Virginia
Virginia Medical Records Retention Laws (2026 Guide)
Independently fact-checked against primary sources (last audited August 18, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 18, 2026. · 13 primary sources cited on this page. How we verify our legal content
Virginia law sets different retention minimums depending on the provider type: hospitals must keep records for at least 5 years after patient discharge under 12 VAC 5-410-370, while physicians must retain records for a minimum of 6 years after the last patient encounter under Va. Code § 54.1-2910.4.
Last verified: March 2026. This page reflects the current Code of Virginia, Virginia Administrative Code, and federal regulations governing medical records retention in the Commonwealth.
Table of Contents
- Overview of Virginia Medical Records Retention Laws
- Hospital Records Retention Requirements
- Physician and Practitioner Retention Requirements
- Records for Minor Patients
- Federal Requirements: HIPAA and CMS
- Patient Access to Medical Records
- Fees for Copies of Medical Records
- Record Storage and Format Requirements
- Record Destruction Rules
- Practice Closure and Record Transfer
- Penalties for Noncompliance
- Frequently Asked Questions
Overview of Virginia Medical Records Retention Laws
Virginia law establishes different medical records retention periods depending on the type of health care provider. Hospitals follow regulations set by the Virginia Department of Health, while physicians and other practitioners follow rules issued by the Virginia Board of Medicine.
The two primary retention frameworks are:
- Hospitals: Minimum 5 years after patient discharge, governed by 12 VAC 5-410-370
- Physicians: Minimum 6 years after the last patient encounter, governed by Va. Code § 54.1-2910.4
Both frameworks include extended requirements for records of minors. Federal rules under HIPAA and CMS add additional layers of compliance for facilities that participate in Medicare or handle protected health information.
Virginia providers should treat these periods as minimums. Other obligations, including malpractice statutes of limitations, federal program participation, and contractual requirements, may require longer retention in practice.
Hospital Records Retention Requirements
Virginia's hospital medical records retention rules are found in the Regulations for the Licensure of Hospitals in Virginia, specifically 12 VAC 5-410-370. These regulations apply to all hospitals licensed by the Virginia Department of Health.
General Retention Period
All medical records, whether originals or accurate reproductions, must be preserved for a minimum of five years following the discharge of the patient. This applies to inpatient, outpatient, and emergency department records.
Hospitals must establish a medical record for every patient treated on an inpatient, outpatient, or emergency basis. A separate medical record is required for each newborn infant, including documentation of gestational history and delivery complications.
Birth and Death Records
Birth and death information must be retained for 10 years in accordance with Va. Code § 32.1-274. This longer period applies specifically to vital records documentation maintained by the hospital.
Storage Standards
Hospitals must make provisions for the safe storage of medical records or accurate and legible reproductions. Storage practices must comply with both Va. Code § 32.1-127.1:03 (Health Records Privacy) and the Health Insurance Portability and Accountability Act (HIPAA) at 42 U.S.C. § 1320d et seq.
| Record Type | Minimum Retention Period | Authority |
|---|---|---|
| Adult patient records | 5 years after discharge | 12 VAC 5-410-370 |
| Minor patient records | 5 years after patient turns 18 | 12 VAC 5-410-370 |
| Birth and death records | 10 years | Va. Code § 32.1-274 |
| Newborn records | 5 years after discharge (or minor rule, whichever is longer) | 12 VAC 5-410-370 |
Physician and Practitioner Retention Requirements
Physicians and other practitioners licensed under Chapter 29 of the Code of Virginia (Medicine and Other Healing Arts) follow a separate set of retention rules under Va. Code § 54.1-2910.4 and the Virginia Board of Medicine regulations at 18 VAC 85-20-26.
General Retention Period
Practitioners must maintain health records for a minimum of six years following the last patient encounter. This applies to all records as defined in Va. Code § 32.1-127.1:03.
Maximum Retention Period
Virginia law provides that practitioners are not required to maintain health records for longer than 12 years from the date of creation. This ceiling applies to adult patient records and gives practitioners a clear endpoint for retention obligations.
The exceptions to this 12-year maximum include:
- Records of minor patients (which follow the minor-specific rules described below)
- Records required by a contractual obligation to be maintained longer
- Records required by federal law to be maintained for a longer period
Transferred Records Exception
Practitioners are not required to retain records that have been transferred to another practitioner or health care provider, or that have been provided directly to the patient or the patient's personal representative. This allows practitioners to satisfy retention obligations through proper transfer rather than indefinite storage.
Record Management Standards
Under 18 VAC 85-20-26, practitioners must properly manage patient records and maintain timely, accurate, legible, and complete documentation. Records must be made available for transfer to other practitioners, patients, or authorized representatives in accordance with state law.
Records for Minor Patients
Both hospitals and physicians face extended retention periods for the records of minor patients. The rules differ slightly between the two provider types.
Hospital Rules for Minors
Under 12 VAC 5-410-370, hospital records for minors must be kept for at least five years after the minor has reached the age of 18. This means a hospital record created for a newborn must be retained for approximately 23 years from the date of creation.
For example, if a child is born in 2026, the hospital must retain that record until at least 2049 (when the child turns 18 plus five additional years).
Physician Rules for Minors
Under Va. Code § 54.1-2910.4, physician records for minor children, including immunization records, must be maintained until the child reaches the age of 18 or becomes emancipated. The minimum retention period of six years from the last patient encounter still applies regardless of the patient's age.
In practice, this means a physician who last treats a 10-year-old patient in 2026 must keep those records until at least 2034 (when the child turns 18), or 2032 (six years from the last encounter), whichever is later.
| Provider Type | Minor Record Retention | Practical Minimum |
|---|---|---|
| Hospitals | 5 years after patient turns 18 | Up to 23 years from birth |
| Physicians | Until age 18 or emancipation (6-year minimum) | Up to 18 years from birth |
Federal Requirements: HIPAA and CMS
Virginia providers must also comply with federal requirements that affect medical records management, even though federal law does not impose a single nationwide retention period.
HIPAA (Health Insurance Portability and Accountability Act)
The HIPAA Privacy Rule does not require covered entities to retain medical records for any specific period. According to the U.S. Department of Health and Human Services, HIPAA defers to state law on retention periods.
However, HIPAA does require covered entities to:
- Retain HIPAA-related documentation (policies, procedures, and compliance records) for six years from the date of creation or the date it was last in effect, whichever is later (45 CFR § 164.530(j))
- Apply appropriate administrative, technical, and physical safeguards to protect records throughout retention
- Implement policies for the secure disposal of electronic protected health information (ePHI) and the hardware or media on which it is stored
This means Virginia providers must keep their HIPAA compliance documentation for six years, even though the medical records themselves follow Virginia's state retention schedule.
CMS Conditions of Participation
Hospitals that participate in Medicare must meet the Conditions of Participation under 42 CFR § 482.24. These federal regulations require hospitals to maintain medical records that are accurately written, promptly completed, properly filed and retained, and accessible.
42 CFR § 482.24(b)(1) sets an explicit federal floor: hospitals must retain medical records in their original or legally reproduced form for a period of at least 5 years. Beyond that floor, CMS guidance and Medicare billing rules can effectively call for longer retention depending on the record type; Medicare claims records, for example, are often retained for at least 7 years to support potential audits.
Virginia hospitals should follow whichever period is longer: Virginia's 5-year state minimum or the applicable CMS/Medicare retention guidance.
Patient Access to Medical Records
Virginia law provides patients with clear rights to access their own medical records. These rights are established primarily through Va. Code § 32.1-127.1:03 and Va. Code § 8.01-413.
Who Can Request Records
Two different statutes govern access, and who may request records depends on which one applies:
- A patient's own records: under Va. Code § 32.1-127.1:03, the individual or the individual's personal representative may request a copy of the health record.
- Requests in anticipation of or during litigation: under Va. Code § 8.01-413 subsection D, the patient, the patient's attorney, the patient's executor or administrator, or an authorized insurer may request records.
Response Timeline
Health care providers must furnish copies of requested records within 30 days of receiving a written request. If the provider cannot meet this deadline, they must notify the requester in writing explaining the reason for the delay. The provider then has an additional 30 days to comply.
Providers must also include an audit trail of any additions, deletions, or revisions to the health record if specifically requested.
Format Options
Providers must produce records in either paper (hard copy) or electronic format, as requested by the requester. When electronic format is requested, the provider should furnish the records in an available electronic format. Providers may decline an electronic format request only if it would require substantial additional cost, modify the records, or compromise their integrity.
Nonpayment and Records Requests
Va. Code § 8.01-413 subsection B9 provides that production of health records to the patient, or to the patient's attorney, requested pursuant to that section shall not be withheld or delayed solely on the grounds of nonpayment for the records. Read together with subsection D, which limits the whole section to requests made in anticipation of litigation or in the course of litigation, that protection is written for litigation-related requests rather than as a blanket rule for every records request.
A routine request by a patient for a copy of their own records is governed instead by Va. Code § 32.1-127.1:03, which allows a reasonable cost-based copying fee and contains no equivalent nonpayment provision. Patients who are told a copy is being held over a balance should ask the provider which statute it is relying on and, where litigation is involved, point to § 8.01-413(B9).
Fees for Copies of Medical Records
What a Virginia provider may charge for copies depends on why the records were requested. Two statutes apply, and they set materially different standards, so the applicable one has to be identified first.
Routine Patient Requests for Your Own Records
A request by a patient for a copy of their own health record is governed by subsection J of Va. Code § 32.1-127.1:03. Subsection G of Va. Code § 8.01-413 expressly carves such requests out of its own fee provisions and routes them to that subsection.
Under § 32.1-127.1:03(J), the health care entity may impose a reasonable cost-based fee, which shall include only:
- The cost of supplies for copying the requested information
- The labor of copying the requested information
- Postage, when the individual asks that the records be mailed
- Preparation of an explanation or summary of the information, as agreed to by the individual
This standard sets no fixed per-page dollar caps and no maximum total charge. The charge must be reasonable and cost-based, and it may not recover costs outside that list.
One Free Copy Per Calendar Year for Benefit Claims
Subsection B7 of Va. Code § 8.01-413 requires a provider to furnish one free copy per calendar year of a patient's records stored or maintained in an electronic health record, when the patient or the patient's attorney requests them to support a claim or appeal under Title II, XVI, XVIII, or XIX of the Social Security Act, under 38 U.S.C. § 101 et seq., or under any federal or state financial needs-based benefit program. The request must be supported by reasonable documentation, such as a Social Security Administration appointment form or hearing notice.
Section 32.1-127.1:03(J) opens with an express exception for subsection B7, so this free copy applies to a patient's own-records request as well. Additional requests in the same calendar year are subject to a reasonable fee, and no fee may be charged if no records are found in response to the request.
Litigation-Related Requests: Paper Copies
The per-page schedule below comes from Va. Code § 8.01-413. Subsection D limits that section to requests by the patient, the patient's attorney, the patient's executor or administrator, or an authorized insurer, made in anticipation of litigation or in the course of litigation. These figures are not the general cap on what a provider may charge a patient for a routine copy of their own chart.
| Pages | Maximum Fee Per Page |
|---|---|
| First 50 pages | $0.50 per page |
| Pages 51 and beyond | $0.25 per page |
| From microfilm | $1.00 per page |
Litigation-Related Requests: Electronic Copies
| Pages | Maximum Fee Per Page |
|---|---|
| First 50 pages | $0.37 per page |
| Pages 51 and beyond | $0.18 per page |
| Maximum total charge | $160 (including search/handling and shipping) |
Additional Allowable Charges for Litigation-Related Requests
- Search and handling fee: Up to $20
- Postage and shipping: Actual costs
- X-ray/imaging studies (electronic): $25 per study plus $10 search/handling fee
- X-ray/imaging studies (hard copy): Actual cost of supplies and labor plus $10 search/handling fee
Under § 8.01-413(C), if a court finds that a provider willfully refused to comply with a written request made in accordance with subsection B, the court may award the expenses the patient or authorized insurer incurred to obtain the copies, a refund of fees already paid, court costs, and reasonable attorney fees.
Record Storage and Format Requirements
Virginia law permits health care providers to store medical records in a variety of formats. Under Va. Code § 32.1-127.1:01, providers may maintain records using:
- Computerized or other electronic processes
- Microfilm
- Other photographic, mechanical, or chemical processes
Once records have been converted to an unalterable technological format, the provider may dispose of the original paper documents. However, this disposal must be done in a manner that preserves patient confidentiality.
Any documents or information that cannot be stored in a technological format must be identified and preserved separately. This ensures that no part of the patient record is lost during format conversion.
Providers using electronic health records (EHR) systems should ensure their systems maintain data integrity, include audit trails, and meet both HIPAA security requirements and Virginia state standards.
Record Destruction Rules
When medical records have been retained for the required minimum period, Virginia law permits their destruction. However, the destruction process must follow specific rules to protect patient privacy.
Acceptable Destruction Methods
Under 18 VAC 85-20-26, patient records may only be destroyed in a manner that protects patient confidentiality. The regulation specifically identifies the following acceptable methods:
- Incineration of paper records
- Shredding of paper records
- Secure electronic deletion of digital records, including wiping of storage media
Patient Notification Requirement
Practitioners are required to post information or otherwise inform all patients about the timeframe for record retention and destruction. This notification should be part of the practice's standard patient communications, such as intake forms, office signage, or the practice website.
This transparency requirement ensures patients know when their records may be destroyed and can request copies before that happens.
HIPAA Disposal Requirements
In addition to Virginia state requirements, HIPAA requires covered entities to implement policies and procedures that address the final disposition of electronic protected health information (ePHI). This includes procedures for removing ePHI from electronic media before the media are made available for reuse or disposal.
Paper records containing protected health information must also be disposed of securely. Placing unshredded documents in a standard trash receptacle does not meet HIPAA disposal requirements.
Practice Closure and Record Transfer
When a Virginia physician or health care practitioner closes, sells, or relocates a practice, Va. Code § 54.1-2405 establishes specific requirements for handling patient records.
Notice Requirements
Before transferring patient records, the provider must:
- Attempt to notify current patients of the pending transfer, either electronically or by mail, at the patient's last known address
- Publish advance notice in a newspaper of general circulation within the practice area
A "current patient" under the statute is defined as any patient who had a patient encounter with the provider during the two-year period immediately preceding the date of the record transfer.
Patient Rights During Closure
Patients have the right to request that their records be:
- Sent to another like-regulated provider of their choice
- Provided directly to them
Any charges for copying and mailing records during a practice closure cannot exceed the actual costs incurred by the provider.
Relocation Definition
Virginia defines "relocation" as moving a Virginia practice more than 30 miles from its current location, or moving to another state or the District of Columbia. Moves of 30 miles or less within Virginia do not trigger the notice requirements.
Ongoing Retention Obligations
Even after a practice closes, the retention requirements of Va. Code § 54.1-2910.4 still apply. Records that have not been transferred to another provider or given to the patient must be maintained for the full minimum retention period (6 years from last encounter, up to 12 years from creation).
Penalties for Noncompliance
Virginia providers who fail to comply with medical records retention laws face several types of consequences.
State Licensing Actions
The Virginia Board of Medicine may take disciplinary action against practitioners who fail to maintain adequate records or who destroy records prematurely. Potential sanctions include reprimand, probation, license suspension, or license revocation.
Civil Liability
Under Va. Code § 8.01-413, providers who unlawfully refuse to provide records or charge excessive fees may be liable for damages, court costs, and attorney fees. Patients may seek court intervention to compel the production of records.
HIPAA Enforcement
The U.S. Department of Health and Human Services Office for Civil Rights (OCR) enforces HIPAA requirements. Violations related to improper disposal of protected health information can result in civil monetary penalties ranging from $145 to $73,011 per violation depending on the level of culpability (up to $2,190,294 for the most serious tier), with a calendar-year cap of $2,190,294 for all violations of an identical provision, under the inflation-adjusted tiers effective January 28, 2026 (91 FR 3665; 45 CFR 160.404).
Malpractice Implications
Providers who destroy records prematurely may face adverse inferences in malpractice litigation. If a provider cannot produce records during a malpractice suit, a court may instruct the jury to presume the missing records would have been unfavorable to the provider.
Frequently Asked Questions
How long do Virginia hospitals have to keep medical records?
Virginia hospitals must retain medical records for a minimum of 5 years following the discharge of the patient under 12 VAC 5-410-370. Records for minor patients must be kept for at least 5 years after the patient turns 18. Birth and death records must be retained for 10 years under Va. Code § 32.1-274.
How long do Virginia physicians have to keep patient records?
Virginia physicians must maintain patient records for a minimum of 6 years following the last patient encounter under Va. Code § 54.1-2910.4. Physicians are not required to keep records longer than 12 years from the date of creation, except for minor patients and records subject to federal law or contractual obligations.
Can I get copies of my medical records in Virginia, and what does it cost?
Virginia law gives patients the right to request copies of their medical records, and a provider must respond within 30 days under Va. Code § 32.1-127.1:03. For a routine request for your own records, the fee is set by § 32.1-127.1:03(J): a reasonable cost-based fee covering only copying supplies, copying labor, postage if you ask for mailing, and any summary you agree to, with no per-page dollar cap. The per-page caps in Va. Code § 8.01-413 (such as $0.50 per page for the first 50 pages) apply on their own terms only to requests made in anticipation of or during litigation. Separately, § 8.01-413(B7) requires one free copy per calendar year of records held in an electronic health record when you or your attorney request them to support a Social Security, veterans, or other needs-based benefit claim or appeal.
What happens to my medical records if my doctor retires or closes their practice?
Under Va. Code § 54.1-2405, a physician closing or relocating a practice must attempt to notify current patients (those seen within the past 2 years) by mail or electronically, and must also publish notice in a local newspaper. Patients can request that records be transferred to another provider or provided directly to them. Copying and mailing charges cannot exceed the provider's actual costs.
Does HIPAA require a specific medical records retention period?
No. The HIPAA Privacy Rule does not set a minimum retention period for medical records. According to the U.S. Department of Health and Human Services, retention periods are governed by state law. However, HIPAA does require covered entities to retain compliance-related documentation (policies, procedures, and training records) for 6 years, and to follow secure disposal practices when destroying records containing protected health information.
Updates
Corrected the copy-fee section: a routine request for your own records is governed by the reasonable cost-based fee standard in Va. Code 32.1-127.1:03(J), not the per-page schedule in Va. Code 8.01-413, which applies to litigation-related requests, and added the one-free-copy-per-year entitlement for Social Security, veterans, and other needs-based benefit claims.
Updated the HIPAA civil-penalty figures to the January 28, 2026 inflation-adjusted amounts.
Independently fact-checked against the cited primary sources; governing law re-checked for recent changes
Governing law re-checked for recent changes
Corrected a claim that 42 CFR 482.24 sets no explicit retention period -- the regulation's text at (b)(1) requires hospitals to retain medical records for at least 5 years.
Governing law re-checked for recent changes
Reviewed and approved by an editor
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
Code of Virginia, Title 54.1: Professions and Occupations
§ 54.1-2910.4Health record retentionIn force
Practitioners licensed under this chapter shall maintain health records, as defined in § 32.1-127.1:03, for a minimum of six years following the last patient encounter. However, such practitioners are not required to maintain health records for longer than 12 years from the date of creation except for (i) health records of a minor child, including immunizations, which shall be maintained until the child reaches the age of 18 or becomes emancipated, with a minimum time for record retention of six years from the last patient encounter regardless of the age of the child or (ii) health records that are required by contractual obligation or federal law to be maintained for a longer period of time. Health records that have previously been transferred to another practitioner or health care provider or provided to the patient or his personal representative are not required to be maintained beyond such transfer or provision.
Official text (excerpt) · last checked 2026-09-07 · Read the full text in our law library · Verify at law.lis.virginia.gov
§ 54.1-2405Transfer of patient records in conjunction with closure, sale, or relocation of practice; notice requiredIn force
A. No person licensed, registered, or certified by one of the health regulatory boards under the Department shall transfer records pertaining to a current patient in conjunction with the closure, sale or relocation of a professional practice until such person has first attempted to notify the patient of the pending transfer, either electronically or by mail, at the patient's last known address, and by publishing prior notice in a newspaper of general circulation within the provider's practice area, as specified in § 8.01-324. The notice shall specify that, at the written request of the patient or an authorized representative, the records or copies will be sent, within a reasonable time, to any other like-regulated provider of the patient's choice or provided to the patient pursuant to § 32.1-127.1:03. The notice shall also disclose whether any charges will be billed by the provider for supplying the patient or the provider chosen by the patient with the originals or copies of the patient's records. Such charges shall not exceed the actual costs of copying and mailing or delivering the records. B.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at law.lis.virginia.gov
Code of Virginia, Title 32.1: Health
§ 32.1-127.1:03Health records privacyIn forcecited in 2 of our articles
A. There is hereby recognized an individual's right of privacy in the content of his health records. Health records are the property of the health care entity maintaining them, and, except when permitted or required by this section or by other provisions of state law, no health care entity, or other person working in a health care setting, may disclose an individual's health records. Pursuant to this subsection: 1. Health care entities shall disclose health records to the individual who is the subject of the health record, including an audit trail of any additions, deletions, or revisions to the health record, if specifically requested, except as provided in subsections E and F and subsection B of § 8.01-413. 2. Health records shall not be removed from the premises where they are maintained without the approval of the health care entity that maintains such health records, except in accordance with a court order or subpoena consistent with subsection C of § 8.01-413 or with this section or in accordance with the regulations relating to change of ownership of health records promulgated by a health regulatory board established in Title 54.1. 3.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at law.lis.virginia.gov
Cited in 9 court opinions in our collectionLatest citing opinion in our collection: 2025
Opinions citing this section in our collection:
- Crystal Houston v. City of Newport News Department of Human Services (Court of Appeals of Virginia 2017)“…a. Code Section 8.01-399, Va. Code Section 8.01-400.2, and Va. Code Section 32.1-127.1:03(H), the patient privacy provisions of…”
- United States v. Sutherland (District Court, W.D. Virginia 2001, 143 F. Supp. 2d 609)“…notice of his or her rights and remedies under the statute. Va.Code Ann. § 32.1-127.1:03(H). The statute gives patients the righ…”
- Maple v. Colonial Orthopaedics, Inc. (In Re Maple) (United States Bankruptcy Court, E.D. Virginia 2010, 434 B.R. 363)“…l’s right of privacy in the content of his health records.” Va.Code Ann. § 32.1-127.1:03 (2010). “[N]o health care entity ... ma…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Virginia Medical Recording Laws: Patient Rights and Healthcare Privacy
§ 32.1-127.1:01Record storageIn force
A. Health records, as defined in § 32.1-127.1:03, may be stored by computerized or other electronic process or microfilm, or other photographic, mechanical, or chemical process; however, the stored record shall identify the location of any documents or information that could not be so technologically stored. If the technological storage process creates an unalterable record, the nursing facility, hospital or other licensed health care provider shall not be required to maintain paper copies of health records that have been stored by computerized or other electronic process, microfilm, or other photographic, mechanical, or chemical process. Upon completing such technological storage, paper copies of health records may be destroyed in a manner that preserves the patient's confidentiality. However, any documents or information that could not be so technologically stored shall be preserved. B. Notwithstanding the authority of this section to copy health records in the form of microfilm, prescription dispensing records maintained in or on behalf of any pharmacy registered or permitted in Virginia shall only be stored in compliance with §§ 54.1-3410, 54.1-3411, and 54.1-3412.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at law.lis.virginia.gov
§ 32.1-274Persons in charge of institutions and funeral directors, etc., to keep records; lists sent to State RegistrarIn force
A. Every person in charge of an institution shall keep a record of personal data concerning each person admitted or confined to such institution. This record shall include such information as required for the certificates of birth, death, and reports of spontaneous fetal death and induced termination of pregnancy required by this chapter. The record shall be made at the time of admission from information provided by the person being admitted or confined, but when it cannot be so obtained, the information shall be obtained from relatives or other persons acquainted with the facts. The name and address of the person providing the information shall be a part of the record. B. When a dead human body is released or disposed of by an institution, the person in charge of the institution shall keep a record showing the name of the deceased, date of death, the name and address of the person to whom the body is released and the date of removal from the institution, or, if final disposal is by the institution, the date, place, and manner of disposition. C.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at law.lis.virginia.gov
Code of Virginia, Title 8.01: Civil Remedies and Procedure
§ 8.01-413Certain copies of health care provider's health records of patient admissible; right of patient, his attorney and authorized insurer to copies of such health records; subpoena; damages, costs and attorney feesIn force
A. In any case where the health records of a health care provider for any patient in a hospital or institution for the treatment of physical or mental illness are admissible or would be admissible as evidence, any typewritten copy, photograph, photostatted copy, or microphotograph or printout or other hard copy generated from computerized or other electronic storage, microfilm, or other photographic, mechanical, electronic, imaging, or chemical storage process thereof shall be admissible as evidence in any court of the Commonwealth in like manner as the original, if the printout or hard copy or microphotograph or photograph is properly authenticated by the employees having authority to release or produce the original health records. Any health care provider whose health records relating to any such patient are subpoenaed for production as provided by law may comply with the subpoena by a timely mailing to the clerk issuing the subpoena or in whose court the action is pending properly authenticated copies, photographs or microphotographs in lieu of the originals.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at law.lis.virginia.gov
Cited in 5 court opinions in our collectionLatest citing opinion in our collection: 2025
Opinions citing this section in our collection:
- McCaulley v. Purdue Pharma, L.P. (District Court, W.D. Virginia 2001, 172 F. Supp. 2d 803)“…thheld from a patient or her attorney. See Va.Code Ann. § 8.01-413 (Michie Supp. 2001). 13…”
- Dexter Drake Coffin, III Jo Anne J. Coffin v. Tracy Collette Bridges (Court of Appeals for the Fourth Circuit 1995, 72 F.3d 126)“…uthorization, mental health records are also discoverable. Va.Code Ann. Sec. 8.01-413 (1995) 2…”
- Ferguson v. Norfolk Southern Corp. (District Court, W.D. Virginia 1987, 704 F. Supp. 666)“…and suspension. Finally, he accuses Dr. Blair of violating Va.Code § 8.01-413 by failing to provide him with a…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Code of Federal Regulations Title 42
§ 482.24Condition of participation: Medical record services.In forcecited in 53 of our articles
The hospital must have a medical record service that has administrative responsibility for medical records. A medical record must be maintained for every individual evaluated or treated in the hospital. (a) Standard: Organization and staffing. The organization of the medical record service must be appropriate to the scope and complexity of the services performed. The hospital must employ adequate personnel to ensure prompt completion, filing, and retrieval of records. (b) Standard: Form and retention of record. The hospital must maintain a medical record for each inpatient and outpatient. Medical records must be accurately written, promptly completed, properly filed and retained, and accessible. The hospital must use a system of author identification and record maintenance that ensures the integrity of the authentification and protects the security of all record entries. (1) Medical records must be retained in their original or legally reproduced form for a period of at least 5 years. (2) The hospital must have a system of coding and indexing medical records. The system must allow for timely retrieval by diagnosis and procedure, in order to support medical care evaluation studies.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 18 court opinions in our collectionLatest citing opinion in our collection: 2024
In the courts (editorial summary, independently checked):United States ex rel. Janssen v. Lawrence Memorial Hospital (2020) held the accurate medical record duty in 42 C.F.R. 482.24 is a generic regulatory requirement that does not establish False Claims Act materiality. United States Ex Rel. El-Amin v. George Washington University (2008) applied 482.24(c) to record completion evidence.
Opinions citing this section in our collection:
- United States ex rel. Janssen v. Lawrence Memorial Hospital (Court of Appeals for the Tenth Circuit 2020, 949 F.3d 533)✓A relator alleged the hospital falsified patient arrival times to raise its Medicare quality-program payments. The court held the general duty to keep accurate medical records under 42 C.F.R. 482.24 does not address those programs and cannot show False Claims Act materiality.
- United States Ex Rel. El-Amin v. George Washington University (District Court, District of Columbia 2008, 533 F. Supp. 2d 12)✓Nurse anesthetists claimed the hospital billed Medicare as though anesthesiologists performed whole procedures. Citing the 30-day rule in 42 C.F.R. 482.24(c)(2), the court excluded late-signing evidence, and excluded mass-signing evidence too though (c)(1) made it probative.
- NATIONAL ASS'N OF PSYCHIATRIC HEALTH SYSTEM v. Shalala (District Court, District of Columbia 2000, 120 F. Supp. 2d 33)“…to preexisting recordkeeping requirements, as specified in 42 C.F.R. § 482.24 . 7 . Proposed Rul…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: How Long Do Hospitals Keep Medical Records? (2026), How to Find Old Medical Records Online, Medical Records Retention Laws by State (2026 Guide)
Code of Federal Regulations Title 45
§ 164.530Administrative requirements.In forcecited in 42 of our articles
(a)(1) Standard: Personnel designations. (i) A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity. (ii) A covered entity must designate a contact person or office who is responsible for receiving complaints under this section and who is able to provide further information about matters covered by the notice required by § 164.520. (2) Implementation specification: Personnel designations. A covered entity must document the personnel designations in paragraph (a)(1) of this section as required by paragraph (j) of this section. (b)(1) Standard: Training. A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity. (2) Implementation specifications: Training.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 23 court opinions in our collectionLatest citing opinion in our collection: 2025
In the courts (editorial summary, independently checked):Surprise v. Innovation Group, Inc. (2013) applied 45 CFR 164.530(c), noting it requires appropriate safeguards but does not specify what they must be, and rejected a wrongful discharge claim resting on it. Baum v. KEYSTONE MERCY HEALTH PLAN (2011) treated the same duty as background to state tort claims and remanded.
Opinions citing this section in our collection:
- Baum v. KEYSTONE MERCY HEALTH PLAN (District Court, E.D. Pennsylvania 2011, 826 F. Supp. 2d 718)✓A lost flash drive exposed health data on 280,000 insured children, and a parent sued in state court for negligence per se. The court held that resting the claim on the HIPAA safeguard rule at 45 C.F.R. 164.530(c)(2)(i) raised no substantial federal question, and remanded.
- Surprise v. Innovation Group, Inc. (District Court, D. Massachusetts 2013, 925 F. Supp. 2d 134)✓An employee fired after complaining that health-information documents went into unsecured trash sued for wrongful discharge. The court read 45 C.F.R. 164.530(c) to require safeguards without prescribing a method, and held HIPAA disposal rules are not well-defined public policy.
- Michael Terpin v. at and T Mobility LLC (Court of Appeals for the Ninth Circuit 2024, 118 F.4th 1102)“…viders to protect patients’ “protected health information.” 45 C.F.R. § 164.530(c)(1); Moore, 299 Cal. Rptr. 3d at 561.…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: HIPAA and Subpoenas: When Can PHI Be Disclosed? (2026), Alaska Medical Records Retention Laws (2026 Guide), Arizona Medical Records Retention Laws (2026 Guide)
§ 160.404Amount of a civil money penalty.In forcecited in 14 of our articles
(a) The amount of a civil money penalty will be determined in accordance with paragraph (b) of this section, and §§ 160.406, 160.408, and 160.412. These amounts were adjusted in accordance with the Federal Civil Monetary Penalty Inflation Adjustment Act of 1990, (Pub. L. 101-140), as amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, (section 701 of Pub. L. 114-74), and appear at 45 CFR part 102. These amounts will be updated annually and published at 45 CFR part 102.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 2 court opinions in our collectionLatest citing opinion in our collection: 2025
Opinions citing this section in our collection:
- Kirstyn Bashaw v. Majestic Care of Whitehall (Court of Appeals for the Sixth Circuit 2025, 130 F.4th 542)“…de range of civil penalties. See 45 C.F.R. § 160.404. And Nieset testified that Bashaw’s reco…”
- Planned Parenthood Minnesota, North Dakota, South Dakota v. Daugaard (District Court, D. South Dakota 2021)“…ble diligence, would not have known” about the disclosure. 45 C.F.R. § 160.404(b)(2)(i). While the Unif…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Montana Medical Recording Laws: Patient Rights, HIPAA, and Consent Rules (2026), Oregon Medical Recording Laws: Patient Rights, HIPAA, and Consent, Arkansas Medical Recording Laws: Patient Rights, HIPAA, and One-Party Consent (2026)
United States Code Title 42
§ 1320dDefinitionsIn force
For purposes of this part: The term “code set” means any set of codes used for encoding data elements, such as tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes. The term “health care clearinghouse” means a public or private entity that processes or facilitates the processing of nonstandard data elements of health information into standard data elements. The term “health care provider” includes a provider of services (as defined in section 1395x(u) of this title), a provider of medical or other health services (as defined in section 1395x(s) of this title), and any other person furnishing health care services or supplies. The term “health information” means any information, whether oral or recorded in any form or medium, that— is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 574 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Tyquan Stewart v. Parkview Hospital (Court of Appeals for the Seventh Circuit 2019)“…ure of medical records with‐ out the patient’s consent. See 42 U.S.C. §§ 1320d–1 to d–7. But nowhere does the statute…”
- Law v. Zuckerman (District Court, D. Maryland 2004, 307 F. Supp. 2d 705)“…Portability Accountability Act of *707 1996, 42 U.S.C. 1320d et seq. (“HIPAA”). The Cou…”
- Johnson v. Quander (District Court, District of Columbia 2005, 370 F. Supp. 2d 79)“…ance Portability and Accountability Act of 1996 (“HIPAA”), '42 U.S.C. §§ 1320d to d-8; and the International Conventio…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
United States Code Title 38
§ 101DefinitionsIn force
For the purposes of this title— The terms “Secretary” and “Department” mean the Secretary of Veterans Affairs and the Department of Veterans Affairs, respectively. The term “veteran” means a person who served in the active military, naval, air, or space service, and who was discharged or released therefrom under conditions other than dishonorable. The term “surviving spouse” means (except for purposes of chapter 19 of this title) a person who was the spouse of a veteran at the time of the veteran’s death, and who lived with the veteran continuously from the date of marriage to the date of the veteran’s death (except where there was a separation which was due to the misconduct of, or procured by, the veteran without the fault of the spouse) and who has not remarried.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at uscode.house.gov
Cited in 638 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Rowland v. California Men's Colony, Unit II Men's Advisory Council (Supreme Court of the United States 1993, 506 U.S. 194)“…therwise" in statutes dealing with marriage, see, e. g., 38 U. S. C. § 101 (31) ("The term `spouse' means a person…”
- Johnson v. Robison (Supreme Court of the United States 1974, 415 U.S. 361)“…as a “veteran who . . . served on active duty” (defined in 38 U. S. C. § 101 (21) as “full-time duty in the Armed F…”
- Jerry R. Shedden, Claimant-Appellant v. Anthony J. Principi, Secretary of Veterans Affairs (Court of Appeals for the Federal Circuit 2004, 381 F.3d 1163)“…d" means the same thing as "incurred in the line of duty." 38 U.S.C. § 101 (16) states that: The term service-conn…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Sources and References
- 12 VAC 5-410-370 - Hospital Medical Records Retention(law.lis.virginia.gov).gov
- Va. Code § 54.1-2910.4 - Health Record Retention(law.lis.virginia.gov).gov
- 18 VAC 85-20-26 - Patient Records (Virginia Board of Medicine)(law.lis.virginia.gov).gov
- Va. Code § 32.1-127.1:03 - Health Records Privacy(law.lis.virginia.gov).gov
- Va. Code § 8.01-413 - Patient Right to Copies of Health Records(law.lis.virginia.gov).gov
- Va. Code § 54.1-2405 - Transfer of Patient Records (Practice Closure)(law.lis.virginia.gov).gov
- Va. Code § 32.1-127.1:01 - Record Storage(law.lis.virginia.gov).gov
- Va. Code § 32.1-274 - Vital Records Retention(law.lis.virginia.gov).gov
- HHS HIPAA Privacy Rule Summary(hhs.gov).gov
- HHS FAQ - Does HIPAA Require Record Retention?(hhs.gov).gov
- CMS Medical Record Maintenance and Access Requirements(cms.gov).gov
- HHS HIPAA Right of Access - 45 CFR § 164.524(hhs.gov).gov
- HHS, Annual Civil Monetary Penalties Inflation Adjustment, 91 FR 3665 (Jan. 28, 2026): 2026 HIPAA civil penalty tiers (45 CFR 160.404)(federalregister.gov).gov