If a physician at your practice just announced their retirement, you’re probably the one fielding questions about the patient records. In a group practice, the records usually stay with the practice, which remains the medical records custodian, and the retiring physician keeps duties to patients under state medical board rules. Compliance duties and civil penalties under the Health Insurance Portability and Accountability Act (HIPAA) fall on the practice, and board duties fall on the licensed physician, not on you personally.
That still leaves plenty to organize, including patient notices, retention periods, a custodian agreement, and a plan for former patients who call asking for their charts. This guide walks through who’s responsible for what, what HIPAA and state boards expect, and how long the records have to be kept.
Who Is the Medical Records Custodian?
A medical records custodian is the person or organization legally responsible for keeping patient records secure, retaining them for the required period, and releasing them when a patient or another authorized party asks. The custodian of records also answers subpoenas and certifies copies when records are needed as evidence.
In a group practice, the custodian is usually the practice, which generally owns the records it maintains. In a solo practice, the custodian is the physician, so a retiring solo physician has to arrange custody, whether by keeping the records, transferring them to a colleague who takes over the patients, or contracting with a custodianship provider.
Practice or Physician: Who’s Responsible?
Both are, for different things. The practice is the covered entity under HIPAA, meaning a health care provider the law regulates directly, so it answers for how records are protected and released, including violations by staff acting within the scope of their jobs.
The physician’s obligations come from the state medical board, and retirement doesn’t end them. Boards generally hold licensees responsible for making sure former patients can still reach their records. The Pennsylvania Medical Society, for example, notes in its guidance on medical record disposition that a group practice may keep a retiring physician’s records, and that any custodianship agreement “must guarantee access to the records by the physician’s former patients.”
Some states split the work explicitly. Texas puts the patient notice on the departing physician and requires the practice to supply a list of the patients that physician saw in the last two years, so the notice reaches all of them.
Before anything moves, pull the physician’s employment or partnership agreement. It may already say who keeps the records, who pays for storage, and how the physician can get copies later to answer a board complaint or a malpractice claim. If the retirement means the practice is closing entirely, the steps for closing a medical practice reach well beyond the records, from payer contracts to leases.
HIPAA, State Boards, and the Custodian Agreement
HIPAA is the federal law governing the privacy and security of patient information, and the Department of Health and Human Services (HHS) says its Privacy Rule does not include medical record retention requirements, leaving retention to state law. HIPAA’s safeguards still apply for as long as the practice keeps the records, including when it disposes of them.
The six-year HIPAA rule you may have heard about covers the practice’s HIPAA policies, procedures, and other required documentation. It doesn’t cover patient charts.
State boards fill in the rest. They set how long physicians keep records, what notice patients get, and who can act as custodian, which is why the same retirement can involve different steps in Texas than in Florida.
If an outside company will hold the records, it becomes a business associate, an organization that creates, receives, maintains, or transmits protected health information (PHI) on the practice’s behalf. HIPAA requires a business associate agreement (BAA) before the vendor gets access, and since the HITECH Act, HIPAA’s penalties reach business associates too.
A custodian agreement usually wraps the BAA together with the business terms. Make sure yours covers:
- which records transfer, in what format, and the date custody begins
- how long each group of records will be kept, matched to state law and payer contracts
- how former patients and their new providers request records, and how fast the custodian responds
- what fees the custodian may charge patients, and how they’re set
- safeguards for the records, and how the custodian reports a breach to the practice
- whether subcontractors can handle the records, and on what terms
- what happens when retention ends, whether secure destruction with a certificate or return of the records
- the custodian’s name, address, and phone number exactly as they’ll appear in patient notices
Retention Schedules and Patient Notification
A retention schedule is a written list of each type of record your practice keeps and how long it has to be kept. For patient charts, there’s no single national retention period. State law sets the floor, and payer contracts can push it higher.
For example:
| State | Physician retention rule | Notice when a physician leaves |
|---|---|---|
| Pennsylvania (MDs) | At least 7 years from the last service, or until 1 year after a minor reaches majority, whichever is later | The state medical society recommends written notice to all of the physician’s patients |
| Texas | At least 7 years from last treatment, or until a minor turns 21 if that’s longer | Letter or email to patients seen in the last 2 years, plus an office and website notice posted at least 30 days before departure |
| Florida | At least 5 years from the last patient contact | When a physician closes or relocates and is no longer available to patients, newspaper notice once a week for 4 consecutive weeks, with a copy to the board within one month |
The Pennsylvania figures come from 49 Pa. Code § 16.95, which covers MDs, while osteopathic physicians follow a different minor-patient rule. Texas spells out its notice rule in 22 TAC § 163.4, which replaced the board’s older Chapter 165 rules in January 2025. Florida’s rule is 64B8-10.002, and it requires the notice to give an address where patients can get their records.
Payers add their own clocks. Medicare requires providers that furnish, order, certify, refer, or prescribe Part A or B services, items, or drugs to keep the supporting documentation, such as orders, referrals, and prescriptions, for 7 years from the date of service, according to the Centers for Medicare & Medicaid Services (CMS) record maintenance fact sheet. For Medicare Advantage, contracts give the government audit rights over contracted providers’ records for 10 years under 42 CFR 422.504.
Build the schedule from the longest rule that applies to each chart, which for pediatric patients is often the minor-patient rule. A breakdown of how long to keep medical records by state is a good place to start, and your state board’s current rule is the final word.
The notice clock starts well before the physician’s last day. The American Medical Association’s (AMA) ethics guidance on medical records adds that patients should be told how to reach their stored records and how long the records will be available.
How Patients Request Records After Closure
Once a custodian holds the records, every request should go to the custodian, and your notices, voicemail, and website should say so. HIPAA gives patients a right of access to their own records, and the practice, through its custodian, has to act on a request no later than 30 days after receiving it. One 30-day extension is allowed if the patient gets a written reason and a new date.
A patient asking for their own chart doesn’t need to sign a HIPAA authorization. HHS’s right of access guidance says requiring one can create an impermissible obstacle. The custodian can require a written request and charge a reasonable, cost-based fee for copies.
A release authorization is a different form, used when records go to a third party for a purpose HIPAA doesn’t otherwise permit, such as a life insurer or a prospective employer. The patient, or their personal representative, signs it, and it has to describe the information, name who discloses it and who receives it, state the purpose, include an expiration date or event, and explain the right to revoke, among other required elements. Sending a chart to the patient’s new physician for treatment doesn’t need an authorization at all.
Requests from insurers and other third parties often call for removing information the requester isn’t entitled to see, so ask whether the custodian offers document redaction before release.
Why Outsourcing Custodianship Protects Your Practice
A custodianship provider takes the records, the request line, and the retention calendar off your desk. The provider signs the BAA, holds the charts in a secure facility or a hosted system, keeps a log of releases, and tracks each record’s retention date, including the later dates for patients who were minors.
Without one, the charts can end up in a back room, a self-storage unit, or the retiring physician’s garage, with no one assigned to answer the phone when a former patient calls five years from now. AMA guidance asks physicians to appropriately store records that aren’t transferred and to destroy discarded records in a way that protects confidentiality. A provider certified to NAID AAA, the destruction standard set by the International Secure Information Governance & Management Association (i-SIGMA), handles that last step and issues a certificate of destruction.
Outsourcing also gives you one name to print in every notice and one place to send every subpoena. Once you know roughly how many charts are involved, you can get your free quote on medical records custodianship.
Custodian of Records FAQs
In a group practice, the practice usually remains the custodian of medical records and keeps the retiring physician’s charts. A solo physician has to keep the records or arrange a successor custodian, such as another physician or a custodianship provider, before closing.
No. State boards generally hold physicians responsible for making sure former patients can access their records, so a retiring physician should confirm that a custodian is in place and that patients know how to reach it.
As long as the longest rule that applies, whether that’s state law, the minor-patient rule, or a payer contract. Periods vary widely, so check record retention guidelines by state against your state board’s current rule.
Moving the charts into secure storage first keeps them protected and retrievable while you decide. You can explore long-term medical records storage options that work for either path.
No. Patients have a right of access to their own records under HIPAA, and the custodian can ask for a written request but can’t require an authorization form.
Connecting Your Practice With a Records Custodian
Record Nations connects private practices with certified, vetted custodianship providers who can take over storage, release requests, and end-of-retention destruction. Providers in our network offer offsite records storage for paper charts, and many can scan the charts first if you’d rather the custodian hold digital files. The network reaches practices in cities like Des Moines, IA, and Tucson, AZ.
Record Nations is an i-SIGMA member, and we work closely with i-SIGMA to ensure our network providers meet its PRISM Privacy+ standards for records and information management. Pricing and pickup questions often have quick answers in the Record Nations FAQ.
Fill out our form or call (866) 385-3706, and we’ll match your practice with custodians who can quote the job. You’ll often receive multiple competitive quotes within minutes or the hour, and generally by day’s end, depending on how integrated each provider is.
