State Law, Not HIPAA, Sets Your Retention Clock

One of the most persistent misconceptions in chiropractic offices is that HIPAA dictates how long you must store patient charts. It does not. Under 45 CFR 164.530(j), HIPAA requires covered entities to retain administrative compliance documents—privacy policies, training logs, business associate agreements, breach documentation—for six years from the date of creation or last effective date. That rule has nothing to do with patient treatment records. The obligation to keep a patient's chart, X-ray, billing history, or treatment plan alive is governed by your state's chiropractic or medical board regulations. In Washington, for example, WAC 246-808-650 requires any chiropractor treating patients in the state to retain all treatment records, including X-rays, treatment plans, patient charts, histories, correspondence, financial data, and billing, for five years in an orderly, accessible file. Most other states set minimums in the five-to-ten-year range, but a handful go longer, and a few (like Wyoming) impose no state-mandated physician retention period at all. If your office bills Medicare, add another layer: hospitals participating in Medicare must keep records at least five years under 42 CFR 482.24, and Medicare Advantage organizations and Part D sponsors owe ten years under 42 CFR 422.504(d) and 42 CFR 423.505(d). The practical rule for your office is to follow whichever requirement is longest—state board, federal program, or payer contract—and document which authority you are relying on.

Minor patients add a second, often longer, clock. Because the statute of limitations for a malpractice or injury claim frequently does not begin running until a child reaches the age of majority, many states extend retention well past the treatment date. Arizona requires records to be kept until three years after the patient turns 18 or six years from the last treatment, whichever is later. Maryland holds minor records until the patient is 25. North Carolina requires hospitals to retain a minor's record until the patient turns 30. If your practice treats adolescents—common in chiropractic, where many patients first present in their teens—you need to track the birth date alongside the last-visit date so the correct endpoint fires automatically. In ChiroTouch, patient demographics and visit history live in the same chart, so office managers can build a simple internal flag or report that surfaces minor-patient records approaching their extended retention window before they are eligible for archive or destruction.

When a record does reach the end of its required period, the destruction process itself carries obligations that many small offices overlook. Washington's rule, for instance, requires that office records state the date records were released, the method by which they were forwarded, to whom, and the reason for the release. A reasonable fee may be charged to cover mailing and clerical costs when a patient or another licensed provider requests copies. Across the country, the pattern is similar: you must be able to produce the record on demand within a set window (fifteen days in Washington for an adult patient's written request), and you must log the transaction. If your practice runs ChiroTouch Cloud—identifiable by an account number beginning with CTC—your records are accessible from any authorized workstation, which makes responding to a patient's release request or a referring provider's written request faster than pulling a paper file from a back-office cabinet. Staff should still follow your office's internal protocol for logging each release, noting the date, recipient, method, and reason, so that the audit trail exists even if the underlying record later reaches the end of its retention period.

A practical retention workflow for a multi-provider chiropractic office looks like this. First, confirm your state's minimum for adult and minor records with your state board or administrative code; do not rely on a single blog post or a colleague's recollection. Second, cross-check any Medicare, Medicare Advantage, or workers' compensation payer contracts for longer periods. Third, set a review cadence—annually is common—where your office manager or compliance lead pulls a report of patients whose last visit falls near the retention threshold and verifies whether any pending litigation, open workers' comp claim, or active subpoena extends the obligation. Fourth, when records are lawfully ready for destruction, use a secure method (cross-cut shredding for paper, certified deletion for electronic files) and retain a destruction log that names the records, the date, the method, and the authorizing person. None of this replaces legal counsel; state rules change, and the interaction between a board regulation, a federal program requirement, and a payer contract can produce an unexpected obligation. But a clear, documented process removes the guesswork from the one compliance task that, once missed, cannot be undone.

Sources and further reading