Under Florida medical record retention laws, a licensed practitioner must keep an adult patient’s records for at least five years from the last date of contact. Minors, hospitals, and closed practices follow longer or different schedules, and HIPAA adds a separate six-year requirement for compliance paperwork. Destroying records too soon can cost a practitioner their license and expose them to federal penalties.
The Five-Year Baseline for Adult Patients
Florida’s Administrative Code sets the floor at five years from the last date of contact with the patient. The records must remain in the practitioner’s office or possession and stay confidential except where disclosure is authorized by law.1Cornell Law Institute. Fla Admin Code Ann R 64B8-10.002 Florida Statute 456.057 handles the separate questions of who owns the records and how patients can access them.2Justia Law. Florida Statutes 456.057 – Ownership and Control of Patient Records
Five years is the legal minimum. Most practitioners hold records for at least seven, and there’s a concrete reason. Florida’s medical malpractice statute of repose generally caps lawsuits at four years from the date of the incident, but when fraud or concealment delayed discovery of the injury, the window extends to seven years.3Florida Senate. Florida Statutes 95.11 – Limitations Other Than for the Recovery of Real Property A practitioner who shreds files at the five-year mark can find themselves without evidence to defend a claim filed in year six or seven.
Longer Retention for Minor Patients
Records for minor patients need to be held longer because the limitations clock is tolled during childhood. Florida law does not bar a malpractice claim brought on behalf of a minor on or before the child’s eighth birthday, regardless of the four-year repose.3Florida Senate. Florida Statutes 95.11 – Limitations Other Than for the Recovery of Real Property For older minors, the standard two-year discovery period and four-year repose apply from the date of the incident, with a possible extension to seven years in fraud cases.
A common practice is to keep a minor’s records until the patient turns 25. That number comes from the age of majority (18) plus the seven-year repose window for fraud or concealment. A child treated at 17 whose injury isn’t discovered until adulthood could file as late as age 24 under that extended window. The five-year rule from last contact still applies, but for a minor seen at 16, five years only gets you to age 21.
Hospital and Public Facility Records
Hospitals and public health care facilities follow a longer schedule than individual practitioners. Florida’s General Records Schedule GS4 requires public hospitals, health care facilities, and medical providers to retain patient medical records for seven anniversary years after the last entry.4Florida Department of State. General Records Schedule GS4 for Public Hospitals, Health Care Facilities and Medical Providers Chapter 395 of the Florida Statutes governs hospital licensing more broadly, including patient access and copy fees, but the specific seven-year standard comes from the GS4 schedule itself.
When a Practice Closes or the Practitioner Dies
Florida Statute 456.058 requires each licensing board to adopt rules for the records left behind when a practitioner retires, relocates, or dies. The statute sets a floor of at least two years after the death, closure, or relocation.5Florida Senate. Florida Statutes 456.058 – Disposition of Records of Deceased Practitioners or Practitioners Relocating or Terminating Practice That two-year minimum is in addition to any time still remaining on the original retention period. A practice closing with records from a patient visit two years ago must keep those records accessible for at least another three years to meet the five-year baseline.
When the practitioner has died, the estate is responsible for proper disposition of the records.5Florida Senate. Florida Statutes 456.058 – Disposition of Records of Deceased Practitioners or Practitioners Relocating or Terminating Practice Estates often contract with a professional records custodian to handle storage, security, and patient requests until the retention period runs out.
Notifying Patients
Each licensing board sets its own rules on how patients must be notified when a practice closes. For physicians, the Board of Medicine’s rules sit in Florida Administrative Code Chapter 64B8 and generally require public notice along with communication to the board.1Cornell Law Institute. Fla Admin Code Ann R 64B8-10.002 Check the administrative code for your specific board well before a planned closure.
Patient Access and Copy Fees
Retention exists so patients can actually get their records. Florida law prohibits conditioning the release of records on payment of unpaid treatment bills, and records must be provided in a timely manner without delays for legal review.2Justia Law. Florida Statutes 456.057 – Ownership and Control of Patient Records
Charges for copies are capped. A practitioner can bill up to the actual cost of copying, including reasonable staff time, or the amount set by the licensing board’s rules.2Justia Law. Florida Statutes 456.057 – Ownership and Control of Patient Records Hospitals under Chapter 395 face a tighter limit: no more than $1 per page for paper records, $2 for non-paper records, and up to $1 per year of records requested. Patients obtaining records to continue medical care pay nothing in copy or search fees.6The Florida Legislature. Florida Statutes 395.3025 – Patient Records
Where HIPAA Fits In
HIPAA does not set a retention period for patient medical records. Federal law defers to state rules on the charts themselves, so Florida’s five-year and seven-year schedules control.
HIPAA does require covered entities to keep their compliance documentation (policies, procedures, and records of required actions or assessments) for six years from the date of creation or the date the document was last in effect, whichever is later.7eCFR. 45 CFR 164.530 These are internal compliance files, not patient charts. If a state rule required a shorter retention for compliance documents, the federal six-year minimum would override it.
Penalties for Getting It Wrong
Under Florida Statute 456.072, violating a rule adopted by a licensing board is a standalone ground for disciplinary action, as is failing to perform any statutory or legal obligation placed on a licensee.8The Florida Legislature. Florida Statutes 456.072 – Grounds for Discipline, Penalties, Enforcement Possible penalties include fines, probation, license suspension, and revocation.
Improper disposal of records containing protected health information adds federal exposure. Civil HIPAA penalties start at $145 per violation and can exceed $2.1 million per violation category per year, depending on culpability. Even unintentional violations carry penalties when the covered entity should have known about the problem. Shredding files a year early looks like a minor administrative error until a complaint reaches the Office for Civil Rights. Keeping records longer than the minimum is almost always the safer call.