How Long Should Dental Practices Keep Patient Records?

Every dental practice accumulates patient records. X-rays, treatment notes, insurance claims, financial records. Over years, this becomes massive amounts of data.

At some point, you need to ask: how long do we keep all this? Can we delete old records? What are the legal requirements?

The answers are more complicated than you might expect.

Legal Requirements in Arizona

Arizona law requires dental practices to maintain patient records for at least six years from the date of last treatment for adult patients.

For minor patients, records must be kept for at least three years after the patient reaches age 18, or six years from last treatment, whichever is longer.

These are minimum requirements. Other factors may require longer retention.

Federal Requirements

HIPAA

HIPAA doesn't specify how long to keep medical records. But it does require you to keep documentation of HIPAA compliance (policies, training records, breach notifications) for at least six years.

Insurance and Medicare

If you accept Medicare or Medicaid, you must keep records for at least five years. Some insurance contracts require longer retention.

Tax Records

IRS requires keeping business records (including patient financial records) for at least three years, and up to seven years in some situations.

Practical Considerations

Statute of Limitations

Arizona's statute of limitations for malpractice claims is two years from discovery of injury. But injuries might not be discovered immediately.

Keeping records longer than minimum legal requirements provides protection if claims arise years later.

Continuity of Care

Patients sometimes return after years away. Having their historical records helps provide better care.

Long-term retention serves patient care even when legal requirements don't require it.

Storage Costs

The longer you keep records, the more storage you need. Digital records are cheaper to store than paper, but still have costs.

This creates tension between keeping everything forever and managing storage expenses.

What to Keep and for How Long

Clinical Records

Treatment notes, radiographs, periodontal charts, consent forms, referrals.

Recommendation: Minimum six years from last treatment for adults. For minors, three years after age 18 or six years from last treatment, whichever is longer.

Many practices keep clinical records for 10 years or permanently for continuity of care.

Financial Records

Billing records, insurance claims, payment history, ledgers.

Recommendation: Minimum seven years for tax purposes. Insurance contracts may require longer.

Radiographs

X-rays, digital images, CBCT scans.

Recommendation: Same as clinical records. But digital images are cheap to store, so many practices keep them indefinitely.

HIPAA Compliance Documentation

Privacy policies, security policies, training records, Business Associate Agreements, breach notification documentation.

Requirement: Six years minimum. Keep indefinitely for practices with long history.

Record Destruction

When retention periods expire and you decide to delete records, destruction must be done securely.

Paper Records

Shredding or incineration. Don't just throw patient records in the trash. That's a HIPAA violation.

Use a certified document destruction service if you're destroying large volumes.

Digital Records

Secure deletion that makes data unrecoverable. Simply deleting files doesn't actually erase data from hard drives.

For computers being retired, use disk wiping software or physical destruction of drives.

Document Destruction

Keep records of what was destroyed and when. If questions arise later about why you don't have certain records, documentation of proper destruction per retention policy protects you.

Creating a Retention Policy

Every practice should have a written record retention policy documenting:

• What types of records are kept
• How long each type is retained
• Where records are stored
• Who has access
• How records are destroyed when retention periods expire
• How destruction is documented

Having a policy shows you're thinking about records management systematically, not just accumulating data forever.

Special Situations

Patient Requests for Records

Patients have right to access their records under HIPAA. If they request records and you've already destroyed them per your retention policy, document the request and why records are no longer available.

Litigation Hold

If you're sued or reasonably anticipate litigation, don't destroy any records related to the case even if retention periods have expired. Place a litigation hold preserving relevant records.

Practice Sale or Closure

If you sell your practice or close it, you're still responsible for patient records. Either transfer them to the new owner, provide them to patients, or arrange for continued secure storage meeting retention requirements.

Digital vs. Paper Considerations

Digital Advantages

Digital records are easier to store long-term. Cloud storage is inexpensive. You can keep records indefinitely without massive physical storage space.

Digital records are also easier to search and retrieve when needed.

Digital Challenges

File formats change over time. Records stored 20 years ago might be in formats current software can't read.

Plan for format migration as technology changes. Don't lock yourself into proprietary formats that might become inaccessible.

Paper Challenges

Physical storage is expensive. Climate control to prevent deterioration adds cost. Retrieval is slow.

But paper doesn't require software to read and won't become obsolete due to format changes.

Recommended Approach

For most Arizona dental practices:

1. Keep all clinical records for at least 10 years from last treatment
2. Keep minor patient records until three years after they turn 18, minimum
3. Keep financial records for at least seven years
4. Keep HIPAA compliance documentation indefinitely
5. Have a written retention policy
6. Document destruction when you do delete old records
7. When in doubt, keep records longer rather than shorter

Storage is cheap compared to the cost of not having records when you need them.

Our Take

Record retention is one of those topics that seems straightforward until you dig into details. State requirements, federal requirements, insurance contracts, and practical considerations all factor in.

The safest approach for most practices is keeping clinical records longer than minimum legal requirements. Digital storage makes this practical and affordable.

If you need help developing a record retention policy or implementing secure record destruction procedures, we can help. We've been working with Arizona dental practices since 1991 and understand both the legal requirements and practical realities.

When in doubt about whether to keep or delete old records, err on the side of keeping them. Storage is cheaper than the problems created by destroying records prematurely.