Washington Medical Records Retention Laws (2026 Guide)

Washington state has detailed rules governing how long hospitals, physicians, and other health care providers must keep patient medical records. These requirements come from a combination of state statutes, administrative rules, and federal regulations. Understanding them matters whether you are a patient trying to access old records, a provider managing storage, or a practice planning for closure.

This guide covers the current retention periods, federal requirements under HIPAA and CMS, patient access rights, proper destruction methods, and what happens when a medical practice closes in Washington.

Hospital Medical Records Retention in Washington

The 26-Year Rule Under RCW 70.41.190

Washington Governor Jay Inslee signed SB 5239 into law on April 22, 2025, fundamentally changing hospital record retention requirements. The new law took effect on July 27, 2025.

Under the amended RCW 70.41.190, hospitals must retain and preserve all medical records for a minimum of 26 years from the date the record was created. This replaced the previous requirement, which mandated retention for 10 years following patient discharge.

The old law created a practical problem: records without a clear discharge date had to be kept indefinitely. According to Sen. Vandana Slatter, the bill's sponsor, UW Medical Center alone was spending approximately $750,000 annually on storing decades-old records. The 26-year timeframe was chosen to ensure records of minor patients are preserved for at least 8 years beyond the age of 18.

What the New Law Covers

The 26-year requirement applies to:

• Medical records created before July 27, 2025, that the hospital still retained on that date
• All medical records created on or after July 27, 2025
• Records in any format, including paper, microfilm, and electronic media

Hospitals that had already properly disposed of records under the previous 10-year law before July 27, 2025, are not liable for those destroyed records.

WAC 246-320-166: Administrative Requirements

WAC 246-320-166 provides the administrative framework for hospital medical records management. Under this regulation, hospitals must:

• Maintain confidentiality and security of all patient records
• Initiate and sustain medical records for every patient evaluated or treated
• Ensure records contain patient identification, clinical data supporting diagnosis and treatment, signed consent documents, and entries that are accurately written, signed, dated, and timed
• Establish systematic methods for identifying, filing, and retrieving patient records
• File records accessibly and retain them per RCW 70.41.190 and chapter 5.46 RCW

Physician and Other Provider Retention Requirements

No Mandatory Statutory Period for Physicians

Unlike hospitals, Washington state does not have a general statute requiring individual physicians to retain medical records for a specific number of years. This is an important distinction that many providers and patients misunderstand.

However, the Washington Medical Commission (WMC) has issued formal guidance recommending that physicians retain medical records for at least 10 years from the date of the patient's last visit, prescription refill, telephone contact, test, or other contact. The WMC concurs with the Washington State Medical Association on this recommendation.

While this is technically a recommendation rather than a legal mandate, failing to follow it could factor into professional discipline proceedings or malpractice claims. The WMC considers record retention practices when evaluating complaints against physicians.

Retention Periods for Other Provider Types

Different categories of health care providers in Washington have specific retention requirements set by statute or rule:

Provider Type	Minimum Retention Period	Authority
Hospitals	26 years from date of creation	RCW 70.41.190
Nursing facilities	8 years from most recent discharge	RCW 18.51.300
Psychologists	8 years from last client contact	WAC 246-924-354
Physicians (recommended)	10 years from last contact	WMC Guideline
Podiatrists	7 years	WAC 246-922
Chiropractors	5 years	WAC 246-808

Records of Minor Patients

Washington has specific rules for retaining records of patients who were minors at the time of treatment:

• Hospitals: 26 years from date of creation under the amended RCW 70.41.190. Previously, the longer of 10 years after discharge or 3 years after the minor turned 18. The new 26-year rule provides even longer protection in most cases.
• Nursing facilities: The longer of 10 years after discharge or 3 years after the minor turns 18, under RCW 18.51.300.
• Psychologists: Until the client reaches age 22 or for 8 years after last contact, whichever is longer, under WAC 246-924-354.
• Physicians (recommended): The WMC recommends retaining records of minors until the patient reaches age of majority (18 in Washington per RCW 26.28) plus the standard retention period.

The age of majority in Washington is 18 years old. Because the statute of limitations for medical malpractice involving minors can extend beyond their 18th birthday, providers should retain records well beyond that age as a practical matter.

Federal Requirements: HIPAA and CMS

HIPAA Record Retention

A common misconception is that HIPAA requires health care providers to retain medical records for a specific number of years. According to the U.S. Department of Health and Human Services, the HIPAA Privacy Rule does not include a medical record retention requirement. State laws govern how long medical records must be retained.

However, HIPAA does require covered entities to retain certain HIPAA-related documentation for 6 years. This includes:

• Privacy policies and procedures
• Privacy practices notices
• Disposition of complaints
• Required accounting of disclosures
• Training records
• Patient authorization forms

This 6-year HIPAA documentation requirement is separate from medical record retention. Providers must comply with both their state retention obligations and the HIPAA documentation retention rule.

HIPAA also requires that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for the entire period the information is maintained, including through final disposal.

CMS Conditions of Participation

Hospitals participating in Medicare and Medicaid must comply with the Conditions of Participation under 42 CFR 482.24. These federal rules require that:

• A medical record must be maintained for every individual evaluated or treated in the hospital
• Records must be accurately written, promptly completed, properly filed and retained, and accessible
• The hospital must have a system for coding and indexing medical records

CMS requires Medicare providers to maintain medical records for at least 5 years from the date of service, though longer periods apply in some contexts. When state law requires a longer retention period, as Washington's 26-year hospital requirement does, the state law controls.

Patient Access to Medical Records

Rights Under RCW 70.02.080

Washington patients have a statutory right to access their own medical records under RCW 70.02.080. When a patient submits a written request, the provider must respond as promptly as the circumstances require, but no later than 15 working days.

If the provider cannot meet the 15-day deadline, they must notify the patient by that date, explain the reason for the delay, and complete the request no later than the 21st working day.

Upon request, providers must:

• Make records available for examination during regular business hours
• Provide copies if requested
• Inform patients if records do not exist or cannot be located
• Identify other providers who may hold the requested information
• Explain any codes or abbreviations used in the records

Fees for Copies

Under WAC 246-08-400, providers may charge the following maximum fees for medical record copies:

Fee Type	Maximum Amount
First 30 pages	$1.24 per page
Additional pages (beyond 30)	$0.90 per page
Clerical search and handling fee	$28.00
Editing for confidential information removal	Usual fee for a basic office visit

HIPAA-covered entities may not charge fees exceeding those permitted under federal regulation 45 CFR 164. The Washington Department of Health notes that the Secretary of Health adjusts these amounts biennially based on changes in the Consumer Price Index.

Right to Correct Records

Under RCW 70.02.100, patients may request in writing that a provider correct or amend inaccurate or incomplete information in their medical records. Providers must also maintain records for at least one year following receipt of an authorization to disclose health care information, per RCW 70.02.160.

Proper Destruction of Medical Records

State Requirements

When the applicable retention period has expired, Washington requires that medical records be destroyed by secure means. Records containing protected health information may not be discarded in public dumpsters or recycling bins.

WAC 246-101-635 specifies that health information should be destroyed by shredding with a crosscut shredder or by appropriately sanitizing electronic media before disposal.

HIPAA Destruction Standards

The HHS Office for Civil Rights requires covered entities to implement reasonable safeguards when disposing of protected health information. Acceptable destruction methods include:

For paper records:

• Shredding
• Incineration
• Pulping
• Any method that renders the information unreadable and impossible to reconstruct

For electronic records:

• Clearing (overwriting with non-sensitive data using software or hardware products)
• Purging (degaussing or exposing media to a strong magnetic field)
• Physical destruction (disintegration, pulverization, melting, incinerating, or shredding of the storage media)

Covered entities may hire a business associate to handle disposal, but they must have a proper Business Associate Agreement in place and ensure the contractor follows HIPAA-compliant destruction procedures.

Practice Closure and Record Transfer

Physician Practice Closure

When a Washington physician closes or sells a practice, the Washington Medical Commission requires the following steps:

1. Notify patients in writing about the practice closure and the plan for their records
2. Give patients a reasonable timeframe (typically at least 30 days) to request transfer of their records to another provider
3. Offer to transfer records to a provider the patient designates or return records directly to the patient
4. Arrange for a custodian if records cannot be immediately transferred. The custodian may be another physician or a commercial medical record storage company.
5. Ensure the custodian complies with all applicable state and federal confidentiality laws

The provider must document all closure-related communications and maintain records of which patients were notified and how their records were handled.

Hospital Closure

Under RCW 70.41.190, if a hospital ceases operations, it must make immediate arrangements, as approved by the Washington State Department of Health, for preservation of its records. The hospital cannot simply destroy records or abandon them upon closing.

Nursing Facility Closure

Similarly, RCW 18.51.300 requires nursing facilities that cease operations to make immediate arrangements, approved by the department, for preservation of patient care records.

Psychologist Practice Closure

WAC 246-924-354 requires psychologists to establish a written succession plan that designates qualified individuals or facilities to handle referrals and record requests if the psychologist retires, discontinues practice, or becomes unable to work.

Key Differences: Washington vs. Federal Requirements

Requirement	Washington State	Federal (HIPAA/CMS)
Hospital retention period	26 years from creation (RCW 70.41.190)	CMS: 5 years minimum
Physician retention period	No statutory mandate; 10 years recommended	No HIPAA mandate; state law governs
HIPAA documentation	N/A (federal rule)	6 years for policies, authorizations, training records
Patient access response time	15 working days (RCW 70.02.080)	30 days under HIPAA Right of Access
Records of minors	Varies by provider type	No specific federal rule

When state and federal requirements differ, providers must follow whichever standard imposes the longer retention period or stricter obligation.