When a medical practice closes, patient files don’t disappear with it. State and federal law require the practice, or a designated custodian, to keep those records for years after the doors shut, to notify patients in advance, and to release copies on request. Understanding what happens to patient files when a practice closes helps you get your records before they’re archived, transferred, or eventually destroyed.
The Notice You Should Receive Before Closure
A closing practice should send written notice to every active patient at least 60 to 90 days before the closure date. The letter needs to include the date the practice will stop seeing patients, how and where to request a copy of your medical records, and a recommendation to find a new provider. For patients mid-treatment or managing serious chronic conditions, the notice often arrives by certified mail.
If the physician has arranged for another practice to accept patients, the notice should name that practice while making clear you’re free to choose any provider. If records will be stored with a custodian rather than transferred to a successor, the notice should include the custodian’s contact information so you can retrieve your file after the office closes. A sign in the waiting room or a note on the practice website may supplement direct mail, but it doesn’t replace it.
How to Request Your Records
Your right to obtain copies of your medical records is federally enforceable and does not end when a practice closes. Under HIPAA, the practice (or its custodian) must respond to a records request within 30 calendar days. If the records are archived offsite or otherwise not readily accessible, one 30-day extension is allowed, but the practice must notify you in writing within the initial 30 days, explain the delay, and give a specific date the records will be available.1U.S. Department of Health and Human Services. Individuals Right Under HIPAA to Access Their Health Information
Practices can charge a reasonable, cost-based fee for copies. The fee is limited to labor for copying, supplies for the medium (paper, CD, or USB drive), and postage if you want the records mailed.1U.S. Department of Health and Human Services. Individuals Right Under HIPAA to Access Their Health Information Per-page fees for paper copies vary by state, with authorized rates ranging roughly from $0.25 to $2.00 per page. For electronic copies sent directly to the patient, HHS has recognized a flat fee of $6.50 as a reasonable charge that satisfies the cost-based standard. State laws may set their own caps, so the applicable fee depends on the format you request and the state involved.
Electronic Records
If the practice uses an electronic health record system, it must provide records in the electronic format you request when that’s technically feasible. Since April 2021, the 21st Century Cures Act prohibits healthcare providers from information blocking — practices that interfere with access to, exchange of, or use of electronic health information. Certified health IT standards and other machine-readable formats are covered.2eCFR. 45 CFR Part 171 – Information Blocking Enforcement penalties for healthcare providers are still being developed by HHS, but the access right itself is in force.3HHS Office of Inspector General. Information Blocking
Where Your Records Go If You Don’t Claim Them
Not every patient responds to a closure notice. The files that remain become the responsibility of a designated custodian: usually the closing physician, a successor practice that agreed to take them, or a professional medical record storage company. Whoever holds the records must maintain the same privacy and security protections that applied when the practice was open. HIPAA requires appropriate administrative, technical, and physical safeguards for as long as protected health information is held, no matter who holds it.4HHS.gov. Does the HIPAA Privacy Rule Require Covered Entities to Keep Patients Medical Records for Any Period of Time
For paper records, that means a locked, climate-controlled facility with restricted access. For electronic records, it means encrypted storage with access controls and audit logging. The custodian must also be able to respond to your requests during the retention period, because your right to access does not expire just because the practice has closed.
How Long the Records Are Kept
HIPAA itself does not set a retention period for patient records. State law controls how long files must survive after your last date of service, and those timelines vary.4HHS.gov. Does the HIPAA Privacy Rule Require Covered Entities to Keep Patients Medical Records for Any Period of Time Most states require adult records to be retained for seven to ten years from the last encounter. Pediatric records often carry a longer obligation, typically until the child reaches the age of majority plus a set number of additional years.
Federal payer rules can extend those minimums. Medicare fee-for-service requires providers to maintain medical records for seven years from the date of service.5CMS. Medical Record Maintenance and Access Requirements Medicare Advantage (Part C) plans carry a ten-year retention requirement.6CMS. Medical Record Retention and Media Format for Medical Records Medicaid provider agreements generally require records to be kept for at least three years after a case becomes inactive, though some beneficiary categories require retention until the state satisfies estate recovery obligations.7eCFR. 42 CFR 431.17 – Maintenance of Records Practices generally keep records for whichever period is longest across state law, federal payer rules, and the malpractice statute of limitations. In practical terms, that gives most patients several years after a closure to request a copy.
Special Rules for Substance Use Disorder Files
If any part of your file relates to substance use disorder treatment, it’s governed by 42 CFR Part 2, which imposes confidentiality protections that go beyond standard HIPAA rules. These records cannot be used or disclosed in civil, criminal, or administrative proceedings except as specifically permitted by the regulation.8eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
When a Part 2 program closes, the default rule is that patient-identifying information must be destroyed or rendered non-retrievable, unless you consent in writing to transfer the records to another program or another law independently requires retention for a specific period. If a legal retention requirement applies, paper records must be sealed in labeled containers, and electronic records must be encrypted and transferred to a portable device or separate media with access controls, with the original media wiped within one year of closure.8eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records If you were treated at a program that’s shutting down, request a transfer or a copy in writing before the closure date rather than assuming the file will remain available.
When Records Are Finally Destroyed
Once every applicable retention period has run, unclaimed records are destroyed. HIPAA does not prescribe a single method, but it prohibits abandoning records or tossing them into an accessible dumpster.9U.S. Department of Health and Human Services Office for Civil Rights. Frequently Asked Questions About the Disposal of Protected Health Information
Acceptable methods for paper files include shredding, burning, pulping, or pulverizing the documents so the information cannot be reconstructed. Electronic media can be overwritten with software designed for that purpose, degaussed with a strong magnetic field, or physically destroyed by shredding, melting, or incinerating the device. HHS advises giving patients an opportunity to pick up their records before any disposition takes place.9U.S. Department of Health and Human Services Office for Civil Rights. Frequently Asked Questions About the Disposal of Protected Health Information If you receive a late-stage notice from a former provider or a storage company saying records are about to be destroyed, act on it quickly.
If You Can’t Find Your Records
If a practice closed and you don’t know where the files went, contact your state medical board. Most states require physicians to notify the board of a closure, and the board often serves as the point of contact for patients trying to locate records years later. The board may be able to point you to the custodian or the successor practice.
Your former insurer may also hold copies of claims data covering the dates of service, which won’t replace a clinical chart but can help reconstruct a treatment timeline.
When the Doctor Dies or the Practice Files Bankruptcy
Two situations can disrupt the normal closure process.
Death of a Solo Practitioner
When a solo practitioner dies unexpectedly, responsibility for patient records typically shifts to the estate. The executor or personal representative must ensure that records are retained for the full period required by state law, that patients are notified, and that files are transferred to a successor provider or placed with a secure custodian. If your former doctor has died, the estate is the right starting point; if you can’t reach the estate, the state medical board is the next stop.
Bankruptcy
A bankruptcy filing does not relieve a healthcare practice of its HIPAA obligations. Under Section 351 of the Bankruptcy Code, when a healthcare business debtor cannot afford to maintain patient records, the trustee or debtor in possession must provide written notice to patients and insurers, and unclaimed records must be destroyed in accordance with federal and state law rather than simply abandoned. Watch for that notice if you learn a former provider has filed, because the window to claim your file is defined by the notice itself.