Washington Medical Records Retention Laws (2026 Guide)

Washington hospitals must retain medical records for at least 26 years from the date of creation under RCW 70.41.190, as amended by SB 5239. Individual physicians have no statutory mandate, but the Washington Medical Commission recommends 10 years from last patient contact. HIPAA does not set its own medical record retention period.

Washington state has detailed rules governing how long hospitals, physicians, and other health care providers must keep patient medical records. These requirements come from a combination of state statutes, administrative rules, and federal regulations. Understanding them matters whether you are a patient trying to access old records, a provider managing storage, or a practice planning for closure.

This guide covers the current retention periods, federal requirements under HIPAA and CMS, patient access rights, proper destruction methods, and what happens when a medical practice closes in Washington.

Hospital Medical Records Retention in Washington

The 26-Year Rule Under RCW 70.41.190

Washington Governor Bob Ferguson signed SB 5239 into law on April 22, 2025, fundamentally changing hospital record retention requirements. The new law took effect on July 27, 2025.

Under the amended RCW 70.41.190 (2025 c 131 s 1), hospitals must retain and preserve all medical records for a minimum of 26 years from the date the record was created. This replaced the previous requirement, which mandated retention for 10 years following patient discharge.

"A hospital shall retain and preserve all medical records for a minimum period of 26 years from the date the record was created." RCW 70.41.190

The old law created a practical problem: records without a clear discharge date had to be kept indefinitely. According to Sen. Vandana Slatter, the bill's sponsor, UW Medical Center alone was spending approximately $750,000 annually on storing decades-old records.

What the New Law Covers

The 26-year requirement applies to:

• Medical records created before July 27, 2025, that the hospital still retained on that date
• All medical records created on or after July 27, 2025
• Records in any format. The statute permits a hospital to retain records on paper, microfilm, electronically, or on other media.

The 26-year requirement does not reach records the hospital no longer held on July 27, 2025, provided the hospital complied with the prior version of the statute when it destroyed or otherwise disposed of them.

WAC 246-320-166: Administrative Requirements

WAC 246-320-166 provides the administrative framework for hospital medical records management. Under this regulation, hospitals must:

• Maintain confidentiality and security of all patient records
• Initiate and sustain medical records for every patient evaluated or treated
• Ensure records contain patient identification, clinical data supporting diagnosis and treatment, signed consent documents, and entries that are accurately written, signed, dated, and timed
• Establish systematic methods for identifying, filing, and retrieving patient records
• File records accessibly and retain them per RCW 70.41.190 and chapter 5.46 RCW

Physician and Other Provider Retention Requirements

No Mandatory Statutory Period for Physicians

Unlike hospitals, Washington state does not have a general statute requiring individual physicians to retain medical records for a specific number of years. This is an important distinction that many providers and patients misunderstand.

"There is no general law in Washington requiring a practitioner to retain a patient's medical record for a specific period of time." Washington Medical Commission, Medical Records Guideline GUI2024-01

The Washington Medical Commission (WMC) has issued formal guidance recommending retention periods anyway. Concurring with the Washington State Medical Association, the WMC recommends that practitioners retain medical records and x-rays for at least:

• Ten years from the date of a patient's last visit, prescription refill, telephone contact, test, or other patient contact
• Twenty-one years from the date of a minor patient's birth
• Six years from the date of a patient's death
• Indefinitely, if the practitioner has reason to believe the patient is or was incompetent, there are or were significant concerns involving the patient's care, or the patient is or is likely to become involved in litigation

The WMC also advises practitioners to consider whether retaining records indefinitely is feasible, to verify the retention time their medical malpractice insurer requires, and to tell patients how long records will be kept.

While these are recommendations rather than legal mandates, failing to follow them could factor into professional discipline proceedings or malpractice claims. The WMC considers record retention practices when evaluating complaints against physicians.

Retention Periods for Other Provider Types

Different categories of health care providers in Washington have specific retention requirements set by statute or rule:

Records of Minor Patients

Washington has specific rules for retaining records of patients who were minors at the time of treatment:

• Hospitals: 26 years from date of creation under the amended RCW 70.41.190. Previously, the longer of 10 years after discharge or 3 years after the minor turned 18. The new 26-year rule provides even longer protection in most cases.
• Nursing facilities: The longer of 10 years after discharge or 3 years after the minor turns 18, under RCW 18.51.300.
• Psychologists: Until the client reaches age 22 or for 8 years after last contact, whichever is longer, under WAC 246-924-354.
• Physicians (recommended): The WMC recommends retaining a minor patient's records for 21 years from the date of the patient's birth.

Each of these rules runs longer than the ordinary adult retention period for the same provider type. If you are requesting childhood records, the practical takeaway is that they may still exist well after you turn 18, and the holder is often a hospital rather than the individual physician who treated you.

Federal Requirements: HIPAA and CMS

HIPAA Record Retention

A common misconception is that HIPAA requires health care providers to retain medical records for a specific number of years. It does not. No provision of the HIPAA Privacy Rule sets a retention period for medical records themselves, a point the U.S. Department of Health and Human Services has also made in its published HIPAA guidance. State laws govern how long medical records must be retained.

HIPAA does require covered entities to retain certain HIPAA-related documentation for 6 years. Under 45 CFR 164.530(j)(2), the Privacy Rule requires that documentation be kept "for six years from the date of its creation or the date when it last was in effect, whichever is later." That covers:

• Privacy policies and procedures
• Privacy practices notices
• Disposition of complaints
• Required accounting of disclosures
• Training records
• Patient authorization forms

The Security Rule imposes a parallel 6-year documentation requirement at 45 CFR 164.316(b)(2)(i), which covers security policies and procedures and written records of any action, activity, or assessment the Security Rule requires to be documented.

Both 6-year clocks attach to compliance paperwork, not to the patient's chart, so neither one tells you how long your medical records are kept. Providers must comply with both their state retention obligations and the HIPAA documentation retention rules.

HIPAA also requires that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for the entire period the information is maintained, including through final disposal.

CMS Conditions of Participation

Hospitals participating in Medicare and Medicaid must comply with the Conditions of Participation under 42 CFR 482.24. These federal rules require that:

• A medical record must be maintained for every individual evaluated or treated in the hospital
• Records must be accurately written, promptly completed, properly filed and retained, and accessible
• The hospital must have a system for coding and indexing medical records

Under 42 CFR 482.24(b)(1), medical records must be retained in their original or legally reproduced form for at least 5 years. When state law requires a longer retention period, as Washington's 26-year hospital requirement does, the state law controls.

Patient Access to Medical Records

Rights Under RCW 70.02.080

Washington patients have a statutory right to access their own medical records under RCW 70.02.080. When a patient submits a written request, the provider must respond as promptly as the circumstances require, but no later than 15 working days.

If the provider cannot meet the 15-day deadline, they must notify the patient by that date, explain the reason for the delay, and complete the request no later than the 21st working day.

Upon request, providers must:

• Make records available for examination during regular business hours
• Provide copies if requested
• Inform patients if records do not exist or cannot be located
• Identify other providers who may hold the requested information
• Explain any codes or abbreviations used in the records

Fees for Copies

Under WAC 246-08-400, providers may charge the following maximum fees for medical record copies:

HIPAA-covered entities may not charge fees exceeding those permitted under 45 CFR 164.524. The Washington Department of Health notes that the Secretary of Health adjusts these amounts biennially based on changes in the Consumer Price Index, so confirm the current figures before disputing a charge.

Right to Correct Records

Under RCW 70.02.100, patients may request in writing that a provider correct or amend inaccurate or incomplete information in their medical records. Providers must also maintain records for at least one year following receipt of an authorization to disclose health care information, per RCW 70.02.160.

Proper Destruction of Medical Records

State Requirements

When the applicable retention period has expired, Washington requires that records containing personal health information be destroyed by secure means. Under RCW 19.215.020, part of chapter 19.215 RCW on disposal of personal information, an entity must take all reasonable steps to destroy, or arrange for the destruction of, personal financial and health information in records within its custody or control when it disposes of records it will no longer retain.

That statute sets a reasonableness standard rather than prescribing one specific method. The practical benchmark comes from federal law: the Washington Medical Commission's guideline notes that the HIPAA Privacy Rule prohibits digital and paper records containing confidential information from being thrown away in a public dumpster or recycling bin until they have been rendered unreadable or indecipherable by shredding, burning, or another method of destruction.

The WMC also advises that practitioners give patients an opportunity to claim their records, or to have them sent to another practitioner, before the records are destroyed.

HIPAA Destruction Standards

For electronic records, 45 CFR 164.310(d)(2) requires covered entities to implement policies and procedures addressing the final disposition of electronic protected health information and the hardware or electronic media on which it is stored, plus procedures for removing that information from media before the media are reused.

Covered entities may hire a vendor to handle disposal. Under 45 CFR 164.308(b)(1), the covered entity must first obtain satisfactory assurances, documented in a written contract or other arrangement meeting 45 CFR 164.314(a), that the business associate will appropriately safeguard the information.

Practice Closure and Record Transfer

Physician Practice Closure

When a Washington physician closes a practice, the Washington Medical Commission recommends the following steps in Guideline GUI2024-01:

1. Notify active patients and patients seen within the previous three years before the practice closes.
2. Give notice at least 30 days in advance, with 90 days being the best practice.
3. Deliver notice by at least one, and preferably all, of these methods: an individual letter to the last known patient address, electronic communication where that is a normal method of clinical communication with the patient, and a notice on the practice website.
4. Include the practical details in the notice: the name, telephone number, and mailing address of the entity or agent to contact for records; how records can be obtained or transferred; the format of the records; how long records will be maintained before they are destroyed; and the cost of recovering or transferring records as defined in chapter 70.02 RCW.
5. Arrange a custodian if needed. A practitioner may contract with a third party to act as custodian, and that custodian must comply with applicable federal and state confidentiality laws.

The obligation to make medical records available to patients and other practitioners continues after a practice closes. If a practice closes because the practitioner died, the practitioner's estate becomes the owner of the records, and the WMC encourages the estate to notify patients.

Hospital Closure

Under RCW 70.41.190, if a hospital ceases operations, it must make immediate arrangements, as approved by the Washington State Department of Health, for preservation of its records. The hospital cannot simply destroy records or abandon them upon closing.

Nursing Facility Closure

Similarly, RCW 18.51.300 requires nursing facilities that cease operations to make immediate arrangements, approved by the department, for preservation of patient care records.

Psychologist Practice Closure

WAC 246-924-354 requires psychologists to establish a written succession plan that designates qualified individuals or facilities to handle referrals and record requests if the psychologist retires, discontinues practice, or becomes unable to work.

Key Differences: Washington vs. Federal Requirements

When state and federal requirements differ, providers must follow whichever standard imposes the longer retention period or stricter obligation.

Frequently Asked Questions

How long do Washington hospitals have to keep medical records?

As of July 27, 2025, Washington hospitals must retain all medical records for a minimum of 26 years from the date the record was created, under the amended RCW 70.41.190. This replaced the previous 10-year requirement that was measured from the date of patient discharge.

How long must a Washington physician keep patient records?

Washington has no general statute requiring physicians to retain medical records for a specific period. The Washington Medical Commission recommends keeping records for at least 10 years from the patient's last visit, prescription refill, telephone contact, test, or other contact; 21 years from a minor patient's birth; and 6 years from a patient's death. It recommends indefinite retention where the patient is or was incompetent, there are significant concerns about the patient's care, or litigation is likely.

How do I get copies of my medical records in Washington?

Submit a written request to your health care provider. Under RCW 70.02.080, the provider must respond within 15 working days. If there is a delay, the provider must notify you and complete the request by the 21st working day. Under WAC 246-08-400, providers may charge up to $1.24 per page for the first 30 pages, $0.94 per page after that, and a $28 clerical search and handling fee. The Department of Health adjusts these amounts biennially, so confirm the current figures.

What happens to medical records when a doctor's office closes in Washington?

The Washington Medical Commission recommends that the physician notify active patients and patients seen within the previous three years at least 30 days before closing, with 90 days as best practice. Notice may go out by letter to the last known address, by electronic communication where that is normal for the practice, or by a notice on the practice website, and it should say how to obtain or transfer records. A practitioner may contract with a third party custodian, who must comply with state and federal confidentiality laws. The duty to make records available continues after the practice closes.

Does HIPAA require medical records to be kept for a specific number of years?

No. The HIPAA Privacy Rule does not set a medical record retention period. However, 45 CFR 164.530(j) requires covered entities to retain HIPAA-related documentation, including privacy policies, authorization forms, and training records, for at least 6 years, and the Security Rule sets a parallel 6-year rule for its own documentation at 45 CFR 164.316(b)(2)(i). Both clocks apply to compliance paperwork, not to the patient's chart. Medical record retention is governed by state law, which in Washington varies by provider type.

How long are a Washington child's medical records kept?

It depends on who holds them. A hospital must keep them 26 years from the date the record was created (RCW 70.41.190). A nursing facility must keep them until 3 years after the minor turns 18 or 10 years after discharge, whichever is longer (RCW 18.51.300). A psychologist keeps them until the client turns 22 or 8 years after last contact, whichever is longer (WAC 246-924-354). The Washington Medical Commission recommends physicians keep them 21 years from the date of the patient's birth.