacy Rule Summary

Frequently Asked Questions

How long must a Texas physician keep medical records?

Texas physicians must retain patient medical records for at least seven years from the date of last treatment by that physician under 22 TAC 163.2(c)(1), or longer if another federal or state law requires it. For patients who were minors (under 18) at the time of last treatment, records must be kept until the patient turns 21 or for seven years, whichever period is longer, under 22 TAC 163.2(c)(2).

How long do Texas hospitals keep medical records?

Under Texas Health and Safety Code Section 241.103(a), a Texas hospital may authorize disposal of a medical record only on or after the 10th anniversary of the date the patient was last treated at the hospital. The hospital licensing rule, 26 TAC 505.41(j)(9), adds that records must be kept in their original or legally reproduced form, meaning hard copy, microform (microfilm or microfiche), or another electronic medium, for those ten years. Films, scans, and other image records are treated differently and only have to be kept for at least five years. These are the earliest permitted disposal dates, not a guarantee the record still exists, so request copies before the window closes.

Is the minor-patient rule the same for hospitals and physicians in Texas?

No, and this is a common mix-up. A physician follows 22 TAC 163.2(c)(2): keep the record until the patient turns 21 or for seven years from last treatment, whichever is longer. A hospital follows Texas Health and Safety Code Section 241.103(b): disposal is permitted on or after the patient's 20th birthday or the 10th anniversary of last treatment, whichever date is later. The two can point to different years for the same child.

Can a Texas hospital destroy records once the 10 years are up?

Not always. Two separate limits survive the ten-year clock. Texas Health and Safety Code Section 241.103(c) prohibits a hospital from destroying medical records that relate to any matter involved in litigation if the hospital knows the litigation has not been finally resolved; that litigation hold has no time limit of its own. Separately, Section 241.1031(a) bars a hospital from destroying a medical record from the forensic medical examination of a sexual assault victim until the 20th anniversary of the date the record was created, which is twice the ordinary hospital period. The licensing rules repeat both limits at 26 TAC 505.41(j)(10) and (j)(12).

Does HIPAA require medical records to be kept for a specific number of years?

No. HIPAA does not set a retention period for patient medical records. The U.S. Department of Health and Human Services states that state laws generally govern how long records must be retained. HIPAA does require covered entities to retain HIPAA-related documentation, such as privacy policies, authorization forms, and business associate agreements, for six years under 45 CFR 164.316(b)(2)(i).

What does Texas SB 1188 require for electronic health records storage?

SB 1188 requires that all electronic health records under the control of a covered entity be physically stored on servers located in the United States or a U.S. territory. This requirement took effect January 1, 2026, and applies to all records regardless of when they were originally created. Violations can result in civil penalties up to $250,000.

What should a physician do with medical records when closing a practice in Texas?

Under 22 TAC 163.4, a physician leaving or closing a practice must send a letter or email to each patient seen in the last two years and post a notice in a conspicuous location in the office and on the practice website at least 30 days before the termination, departure, sale, or relocation. The notice must state the date of departure, explain how patients can obtain or transfer records, give the location of the new practice if there is one, and name the physician, practice, or custodian taking over if ownership of the records is changing. If the license is surrendered or revoked rather than the practice simply closing, 22 TAC 163.4(c) requires the notice immediately instead of 30 days in advance.

Why do older guides cite 22 TAC 165 and 25 TAC 133.41 for Texas record retention?

Those citations are retired, but the substance mostly moved rather than disappearing. The Texas Medical Board moved its medical records rules from 22 TAC Chapter 165 into 22 TAC Chapter 163, and the hospital licensing rules moved from 25 TAC Chapter 133 to 26 TAC Chapter 505 under the Health and Human Services Commission. The old 25 TAC 133.41 content on retention format and imaging now lives at 26 TAC 505.41(j)(9), so a guide quoting the ten-year original-or-legally-reproduced-form rule and the five-year imaging rule is still describing current law under a dead citation. The hospital ten-year floor itself is set by statute at Texas Health and Safety Code Section 241.103.