How Long to Keep Medical Records in New York: HIPAA and State Law Requirements

For healthcare providers in New York — whether a large hospital network in Manhattan, a private medical practice in Westchester, a dental office in Queens, or a physical therapy clinic on Long Island — the question of how long to keep medical records is one of the most consequential compliance questions they face. The answer involves a sometimes contradictory web of federal HIPAA requirements, New York State Public Health Law, and professional licensing obligations. And critically, once the applicable retention period has passed, how long to keep medical records in New York under HIPAA is only half the question — the other half is how to destroy them properly.

Improperly disposed patient records are among the leading causes of HIPAA violations. When medical charts, lab reports, radiology printouts, or billing records end up in general trash or unsecured recycling bins, the covered entity faces substantial civil penalties — and potentially criminal prosecution in egregious cases. This guide explains New York’s medical record retention requirements, the HIPAA standards for disposal, and how certified shredding protects healthcare providers from enforcement action.

How Long Must Medical Records Be Kept in New York?

New York State law sets the baseline for medical record retention. Key requirements under New York Public Health Law and HIPAA include:

• Adult patient records: New York requires medical records to be retained for a minimum of six years from the date of service or three years from the date the patient reaches 18, whichever is longer
• Minor patient records: Must be retained until the patient reaches age 21 or for six years from the date of last service, whichever is longer — meaning a child treated at age 2 has records that must be kept until age 21
• Mental health records: New York imposes additional requirements for mental health records under the Mental Hygiene Law; records related to involuntary commitment must be retained for at least ten years
• Hospital records: New York hospital regulations require retention of the complete medical record for six years from discharge, or three years after the patient reaches majority, or until the patient is 21, whichever is longest
• Mammography records (federal): Under the Mammography Quality Standards Act, mammography films must be retained for five years or ten years if no prior mammogram exists
• Immunization records: Must be maintained for the life of the patient in many practice settings

These are minimum requirements. Many healthcare attorneys in New York recommend retaining adult records for ten years and minor records until the patient reaches 27 — to cover the longest plausible statute of limitations for malpractice claims. Visit our compliance resources page to learn more about how shredding supports HIPAA compliance.

HIPAA Requirements for Medical Record Disposal

HIPAA’s Privacy Rule does not specify exact record retention periods (those are set by state law), but it does require that covered entities and business associates implement policies and procedures to protect patient information through its final destruction. The HIPAA Security Rule and Privacy Rule both address disposal:

1. Privacy Rule (45 CFR 164.530): Requires covered entities to implement administrative, technical, and physical safeguards to protect PHI, including during disposal
2. HHS guidance on disposal: The Department of Health and Human Services has specifically stated that disposing of PHI in unsecured trash violates HIPAA, and that proper disposal means making PHI unreadable, indecipherable, and unable to be reconstructed
3. Business Associate Agreements: Shredding companies handling PHI must sign a HIPAA Business Associate Agreement (BAA) with the covered entity — New York Shredding provides BAAs as a standard element of service

For paper medical records, “unreadable and unable to be reconstructed” means professional cross-cut or micro-cut shredding. Our HIPAA-compliant shredding services include a signed BAA and a Certificate of Destruction after every service.

What Happens When You Dispose of Medical Records Improperly?

HIPAA enforcement statistics underscore the stakes. HHS Office for Civil Rights (OCR) has investigated and settled numerous cases involving improper disposal of PHI, including:

• Patient records found in dumpsters outside medical practices
• Medical records discovered in abandoned office buildings after physician retirements
• Paper records incorrectly placed in standard recycling bins
• Medical files left in storage units that were subsequently auctioned

Civil monetary penalties for HIPAA violations range from $100 to $50,000 per violation (per record), with annual maximums of $1.9 million for violations of the same provision. For a medical practice that improperly disposes of 50 patient records, the penalty exposure is significant — and reputational damage to a healthcare provider can be permanent.

Creating a Medical Record Destruction Schedule

Healthcare providers in New York should build a structured medical record destruction schedule that complies with both HIPAA and New York State law:

• Document your retention periods for each record type in a written policy
• Designate a compliance officer or office manager responsible for tracking retention dates
• Deploy locked HIPAA-compliant shredding consoles in clinical areas, nursing stations, and administrative offices
• Schedule periodic purges — typically annual — with New York Shredding for expired records
• Execute a Business Associate Agreement before any patient records are handled by an outside shredding company
• Retain Certificates of Destruction indefinitely as part of your HIPAA compliance documentation

Contact New York Shredding to schedule a free consultation and receive our standard HIPAA Business Associate Agreement.

Why New York Businesses Choose New York Shredding

For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.

Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your healthcare practice on a shredding schedule that keeps you HIPAA-compliant year-round.

Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.