Destroying medical records in Georgia is illegal in several situations: when records are shredded or deleted before the state’s retention period ends, when disposal methods leave patient information exposed, or when the destruction is meant to hide a fact relevant to a legal claim. Depending on the circumstances, a provider can face a misdemeanor under state law, a felony computer trespass charge, federal healthcare fraud prosecution, HIPAA enforcement, and civil liability to the patient.
How Long Records Must Be Kept First
The first question is whether the retention clock has run. Georgia Composite Medical Board regulations require healthcare providers to keep patient records for at least ten years from the date of discharge or death.1Cornell Law School. Georgia Comp. R. and Regs. R. 511-7-1-.10 – Patient Records Pediatric records have to be held for at least five years after the patient reaches the age of majority. Georgia’s age of majority is 18, so a child’s chart must be preserved until the patient turns 23 at a minimum.2Justia. Georgia Code 39-1-1 – Age of Legal Majority; Residence of Minors
Hospital licensing rules set a shorter floor of five years after discharge for hospital records, with the same post-majority rule for pediatric patients.3Cornell Law School. Georgia Comp. R. and Regs. R. 111-8-40-.18 – Medical Records Because the Medical Board’s ten-year rule also reaches hospital-based providers, most Georgia hospitals follow the longer standard in practice.
Two federal overlays can push the clock further. Medicare providers must keep records for at least seven years from the date of service.4CMS. Medical Record Maintenance and Access Requirements Employers who hold employee medical or toxic exposure records fall under OSHA, which requires retention for the duration of employment plus 30 years.5Occupational Safety and Health Administration. Access to Employee Exposure and Medical Records Destroying records before whichever period applies is the simplest way to end up on the wrong side of the law.
How Records Must Be Destroyed When the Time Comes
Even after the retention period ends, records cannot simply be bagged and tossed. HIPAA requires covered entities to render protected health information unreadable and unreconstructable before disposal. The Department of Health and Human Services lists acceptable methods: paper records can be shredded, burned, or pulverized; electronic media can be overwritten with non-sensitive data, degaussed, or physically destroyed.6HHS.gov. What Do the HIPAA Privacy and Security Rules Require of Covered Entities When They Dispose of PHI Leaving intact charts somewhere an unauthorized person could reach them is itself a HIPAA violation.
Providers who hire a disposal vendor must treat that vendor as a HIPAA business associate, with a written contract requiring the vendor to safeguard the information. Skipping that contract is a common way practices stumble into trouble.
Improper disposal can also become a reportable data breach. Under the HITECH Act, a breach of unsecured health information triggers notification to affected patients and HHS, and breaches touching more than 500 people require media notice as well.7HHS.gov. HITECH Breach Notification Interim Final Rule Georgia’s own breach notification statute, Georgia Code § 10-1-912, adds a state-level duty to notify Georgia residents when computerized personal information is exposed, which includes carelessly discarded patient files.
Criminal Penalties for Unlawful Destruction
Georgia has a statute aimed directly at this conduct. Under Georgia Code § 16-10-94.1, anyone who knowingly and willfully destroys, alters, or falsifies a record with intent to conceal a material fact relating to a potential legal claim is guilty of a misdemeanor.8Justia. Georgia Code 16-10-94.1 – Willful Destruction, Alteration, or Falsification of Records A standard Georgia misdemeanor carries up to 12 months in jail and a fine of up to $1,000. That sounds modest in isolation, but this charge rarely travels alone.
Computer Trespass for Deleting Electronic Records
Deleting or altering electronic medical records without authorization can be prosecuted as computer trespass under Georgia Code § 16-9-93, a felony punishable by up to 15 years in prison and fines up to $50,000.9Justia. Georgia Code 16-9-93 – Computer Crimes Defined; Exclusivity of Article; Civil Remedies; Criminal Penalties The statute reaches anyone who uses a computer or network knowing the use is unauthorized and intends to delete data, obstruct access, or cause a malfunction. Because most medical records are now electronic, this is the charge prosecutors will often reach for in a serious case.
Federal Healthcare Fraud Charges
When record destruction connects to Medicare or Medicaid, federal law takes over. Under 18 U.S.C. § 1035, knowingly falsifying or concealing a material fact in connection with healthcare benefits, items, or services carries up to five years in federal prison.10Office of the Law Revision Counsel. 18 USC 1035 – False Statements Relating to Health Care Matters Destroying records to hide fraudulent billing fits that description. If the destruction is part of a larger scheme, prosecutors can add wire fraud or conspiracy counts, each with its own prison exposure.
Civil Liability and Spoliation
Criminal charges are only part of the exposure. Patients harmed by missing records, whether they lose a malpractice case for lack of proof, suffer a misdiagnosis because a new provider lacks history, or face delayed treatment, can sue for negligence and recover damages for those losses.
Georgia courts also recognize spoliation of evidence. When a party destroys records relevant to pending or reasonably anticipated litigation, the court can tell the jury to assume the missing records contained information unfavorable to the party who destroyed them. That adverse inference instruction can be devastating in a malpractice or personal injury trial because it lets the jury fill in the blanks against the destroyer. Judges can also impose monetary sanctions or, in extreme cases, enter default judgment.
Closing a Practice or Retiring
A physician who retires or sells a practice cannot shred the charts and walk away. Georgia Code § 31-33-2 requires a departing provider to notify patients and give them a chance to receive their records or have them transferred to another provider of their choosing.11Justia. Georgia Code 31-33-2 – Furnishing Copy of Records to Patient, Provider, or Other Authorized Person Only after those steps and the applicable retention period may the provider destroy what remains, using HIPAA-compliant methods.
The same rules apply when a facility closes with no successor to take the records. Patients still get notice and an opportunity to collect copies. Anything no patient claims must be held through the retention period and then destroyed securely. Short-cutting this process invites regulatory enforcement and civil claims from patients who later need their history.
Deceased Patients
HIPAA protection does not end at death. The Privacy Rule continues to protect a deceased person’s health information for 50 years after the date of death.12HHS.gov. Health Information of Deceased Individuals During that window, a personal representative such as an executor or estate administrator can exercise the same access rights the patient would have had, and disclosures outside the Privacy Rule’s standing permissions require a written HIPAA authorization from that representative.
Practically, a deceased patient’s records must be retained for the standard Georgia period and, throughout the 50-year federal window, handled with the same confidentiality safeguards as any living patient’s records. Premature destruction can damage estate litigation, life insurance claims, and wrongful death cases.
Records With Their Own Rules
Substance Use Disorder Treatment Records
Records from substance use disorder programs carry heightened federal protection under 42 CFR Part 2, including formal destruction policies that render patient-identifying information permanently non-retrievable.13eCFR. Part 2 Confidentiality of Substance Use Disorder Patient Records A closing program must either obtain patient consent to transfer records or destroy them completely. When a legal requirement forces continued retention after closure, paper records must be sealed and labeled and electronic records encrypted and stored on separate media, with the originals wiped within one year. Once the mandated retention ends, the sealed or encrypted records must also be destroyed.
Psychotherapy Notes
HIPAA treats psychotherapy notes as a separate category. They must be stored apart from the rest of the chart, and disclosure requires specific patient authorization beyond what general treatment records need. HIPAA does not set a separate destruction timeline for these notes, but their segregated storage means providers need distinct tracking and disposal procedures. Shredding the main file while overlooking separately stored psychotherapy notes is not full compliance.
Workplace Medical Records
Employers holding employee medical, occupational health, or toxic exposure records must keep them for the duration of employment plus 30 years under OSHA.5Occupational Safety and Health Administration. Access to Employee Exposure and Medical Records That is far longer than the standard Georgia healthcare provider retention period and routinely catches employers off guard. Exposure records and any analyses drawn from medical or exposure data carry the same 30-year requirement.
When Destruction Is Authorized by a Court
A court can order records destroyed in limited situations: after falsified records have served their evidentiary purpose in a prosecution, when a court finds that continued retention serves no legitimate purpose and poses a privacy risk, or at the conclusion of certain public health investigations. The order itself supplies the legal authorization, and providers should keep a copy as proof of lawful destruction.