Virginia Medical Records Retention Laws (2026 Guide)

Last verified: March 2026. This page reflects the current Code of Virginia, Virginia Administrative Code, and federal regulations governing medical records retention in the Commonwealth.

Table of Contents

• Overview of Virginia Medical Records Retention Laws
• Hospital Records Retention Requirements
• Physician and Practitioner Retention Requirements
• Records for Minor Patients
• Federal Requirements: HIPAA and CMS
• Patient Access to Medical Records
• Fees for Copies of Medical Records
• Record Storage and Format Requirements
• Record Destruction Rules
• Practice Closure and Record Transfer
• Penalties for Noncompliance
• Frequently Asked Questions

Overview of Virginia Medical Records Retention Laws

Virginia law establishes different medical records retention periods depending on the type of health care provider. Hospitals follow regulations set by the Virginia Department of Health, while physicians and other practitioners follow rules issued by the Virginia Board of Medicine.

The two primary retention frameworks are:

• Hospitals: Minimum 5 years after patient discharge, governed by 12 VAC 5-410-370
• Physicians: Minimum 6 years after the last patient encounter, governed by Va. Code § 54.1-2910.4

Both frameworks include extended requirements for records of minors. Federal rules under HIPAA and CMS add additional layers of compliance for facilities that participate in Medicare or handle protected health information.

Virginia providers should treat these periods as minimums. Other obligations, including malpractice statutes of limitations, federal program participation, and contractual requirements, may require longer retention in practice.

Hospital Records Retention Requirements

Virginia's hospital medical records retention rules are found in the Regulations for the Licensure of Hospitals in Virginia, specifically 12 VAC 5-410-370. These regulations apply to all hospitals licensed by the Virginia Department of Health.

General Retention Period

All medical records, whether originals or accurate reproductions, must be preserved for a minimum of five years following the discharge of the patient. This applies to inpatient, outpatient, and emergency department records.

Hospitals must establish a medical record for every patient treated on an inpatient, outpatient, or emergency basis. A separate medical record is required for each newborn infant, including documentation of gestational history and delivery complications.

Birth and Death Records

Birth and death information must be retained for 10 years in accordance with Va. Code § 32.1-274. This longer period applies specifically to vital records documentation maintained by the hospital.

Storage Standards

Hospitals must make provisions for the safe storage of medical records or accurate and legible reproductions. Storage practices must comply with both Va. Code § 32.1-127.1:03 (Health Records Privacy) and the Health Insurance Portability and Accountability Act (HIPAA) at 42 U.S.C. § 1320d et seq.

Record Type	Minimum Retention Period	Authority
Adult patient records	5 years after discharge	12 VAC 5-410-370
Minor patient records	5 years after patient turns 18	12 VAC 5-410-370
Birth and death records	10 years	Va. Code § 32.1-274
Newborn records	5 years after discharge (or minor rule, whichever is longer)	12 VAC 5-410-370

Physician and Practitioner Retention Requirements

Physicians and other practitioners licensed under Chapter 29 of the Code of Virginia (Medicine and Other Healing Arts) follow a separate set of retention rules under Va. Code § 54.1-2910.4 and the Virginia Board of Medicine regulations at 18 VAC 85-20-26.

General Retention Period

Practitioners must maintain health records for a minimum of six years following the last patient encounter. This applies to all records as defined in Va. Code § 32.1-127.1:03.

Maximum Retention Period

Virginia law provides that practitioners are not required to maintain health records for longer than 12 years from the date of creation. This ceiling applies to adult patient records and gives practitioners a clear endpoint for retention obligations.

The exceptions to this 12-year maximum include:

• Records of minor patients (which follow the minor-specific rules described below)
• Records required by a contractual obligation to be maintained longer
• Records required by federal law to be maintained for a longer period

Transferred Records Exception

Practitioners are not required to retain records that have been transferred to another practitioner or health care provider, or that have been provided directly to the patient or the patient's personal representative. This allows practitioners to satisfy retention obligations through proper transfer rather than indefinite storage.

Record Management Standards

Under 18 VAC 85-20-26, practitioners must properly manage patient records and maintain timely, accurate, legible, and complete documentation. Records must be made available for transfer to other practitioners, patients, or authorized representatives in accordance with state law.

Records for Minor Patients

Both hospitals and physicians face extended retention periods for the records of minor patients. The rules differ slightly between the two provider types.

Hospital Rules for Minors

Under 12 VAC 5-410-370, hospital records for minors must be kept for at least five years after the minor has reached the age of 18. This means a hospital record created for a newborn must be retained for approximately 23 years from the date of creation.

For example, if a child is born in 2026, the hospital must retain that record until at least 2049 (when the child turns 18 plus five additional years).

Physician Rules for Minors

Under Va. Code § 54.1-2910.4, physician records for minor children, including immunization records, must be maintained until the child reaches the age of 18 or becomes emancipated. The minimum retention period of six years from the last patient encounter still applies regardless of the patient's age.

In practice, this means a physician who last treats a 10-year-old patient in 2026 must keep those records until at least 2034 (when the child turns 18), or 2032 (six years from the last encounter), whichever is later.

Provider Type	Minor Record Retention	Practical Minimum
Hospitals	5 years after patient turns 18	Up to 23 years from birth
Physicians	Until age 18 or emancipation (6-year minimum)	Up to 18 years from birth

Federal Requirements: HIPAA and CMS

Virginia providers must also comply with federal requirements that affect medical records management, even though federal law does not impose a single nationwide retention period.

HIPAA (Health Insurance Portability and Accountability Act)

The HIPAA Privacy Rule does not require covered entities to retain medical records for any specific period. According to the U.S. Department of Health and Human Services, HIPAA defers to state law on retention periods.

However, HIPAA does require covered entities to:

• Retain HIPAA-related documentation (policies, procedures, and compliance records) for six years from the date of creation or the date it was last in effect, whichever is later (45 CFR § 164.530(j))
• Apply appropriate administrative, technical, and physical safeguards to protect records throughout retention
• Implement policies for the secure disposal of electronic protected health information (ePHI) and the hardware or media on which it is stored

This means Virginia providers must keep their HIPAA compliance documentation for six years, even though the medical records themselves follow Virginia's state retention schedule.

CMS Conditions of Participation

Hospitals that participate in Medicare must meet the Conditions of Participation under 42 CFR § 482.24. These federal regulations require hospitals to maintain medical records that are accurately written, promptly completed, properly filed and retained, and accessible.

CMS does not set a single explicit retention period in the regulatory text of 42 CFR § 482.24. However, CMS guidance and Medicare billing rules effectively require providers to retain records for a minimum of 5 to 7 years depending on the record type. Medicare claims records should be retained for at least 7 years to support potential audits.

Virginia hospitals should follow whichever period is longer: Virginia's 5-year state minimum or the applicable CMS/Medicare retention guidance.

Patient Access to Medical Records

Virginia law provides patients with clear rights to access their own medical records. These rights are established primarily through Va. Code § 32.1-127.1:03 and Va. Code § 8.01-413.

Who Can Request Records

The following individuals may request copies of health records:

• The patient
• The patient's attorney
• The patient's executor or administrator
• An authorized insurer
• A personal representative of the patient

Response Timeline

Health care providers must furnish copies of requested records within 30 days of receiving a written request. If the provider cannot meet this deadline, they must notify the requester in writing explaining the reason for the delay. The provider then has an additional 30 days to comply.

Providers must also include an audit trail of any additions, deletions, or revisions to the health record if specifically requested.

Format Options

Providers must produce records in either paper (hard copy) or electronic format, as requested by the requester. When electronic format is requested, the provider should furnish the records in an available electronic format. Providers may decline an electronic format request only if it would require substantial additional cost, modify the records, or compromise their integrity.

Records Cannot Be Withheld for Nonpayment

Under Va. Code § 8.01-413, production of health records to the patient cannot be withheld or delayed solely on the grounds of nonpayment. This protection ensures patients can always access their medical information regardless of outstanding balances.

Fees for Copies of Medical Records

Virginia law caps the fees that providers may charge for copies of medical records. The fee schedule is established in Va. Code § 8.01-413.

Paper Copies from Paper or Electronic Records

Pages	Maximum Fee Per Page
First 50 pages	$0.50 per page
Pages 51 and beyond	$0.25 per page
From microfilm	$1.00 per page

Electronic Copies from Electronic Records

Pages	Maximum Fee Per Page
First 50 pages	$0.37 per page
Pages 51 and beyond	$0.18 per page
Maximum total charge	$160 (including search/handling and shipping)

Additional Allowable Charges

• Search and handling fee: Up to $20
• Postage and shipping: Actual costs
• X-ray/imaging studies (electronic): $25 per study plus $10 search/handling fee
• X-ray/imaging studies (hard copy): Actual cost of supplies and labor plus $10 search/handling fee

Providers who unlawfully refuse to provide records or impose excessive charges face court remedies, including damages, court costs, and attorney fees.

Record Storage and Format Requirements

Virginia law permits health care providers to store medical records in a variety of formats. Under Va. Code § 32.1-127.1:01, providers may maintain records using:

• Computerized or other electronic processes
• Microfilm
• Other photographic, mechanical, or chemical processes

Once records have been converted to an unalterable technological format, the provider may dispose of the original paper documents. However, this disposal must be done in a manner that preserves patient confidentiality.

Any documents or information that cannot be stored in a technological format must be identified and preserved separately. This ensures that no part of the patient record is lost during format conversion.

Providers using electronic health records (EHR) systems should ensure their systems maintain data integrity, include audit trails, and meet both HIPAA security requirements and Virginia state standards.

Record Destruction Rules

When medical records have been retained for the required minimum period, Virginia law permits their destruction. However, the destruction process must follow specific rules to protect patient privacy.

Acceptable Destruction Methods

Under 18 VAC 85-20-26, patient records may only be destroyed in a manner that protects patient confidentiality. The regulation specifically identifies the following acceptable methods:

• Incineration of paper records
• Shredding of paper records
• Secure electronic deletion of digital records, including wiping of storage media

Patient Notification Requirement

Practitioners are required to post information or otherwise inform all patients about the timeframe for record retention and destruction. This notification should be part of the practice's standard patient communications, such as intake forms, office signage, or the practice website.

This transparency requirement ensures patients know when their records may be destroyed and can request copies before that happens.

HIPAA Disposal Requirements

In addition to Virginia state requirements, HIPAA requires covered entities to implement policies and procedures that address the final disposition of electronic protected health information (ePHI). This includes procedures for removing ePHI from electronic media before the media are made available for reuse or disposal.

Paper records containing protected health information must also be disposed of securely. Placing unshredded documents in a standard trash receptacle does not meet HIPAA disposal requirements.

Practice Closure and Record Transfer

When a Virginia physician or health care practitioner closes, sells, or relocates a practice, Va. Code § 54.1-2405 establishes specific requirements for handling patient records.

Notice Requirements

Before transferring patient records, the provider must:

1. Attempt to notify current patients of the pending transfer, either electronically or by mail, at the patient's last known address
2. Publish advance notice in a newspaper of general circulation within the practice area

A "current patient" under the statute is defined as any patient who had a patient encounter with the provider during the two-year period immediately preceding the date of the record transfer.

Patient Rights During Closure

Patients have the right to request that their records be:

• Sent to another like-regulated provider of their choice
• Provided directly to them

Any charges for copying and mailing records during a practice closure cannot exceed the actual costs incurred by the provider.

Relocation Definition

Virginia defines "relocation" as moving a Virginia practice more than 30 miles from its current location, or moving to another state or the District of Columbia. Moves of 30 miles or less within Virginia do not trigger the notice requirements.

Ongoing Retention Obligations

Even after a practice closes, the retention requirements of Va. Code § 54.1-2910.4 still apply. Records that have not been transferred to another provider or given to the patient must be maintained for the full minimum retention period (6 years from last encounter, up to 12 years from creation).

Penalties for Noncompliance

Virginia providers who fail to comply with medical records retention laws face several types of consequences.

State Licensing Actions

The Virginia Board of Medicine may take disciplinary action against practitioners who fail to maintain adequate records or who destroy records prematurely. Potential sanctions include reprimand, probation, license suspension, or license revocation.

Civil Liability

Under Va. Code § 8.01-413, providers who unlawfully refuse to provide records or charge excessive fees may be liable for damages, court costs, and attorney fees. Patients may seek court intervention to compel the production of records.

HIPAA Enforcement

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) enforces HIPAA requirements. Violations related to improper disposal of protected health information can result in civil monetary penalties ranging from $141 to $2,134,831 per violation category, per year.

Malpractice Implications

Providers who destroy records prematurely may face adverse inferences in malpractice litigation. If a provider cannot produce records during a malpractice suit, a court may instruct the jury to presume the missing records would have been unfavorable to the provider.