New Jersey’s medical records law is a layered framework: state statutes and administrative codes govern how providers keep, share, and protect patient information, and federal HIPAA rules sit on top of those requirements. Together they set retention periods, give patients the right to obtain and correct their records, limit when records can be released without consent, and impose civil, criminal, and licensing penalties when the rules are broken.
How Long Providers Must Keep Your Records
Retention depends on the type of provider.
Physicians and Other Board-Licensed Professionals
Under N.J.A.C. 13:35-6.5, licensed physicians must keep patient treatment records for at least seven years from the date of the most recent entry.1New Jersey State Library. N.J.A.C. 13:35 – Board of Medical Examiners Billing records and insurance claim forms fall under the same seven-year rule. Records for minors are often held longer because New Jersey’s medical malpractice statute of limitations gives a minor until two years after their eighteenth birthday to file a claim, so a cautious provider may keep the file until the patient is at least twenty.
Hospitals
Hospitals must preserve inpatient and outpatient records under N.J.A.C. 8:43G-15.2, which cross-references the state’s vital statistics recordkeeping requirements. The generally recognized hospital retention period is ten years from the last treatment date, with specific record types carrying their own timelines. Mental health and substance use treatment facilities commonly follow longer retention schedules because of the heightened confidentiality protections attached to those records.
Electronic Records
Electronic health records must remain accessible and unaltered for the full retention period. Providers have to plan for data migration as file formats become obsolete and systems get replaced. The HITECH Act sets baseline security and integrity standards for digital records across their lifecycle.
Your Right to Access Your Records
New Jersey gives patients a clear right to obtain copies of their records. The fee rules split depending on whether the request goes to a physician or a hospital, and HIPAA adds a separate cap for electronic copies.
Physician Offices
Under N.J.A.C. 13:35-6.5, a physician can require the request to be in writing. The maximum copying fee is $1 per page or $100 for the entire record, whichever is less. For records shorter than ten pages, the physician may charge up to $10 to cover postage and retrieval. X-rays and other materials that cannot be photocopied on a standard copier may be charged at actual duplication cost, plus an administrative fee of $10 or 10 percent of the cost, whichever is less.2Cornell Law School. N.J. Admin. Code 13:35-6.5 – Preparation of Patient Records, Computerized Records, Access to or Release of Information
A physician cannot refuse to send your records to another provider on the ground that you owe an unpaid balance, as long as the records are needed for your continuing care.2Cornell Law School. N.J. Admin. Code 13:35-6.5 – Preparation of Patient Records, Computerized Records, Access to or Release of Information That protection is tied to transfers for treatment. It does not necessarily apply to personal copy requests.
Hospitals
A hospital must provide a legible copy of your records within 30 days of a written request. The fee cannot exceed $1 per page or $50 per individual admission record, whichever is less, regardless of whether the record is stored electronically, on microfilm, or on paper.3Justia. New Jersey Revised Statutes Section 26:2H-5n – Hospital to Provide Copy of Individual Admission Records Patients admitted to a general hospital have a separate statutory right of access under N.J.S.A. 26:2H-12.8.4Justia. New Jersey Code 26:2H-12.8 – Rights of Persons Admitted to a General Hospital
HIPAA’s Cap on Electronic Copies
When your records are maintained electronically and you request an electronic copy, HIPAA limits the provider to a cost-based fee covering labor for copying, supplies such as a CD or USB drive, and postage if you ask for mailing. Per-page fees are not permitted for electronic copies. As an alternative to calculating actual costs, the provider may charge a flat fee of no more than $6.50 inclusive of labor, supplies, and postage.5HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information If your provider uses certified EHR technology with a patient portal, they cannot charge you anything for using the portal’s download feature.
Access by Someone Other Than the Patient
Authorized representatives can obtain records on a patient’s behalf. For hospitals, the list of authorized representatives includes a spouse, domestic partner, civil union partner, immediate next of kin, legal guardian, the patient’s attorney, or a third-party insurer.6Cornell Law School. N.J. Admin. Code 8:43G-15.3 – Medical Record Patient Services If a patient has died, the executor or next of kin may obtain records with proper documentation.
Parents and legal guardians generally have access to a minor’s records. New Jersey carves out privacy protections for minors receiving treatment related to pregnancy, sexually transmitted infections, or substance use. In those situations, a parent or guardian is not automatically considered an authorized representative.1New Jersey State Library. N.J.A.C. 13:35 – Board of Medical Examiners
Mental Health Records
Mental health records carry additional protections. Under state and federal law, a provider may withhold mental health records from a patient if a licensed professional determines that disclosure would cause substantial harm. In that case, the records can be released to another healthcare professional designated by the patient. Psychotherapy notes receive stricter protection still and generally cannot be disclosed without specific patient authorization, even to insurers.
Correcting Errors in Your Records
If you find something wrong in your medical records, HIPAA gives you the right to request a correction. Submit the request in writing, identifying the specific information you believe is wrong and what it should say instead. The provider must act within 60 days. A 30-day extension is allowed if the provider gives you a written explanation for the delay.7HHS.gov. Health Information Technology and HIPAA – Correction
A provider can deny the request if they believe the record is accurate, but the denial must be in writing. You then have the right to file a statement of disagreement, which becomes a permanent part of your record. If the disputed information was previously shared with other providers or insurers, you can ask that those parties be notified of the correction or your disagreement. Complaints about a stonewalling provider can be filed with the New Jersey Division of Consumer Affairs or the federal Office for Civil Rights at HHS.
When Records Can Be Disclosed Without Consent
New Jersey and federal law both start from the position that patient consent is required before records are released. Several exceptions apply.
Law Enforcement and Mandatory Reports
Providers may disclose records without consent when compelled by a court order or when state law requires specific injury reporting. New Jersey requires hospitals to report to law enforcement when treating patients with gunshot wounds, stab wounds, or injuries that appear connected to criminal activity. Only limited information can be shared in these reports, such as the patient’s name, the nature of the injury, and the time of treatment. Full records require a subpoena or court order.
Separate mandatory reporting obligations exist for suspected child abuse, which goes to the Division of Child Protection and Permanency, and suspected elder abuse, which goes to Adult Protective Services. Those reports do not automatically trigger disclosure of the full medical record.
Insurance and Workers’ Compensation
Health insurers routinely access records for claims processing and fraud investigations. Patients typically authorize this access when signing an insurance agreement. Under HIPAA’s minimum necessary standard, insurers may only request the information needed to process the specific claim, not the patient’s entire medical history. Disputes over insurer requests can go to the New Jersey Department of Banking and Insurance.
Workers’ compensation access is narrower. It is limited to the portion of the medical record directly relevant to the specific work-related incident at issue.6Cornell Law School. N.J. Admin. Code 8:43G-15.3 – Medical Record Patient Services A workers’ compensation claim is not a gateway to your full medical history.
Court Proceedings
New Jersey recognizes a patient-physician privilege under N.J.R.E. 506 that generally shields medical records from disclosure in legal proceedings.8New Jersey Courts. Article V – Privileges The privilege has exceptions, most notably when the patient’s own health is directly at issue. In a personal injury lawsuit or medical malpractice case, records related to the injuries being claimed are typically fair game.
When a subpoena is issued for records, the provider must notify the patient and give them time to object before turning anything over. In criminal cases, prosecutors must demonstrate a compelling need, and courts weigh the state’s interest against the patient’s privacy. Judges can issue protective orders limiting how disclosed records are used. HIPAA requires providers to confirm that any subpoena or court order meets both state and federal standards before releasing records.
Substance Use Disorder Records
Federal law under 42 CFR Part 2 gives an extra layer of protection to records generated by substance use disorder treatment programs. These records cannot be disclosed even to other healthcare providers or insurers without the patient’s specific written consent. That consent must identify who can receive the information, what information can be shared, the purpose of the disclosure, and an expiration date or event. Every disclosure must include a written notice that the recipient may not further share the information.9eCFR. Part 2 Confidentiality of Substance Use Disorder Patient Records
Substance use disorder counseling notes get stricter treatment. A treatment program cannot condition your care on agreeing to disclose those notes. The limited exceptions are use by the note’s author for your treatment, program training, and defense in a legal action you bring against the program.
Destroying Records After the Retention Period
Once a record passes its retention period, it cannot simply be thrown away. HIPAA and New Jersey regulations require destruction that leaves the information unreadable and impossible to reconstruct.
Acceptable methods for paper include cross-cut shredding, burning, pulping, and pulverizing. Standard strip-cut shredding is generally not sufficient because the strips can sometimes be reassembled. For electronic records on hard drives, flash drives, or other digital media, destruction methods include degaussing magnetic media, overwriting with specialized software, or physically shredding or incinerating the storage device. Degaussing does not work on flash-based storage like solid-state drives or USB drives, which must be physically destroyed.5HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information Providers who outsource destruction to a shredding company or IT disposal service remain responsible for the vendor’s work.
What Happens After a Data Breach
When patient records are compromised, state and federal law both impose notification duties. Under New Jersey’s breach notification statute, any business or public entity that discovers unauthorized access to computerized records containing personal information must notify affected New Jersey residents “in the most expedient time possible and without unreasonable delay.” Notification is not required only if the entity can establish that misuse of the information is not reasonably possible.10Justia. New Jersey Revised Statutes Section 56:8-163
HIPAA adds separate obligations. A breach affecting 500 or more people must be reported to the HHS Secretary within 60 calendar days of discovery. Breaches affecting fewer than 500 people must still be reported, but the deadline is within 60 days after the end of the calendar year in which the breach was discovered.11HHS.gov. Submitting Notice of a Breach to the Secretary Larger breaches also trigger public posting on the HHS breach portal.
Penalties for Violations
Consequences for mishandling medical records come from three directions in New Jersey.
State Licensing Discipline
The New Jersey Board of Medical Examiners can suspend or revoke a provider’s license for violating record-keeping and confidentiality requirements.12Justia. New Jersey Revised Statutes Section 45:1-21 – Refusal to License or Renew, Grounds Civil monetary penalties also apply under the state’s healthcare facility regulations. Patients harmed by willful or negligent breaches of confidentiality can pursue damages in court under New Jersey’s common law right to privacy.
Criminal Liability
Falsifying, destroying, or altering a medical record to deceive or mislead someone about a patient’s diagnosis, treatment, or medical history is a fourth-degree crime in New Jersey.13Justia. New Jersey Revised Statutes Section 2C:21-4.1 – Destruction, Alteration, Falsification of Records More general record-tampering offenses under N.J.S.A. 2C:21-4 also apply when someone falsifies or conceals records with the intent to deceive or conceal wrongdoing.14Justia. New Jersey Revised Statutes Section 2C:21-4 – Falsifying or Tampering With Records
Federal HIPAA Penalties
HIPAA violations carry civil monetary penalties that are adjusted for inflation each year. As of the most recent adjustment, the four penalty tiers range from roughly $200 per violation for cases where the entity did not know about the violation, up to more than $73,000 per violation for willful neglect that goes uncorrected. The annual cap for violations of a single provision now exceeds $2.1 million.15Federal Register. Annual Civil Monetary Penalties Inflation Adjustment With both state and federal regulators capable of bringing actions, compliance failures in this area tend to compound quickly.