Selling a medical practice often feels like the finish line. The purchase agreement is signed. The transition timeline is set. Staff responsibilities shift. Ownership changes hands.
But the records handoff usually outlives the transaction itself.
That surprises many healthcare administrators and practice owners. Patient records, retention obligations, and HIPAA documentation responsibilities do not automatically disappear after a sale, merger, or closure. In many cases, records requests continue arriving years after the transaction closes.
Former patients may request copies. Attorneys may request documentation. Insurance audits may still surface. Regulators may still expect records to remain accessible under state retention requirements. This is where many healthcare transactions become complicated.
The issue is not simply storing old charts. It is documenting who becomes responsible for them, how long records must be retained, who pays for storage and retrieval, and how patients continue accessing records after the practice changes hands. This guide explains how records responsibilities survive a practice transition, what healthcare administrators should negotiate before closing, and how to build a defensible records handoff process.
Why the Obligation to Maintain Records Does Not End at Closing
Many practice owners assume patient records transfer automatically during a sale. Sometimes they do. Sometimes they do not.
Even after selling a medical practice, former owners may still receive patient requests, subpoenas, payer inquiries, or legal questions tied to records created before closing. That is because the legal and operational responsibility for records often survives the transaction itself.
This becomes especially important because different rules apply to different kinds of records.
HIPAA’s 6-year retention requirement generally applies to compliance documentation such as policies, business associate agreements (BAAs), risk analyses, and previous Notices of Privacy Practices. It does not establish one universal retention period for patient charts.
Patient medical records are usually governed by state retention laws, medical board rules, payer requirements, and malpractice considerations. This distinction is where many practice transitions go wrong. Healthcare organizations sometimes assume the “6-year HIPAA rule” controls everything, when patient-chart retention often runs significantly longer.
Identifying the Custodian of Records Before You Sign
One of the most important decisions during a practice transition is identifying the custodian of records. A custodian of records is the person or organization responsible for maintaining patient records and responding to future requests. This should never remain ambiguous.
Before closing, healthcare administrators and legal counsel usually determine who physically stores the records, who responds to patient requests, who pays retrieval costs, who maintains retention schedules, and who handles destruction once retention periods expire. If these responsibilities remain unclear, problems often surface later when patients request records years after the transaction closes.
In many practice sales, buyer’s counsel specifically asks where records are stored, whether records are digitized, how retrieval works, whether retention schedules exist, and whether older records are still accessible. Those questions are part operational and part liability-related. This becomes especially important for physician-owned private practices preparing for retirement, mergers, or acquisition by larger healthcare groups.
Can A Buyer Refuse To Take Old Records?
Yes, in some situations. A buyer may agree to purchase the practice but decline responsibility for older archived records, especially if records are heavily paper-based, storage systems are disorganized, retention schedules are unclear, or retrieval obligations appear expensive. That is why records responsibilities should always appear explicitly in the transaction agreement rather than relying on assumptions after closing.
Understanding the 6-Year Timeframes: HIPAA vs. State Retention Requirements
One of the most important parts of a records handoff is understanding which timeline applies to which records. HIPAA generally requires covered entities and business associates to retain HIPAA-related compliance documentation for at least 6 years. That includes policies, procedures, BAAs, training records, and risk analyses.
Patient medical records themselves are usually controlled by state law. Many states require patient charts to remain accessible for 7 to 10 years, and pediatric records often remain subject to much longer timelines. This means a practice sale may transfer responsibility for records that must remain accessible long after the transaction closes.
How Long After Closing Is A Practice Responsible For Records?
The answer depends on state retention law, transaction structure, malpractice exposure, and the records agreement itself. Some obligations may continue for many years after closing, particularly when pediatric records or litigation-related records remain involved. This is one reason many healthcare organizations establish detailed records-transfer agreements before finalizing the transaction.
Talk to a Records Specialist About Your Practice Transition
If your organization is preparing for a sale, merger, or closure, this is usually the point where records decisions become urgent. Talk to a records specialist about your practice transition before the transaction closes so your organization can identify retention timelines, storage obligations, and custodianship responsibilities before records requests begin arriving later.
Selling or Merging a Medical Practice: The Process for Transferring Patient Records
During a practice merger or acquisition, patient records usually transfer through one of two general structures: an asset sale, or a stock sale. An asset sale typically transfers selected business assets while ownership changes more narrowly. A stock sale generally transfers the entity itself along with operational responsibilities. The records implications may differ significantly depending on the structure.
This article does not provide legal advice regarding transaction structure. Healthcare organizations should review those questions with legal counsel directly. Operationally, however, healthcare administrators still need to document who receives the records, where records are stored, how patients access records, and how retention responsibilities continue afterward.
The Five Records-Clause Terms Most Transactions Negotiate
Most healthcare transaction agreements eventually negotiate five core records-management terms: custody, cost allocation, patient access, retention responsibility, and indemnification. Indemnification refers to contractual responsibility if legal or financial problems arise later. These terms matter because records requests rarely stop after closing. Former patients may still contact the previous practice name years later expecting records retrieval assistance.
Closing a Medical Practice Without a Buyer
Practice closures create additional records-management pressure because no successor organization automatically assumes responsibility. Healthcare administrators usually need a clear plan for patient notification, records storage, retrieval procedures, and future custodianship.
Patients generally need instructions explaining where records will be stored, how records may be requested later, and whom to contact after closure. This becomes especially important for practices with long retention obligations involving pediatric records, behavioral health records, or ongoing treatment documentation. Many organizations move archived paper records into organized off-site storage environments before closure to simplify long-term retrieval.
Do You Need To Notify Patients?
In most situations, yes. State medical boards and licensing authorities often require some form of patient notification when practices close or transfer ownership. Notification procedures vary by state, provider type, and transaction structure, which is why healthcare organizations should review state-specific requirements carefully.
Developing the Records Transfer Agreement
A records transfer agreement documents how patient records will be handled after the transaction closes. Strong agreements usually define the custodian of records, storage responsibilities, retention timelines, retrieval procedures, destruction authority, and patient access workflows. The agreement should also address digital archives, scanned files, paper originals, and backup systems.
Organizations relying heavily on paper records often choose to digitize older files before transitions occur because digital systems simplify retrieval, storage, indexing, and patient access.
Why Destruction Planning Matters Too
Retention planning eventually becomes destruction planning. Keeping records indefinitely may create additional storage costs, litigation exposure, operational confusion, and privacy risk. Once retention periods expire and no legal hold applies, organizations should maintain documented destruction procedures for records no longer required.
Making the Records Handoff a Strategic Advantage, Not a Liability
The strongest practice transitions usually treat records management as part of operational continuity rather than an afterthought. Organized records systems can reduce transaction friction, simplify due diligence, improve patient continuity, and reduce long-term operational risk.
Healthcare administrators who address records responsibilities early often avoid many of the problems that surface after closing such as missing archives, unclear custodianship, inconsistent retention schedules, or patient access confusion. This is especially important for practices still managing large paper archives or disconnected storage systems.
Frequently Asked Questions
Often, yes. Depending on the transaction structure and records agreement, former owners may still receive patient requests, subpoenas, or legal inquiries tied to records created before closing.
Ownership and custodianship depend on the transaction agreement and state law. The merger agreement should clearly define who stores records, who handles retrieval requests, and who maintains retention responsibilities afterward.
No. HIPAA’s 6-year retention requirement generally applies to HIPAA-related compliance documentation such as policies and BAAs. Patient medical record retention is usually governed by state law and often lasts longer.
In many states, yes. Healthcare organizations often must notify patients where records will be stored and how records may be requested after closure.
Potentially. That depends on the transaction agreement, state law, and the circumstances surrounding future records requests or litigation. This is why records custodianship and retention responsibilities should be documented carefully before closing.
Get Your Free Quote Before the Transaction Closes
Whether you are selling a medical practice, managing a merger, or preparing for closure, records obligations usually continue long after the transaction itself ends. Record Nations helps healthcare organizations connect with vetted providers for:
- medical records storage
- document scanning
- records digitization
- custodianship support
- secure destruction services
Our provider network can help your organization build a more organized and defensible records handoff process before patient requests, audits, or retrieval problems begin surfacing later.
Get your free quote today by filling out the form or calling (866) 385-3706.
