There’s no single national deadline for how long mental health records need to be kept. The required period depends on state law, the patient’s age at the time of treatment, whether federal healthcare programs were involved, and whether any legal or clinical circumstances extend the clock. In practice, timelines run from about five years for a straightforward adult case to more than 25 years for records of a young child, and providers are expected to follow whichever rule demands the longest hold.
HIPAA Does Not Set the Retention Period
The most common assumption about mental health records is that HIPAA controls how long they must be kept. It doesn’t. The Department of Health and Human Services has stated directly that the HIPAA Privacy Rule does not include medical record retention requirements and that state laws generally govern how long records are held.1HHS.gov. Does the HIPAA Privacy Rule Require Covered Entities to Keep Patients’ Medical Records for Any Period of Time?
What HIPAA does require is that, for as long as a provider holds protected health information, they maintain appropriate administrative, technical, and physical safeguards to protect it.2eCFR. 45 CFR 164.530 – Administrative Requirements So the federal rule governs how records are protected, not when they can be destroyed. That question belongs to state law and professional standards.
How Long Records Are Kept for Adult Patients
For adults, most states require mental health records to be retained somewhere between five and ten years after the last date of service. The clock starts at the final point of clinical contact: the last session, the last prescription, the last documented interaction. Different states pick different points inside that range.
Professional licensing bodies layer their own minimums on top of the state rule. The American Psychological Association recommends that psychologists retain full records for at least seven years after the last date of service for adult patients.3American Psychological Association. Record Keeping for Practitioners Boards for social workers, licensed counselors, and psychiatrists in individual states set their own numbers. When the professional standard is longer than state law, the provider follows the longer one.
The result is that a therapist in a five-year state who holds an APA-aligned license still keeps records for seven years. Retention always tracks to whichever applicable rule reaches furthest out.
Records of Children and Adolescents Stay Much Longer
Records from childhood treatment are held for far longer than adult records. The reason is simple: a person treated as a minor needs a reasonable window after reaching adulthood to see their own file, continue care, or pursue a legal claim. Because 18 is the age of majority in most states, the retention clock is usually calculated from that birthday rather than from the last session.
The APA guideline recommends keeping a minor’s records for at least three years past the age of majority, or seven years after the last date of service, whichever is later.3American Psychological Association. Record Keeping for Practitioners Many state laws use a similar structure with different numbers. Some require records until the patient turns 21; others push the obligation into the late twenties or to age 30.
The math adds up quickly. A child who begins therapy at four in a state requiring retention until three years past majority would have their file held for 17 years. In states with a longer post-majority window, retention for a young child’s records can exceed 25 years. Malpractice statutes of limitations are frequently paused during minority, which gives providers an independent reason to keep these files long past the treatment date.
Medicare, Medicaid, and Federally Funded Care
Providers who treat patients under federal healthcare programs face retention rules that often push past the state baseline. These exist so federal agencies can audit billing, investigate fraud, and evaluate care paid for with public money.
- Medicare-participating hospitals must retain medical records for at least five years in their original or legally reproduced form.4eCFR. 42 CFR 482.24 – Condition of Participation: Medical Record Services
- Medicare Advantage (Part C) organizations must maintain books, records, and documents sufficient for CMS to audit financial records and evaluate the quality and timeliness of services for 10 years.5eCFR. 42 CFR 422.504 – Contract Provisions
- Medicaid managed care organizations must retain specified records for no less than 10 years, with CMS reserving the right to audit for 10 years from the final date of the contract period or from the completion of any audit, whichever is later.6eCFR. 42 CFR 438.3 – Standard Contract Requirements
There is also a fraud dimension. The federal False Claims Act allows civil action up to six years after an alleged violation, and up to 10 years when the relevant facts were discovered later. For mental health providers who bill Medicare or Medicaid, the records supporting those claims are the primary defense against a fraud investigation, and destroying them before the 10-year outer window closes carries a risk most compliance officers will not accept.
Mental Health Care Tied to Workplace Exposure
If mental health treatment was documented as part of an occupational health program, an entirely different rule can apply. OSHA requires employers to preserve employee medical records for the duration of employment plus 30 years when those records relate to exposure to toxic substances or harmful physical agents.7Occupational Safety and Health Administration. 1910.1020 – Access to Employee Exposure and Medical Records Counseling after a chemical incident or treatment for an occupational stress condition can fall inside that hold.
What Pauses or Extends the Retention Clock
Even when the standard retention period would normally expire, several circumstances stop the clock and require continued preservation.
- Pending or reasonably anticipated litigation. Once a provider knows about a lawsuit or has reason to expect one, they have a legal duty to preserve all relevant records until the matter is fully resolved, including appeals. This duty overrides normal retention schedules.
- A written patient request. A patient may ask that their records be kept beyond the standard period because of a disability claim, future treatment, or a legal matter. Providers should honor these requests.
- Unresolved billing or insurance disputes. Records tied to outstanding claims or payment appeals must be held until the financial issue is settled.
- Research participation. When a patient has consented to have their records used in a study, the records must be retained for the duration of the study.
The litigation hold is the most common reason records survive past their standard period and the one most likely to cause serious trouble if ignored. Destroying records relevant to reasonably anticipated litigation can result in court sanctions, adverse inferences, and separate legal liability.
Psychotherapy Notes Are Handled Differently
Federal law treats two parts of a therapy file separately. The general treatment record includes diagnoses, treatment plans, medication information, session dates and duration, and clinical progress notes. Psychotherapy notes are the therapist’s personal notes documenting or analyzing the content of counseling sessions, kept apart from the rest of the medical record.8HHS.gov. Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information?
Psychotherapy notes receive heightened privacy protections because they contain the most sensitive material. With few exceptions, a provider must obtain your written authorization before disclosing them to anyone, including other healthcare providers.8HHS.gov. Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information? There is no separate federal retention period for these notes, so they follow the same state-law timelines as the rest of the record. Access rules are different, though: providers can deny you access to psychotherapy notes, and to information compiled in anticipation of legal proceedings.9eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
Getting Your Records Before They Are Destroyed
Under HIPAA, you have the right to inspect and obtain a copy of your protected health information for as long as your provider maintains it, subject to the psychotherapy-notes and legal-proceedings exceptions above.9eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information The right lasts only as long as the records themselves.
If you’re approaching the end of a known retention period and want copies for future treatment or personal reasons, request them before the provider is legally permitted to destroy the file. Providers can charge reasonable copying fees, which vary by state, but they cannot refuse the request because it’s inconvenient.
If you were treated as a child and are now an adult, you can request those childhood records yourself. Given the long retention rules for minors’ files, there is often a multi-year window after your 18th birthday when the records are still available. Don’t assume a childhood therapist still has your file decades later, and don’t assume it was destroyed either. Ask.
When the Provider Retires or Closes the Practice
A therapist retiring or closing a practice does not end the retention obligation. Records still have to be maintained for the full required period, which means someone has to take custody of them. This is an area where professional ethical standards fill gaps that state laws often leave vague.
Standard practice is for a departing provider to arrange for another licensed professional or a secure records storage service to hold the files. Patients should be notified of the closure and told how to reach their records afterward. Professional ethical codes recommend that mental health providers include record disposition instructions in their estate planning, so files are handled properly if the provider becomes incapacitated or dies.
If your therapist has retired or closed and you need your file, start by contacting the provider directly. If that fails, contact their professional licensing board, which may have information about the records custodian. Hospitals and group practices usually transfer records internally, but solo practitioners sometimes leave patients without a clear path to their files. The sooner you look, the better the odds of finding them.