South Carolina Medical Records Statute: Access, Fees, Retention

South Carolina medical records law gives patients a written right to obtain copies of their records, caps what providers can charge, sets minimum retention periods, and backs confidentiality with both state remedies and federal HIPAA penalties. The core state statute is the Physicians’ Patient Records Act in Title 44, Chapter 115 of the South Carolina Code, and it works alongside separate rules for hospitals and the federal privacy and security standards that apply to almost every provider.¹

How to Request Your Records

Under South Carolina Code 44-115-30, a patient or their legal representative can ask a physician to provide a copy of the medical record or transfer it to another physician. The request must be in writing and signed by the patient or by someone legally authorized to act for them. A provider cannot release the record without that signed authorization.²

You can ask for the record in printed or electronic format. Electronic copies are available only when the record is already stored electronically and the provider can produce it without extra cost.² Federal law reinforces electronic access: under the 21st Century Cures Act, providers who knowingly and unreasonably interfere with patient access to electronic health information face disincentives from the HHS Office of Inspector General.³

Timing differs by provider type. Hospitals and other health care facilities fall under Section 44-7-325, which gives them 45 days after discharge or 45 days after the request is received, whichever is later. A facility cannot be forced to release a record earlier than 30 days after discharge. The Physicians’ Patient Records Act sets no equivalent deadline for physician offices, but unreasonable delays can lead to complaints and liability.

What Copies Can Cost

Section 44-115-80 caps what a physician may charge for copies, with separate ceilings for electronic and printed records.

Electronic format: $0.65 per page for the first 30 pages and $0.50 per page for the rest, plus a clerical fee of up to $25, with a combined cap of $150 per request. Actual postage and sales tax may be added above the cap.
Printed format: the same per-page rates and clerical fee, with a combined cap of $200 per request, plus actual postage and sales tax.

The caps matter most on large records. A 300-page printed record would come to $154.50 in per-page charges plus the $25 clerical fee, but the $200 ceiling holds the pre-postage total at $200.⁴ A provider who charges more than the statute allows can be required to reimburse the patient.

How Long Providers Must Keep Records

Retention rules depend on the type of provider and the patient’s age at last treatment.

Physicians

Under Section 44-115-120, a physician must keep an adult patient’s records for at least ten years from the last date of treatment. For minors, the minimum is thirteen years from the last treatment date. After these periods, the records may be destroyed.⁵ The clock runs from the last treatment, not from the patient’s birthday. A child last treated at age three would have records kept until age sixteen, not age twenty-eight.

Hospitals

Hospitals follow S.C. Code Ann. Regs. 61-16, Section 1107. The minimum is ten years for adult patients. For minors, hospital records must be kept until the patient reaches age eighteen. Because the physician rule and the hospital rule use different measuring points, a minor’s hospital record and physician record may have different destruction dates.

These periods also matter for malpractice. South Carolina requires a Notice of Intent to File Suit before a medical malpractice case can proceed, and the retention floors line up with the practical need to preserve records through the limitations window.⁶

If Your Doctor Retires, Closes, or Dies

South Carolina Regulation 81-1 addresses what happens to records when a physician becomes incapacitated, disappears, or dies. The Board of Medical Examiners can appoint another licensed physician to take custody of the records and manage their distribution. The appointed physician must:

Send first-class mail to each patient at the address on file, explaining the right to obtain the records and how to do so.
Post a notice in a visible location at the physician’s last known office.
Publish a notice once a week for three consecutive weeks in a newspaper circulated in the county where the physician practiced, including the physician’s name and address, the time and location for picking up records, and the appointed physician’s contact information.
Send first-class mail to malpractice insurers and other entities that need to know.

Records can only be released on proper written authorization, and the appointed physician must obtain a receipt from whoever picks them up.⁷ If you learn that your doctor has stopped practicing, contact the Board of Medical Examiners to find out who now holds your records.

Correcting Errors in Your Record

Mistakes in a medical record can follow you for years, from a wrong allergy to a stale diagnosis. The HIPAA Privacy Rule gives you the right to request an amendment to your protected health information. The provider must act on the request within 60 days and may take one 30-day extension only after sending you a written explanation and a new deadline.⁸

If the provider denies the request, the denial must be in writing and explain why. You can then submit a written statement of disagreement, which becomes part of the record. The provider can limit how long the statement is but cannot refuse to include it, so even a denied correction leaves a paper trail that future providers will see.⁸

When Records Can Be Shared Without Your Consent

The default rule is no release without signed authorization. Several exceptions matter in practice.

Treatment, Payment, and Health Care Operations

Providers may share records with other treating physicians for continuity of care, and insurers can access what they need for billing and claims. Disclosures must be limited to the minimum necessary to accomplish the purpose.

Workers’ Compensation

Employers and their insurers can obtain records relating to a workers’ compensation claim under South Carolina Code 42-15-95. Access is generally limited to the specific work-related injury, not the full medical history.

Law Enforcement

HIPAA permits disclosure to law enforcement without the patient’s authorization in several defined situations:

A court order, warrant, or similar judicial process.
A written administrative request stating that the information is relevant, specific in scope, and that de-identified data would not work.
Mandatory reporting under state law, such as gunshot wounds, stab wounds, or suspected abuse.
A disclosure to someone reasonably able to prevent a serious and imminent threat to health or safety.
Information the provider believes in good faith is evidence of a crime that occurred on its premises.

Outside those categories, law enforcement needs a signed HIPAA authorization to obtain the record.⁹

Sensitive Records Have Stricter Rules

Two categories carry a higher consent bar. Psychotherapy notes, which are a mental health professional’s personal session notes kept separate from the main chart, almost always require specific written authorization before disclosure, even to another treating provider. The narrow exceptions include mandatory abuse reporting and serious, imminent threats of harm.¹⁰ Substance use disorder treatment records are governed by 42 CFR Part 2, which requires a written consent that identifies the patient, the specific information, the recipient, the purpose, and an expiration date or event, and counseling notes require their own separate consent form.¹¹

Records of a Deceased Patient

HIPAA rights carry past death. A deceased patient’s personal representative, typically the executor or administrator appointed by a South Carolina probate court, has the right to access the decedent’s protected health information.¹² If instead it is the physician who has died, Regulation 81-1 governs how the records are preserved and released by the appointed custodian physician.⁷

Confidentiality, Security, and Disposal

State law treats medical records as confidential, and the federal HIPAA Security Rule layers on administrative, physical, and technical safeguards for electronic health information.¹³ Providers must restrict access to staff with a legitimate need, train employees on privacy, and keep audit logs of record access. The South Carolina Department of Public Health oversees facility compliance and accepts complaints about privacy violations.¹⁴

Once a record reaches the end of its retention period, disposal must prevent recovery. Paper is shredded or otherwise rendered unreadable, and electronic records are securely erased. Deleting a file or throwing paper in the trash does not meet the standard.

Penalties When the Rules Are Broken

Enforcement runs on parallel state and federal tracks.

State Remedies

A patient denied access to records or whose confidentiality has been breached can bring a civil suit, and courts can award compensatory and punitive damages for willful violations. The Department of Public Health’s Healthcare Quality division issues administrative and consent orders, imposes civil monetary penalties, and publishes enforcement actions monthly.¹⁴ Professional licensing boards can suspend or revoke a provider’s license for serious misconduct involving records.

HIPAA Civil Penalties

The HHS Office for Civil Rights enforces HIPAA under a tiered civil penalty structure adjusted annually for inflation. The 2025 figures run from $145 per violation at the lowest tier up to more than $2.19 million per year for willful neglect that is not corrected. The tier turns on culpability: lack of knowledge, reasonable cause, willful neglect corrected within 30 days, and willful neglect not corrected within 30 days.

HIPAA Criminal Penalties

The Department of Justice prosecutes criminal HIPAA violations under 42 U.S.C. 1320d-6, with penalties scaled to intent:

Knowing violation: up to $50,000 and one year in prison.
Violation under false pretenses: up to $100,000 and five years in prison.
Violation with intent to sell, transfer, or use health information for commercial advantage, personal gain, or malicious harm: up to $250,000 and ten years in prison.

The ten-year tier is reserved for the most serious conduct, such as selling patient data or accessing records to harm someone personally.¹⁵

Breach Notification

If unsecured protected health information is breached and 500 or more people are affected, the provider must notify the affected patients and the HHS Secretary within 60 days of discovery. For smaller breaches, the provider logs each incident and reports all breaches from the prior year to HHS no later than 60 days after the calendar year ends.¹⁶ South Carolina may add state-level notification obligations, and providers should follow whichever deadline is shorter.

1
South Carolina Legislature. South Carolina Code Title 44 Chapter 115 – Physicians’ Patient Records Act
2
South Carolina Legislature. South Carolina Code 44-115-30 – Patient’s Right to Receive Copy of Medical Record or Have It Transferred to Another Physician; Written Authorization Required
3
ONC. Information Blocking
4
South Carolina Legislature. South Carolina Code 44-115-80 – Fees Physician May Charge for Search and Duplication of Records
5
South Carolina Legislature. South Carolina Code 44-115-120 – Length of Time Records Must Be Kept; Records Pertaining to Minors
6
South Carolina Legislature. South Carolina Code Title 15 Chapter 79 – Medical Malpractice
7
Legal Information Institute. South Carolina Code Regs. 81-1 – Safeguarding Patient Medical Records When a Physician Licensee Is Incapacitated, Disappears, or Dies
8
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
9
U.S. Department of Health and Human Services. HIPAA Privacy Rule: A Guide for Law Enforcement
10
U.S. Department of Health and Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health
11
eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
12
U.S. Department of Health and Human Services. Individuals’ Right Under HIPAA to Access Their Health Information
13
eCFR. 45 CFR Part 164 – Security and Privacy
14
South Carolina Department of Public Health. Healthcare Quality Enforcement Actions
15
Office of the Law Revision Counsel. 42 U.S. Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
16
eCFR. 45 CFR Part 164 Subpart D – Notification in the Case of Breach of Unsecured Protected Health Information