How long do I need to maintain my patient's records?
The statutes (A.R.S. § 12-2297)
require a physician to retain the original or copies of a patient’s medical records for a minimum of six years past the last visit if the patient is an adult. If the
patient is a child, a doctor must maintain the records until the child is 21 or for at least six years
past the last patient visit - whichever is longer.
How should patients make their requests for their medical records?
The statutes (A.R.S. §12-2292)require that a physician must make medical records available when
a patient submits a request in writing. Patients often sign a release form, but a written request is
Once we have a written request for medical records, how soon must my office provide them?
Yes. It is unprofessional conduct for a physician to fail to make medical records “promptly available.”
(A.R.S. §1401(27)(rr)) Three weeks is a reasonable amount of time unless there are extenuating circumstances.
If a patient asks for copies of his records, may I charge for making them?
A doctor may not charge for making copies of a patient’s medical records if another physician, the
patient, or the healthcare decision maker requests them for continuity of care. Under other
circumstances, a physician may charge a patient or healthcare decision maker a reasonable fee for
the production of the records. And a doctor may require the payment of the fee in advance.
The patient has had other providers before becoming a patient of mine. When the patient requests the medical records,
do I need to give him all the records or just the ones I’ve created for his/her care?
The definition of “Medical Records” in the statutes (A.R.S. § 12-2291(5))“means all communications
related to a patient’s physical or mental health or condition that are recorded in any form or medium
and that are maintained for purposes of patient diagnosis or treatment, including medical records that
are prepared by a health care provider or other providers.” So, if the patient asks for his/her medical
records, that includes everything in the chart, whether you created it or not.
If the patient owes my practice money for visits or treatment, is it okay to withhold his requested medical records until he pays his bill?
A.R.S. §12-2293(B and C)specifies six conditions under which a health care provider may deny a request for access to or copies of
medical records or payment records. Delinquent balances are not an identified reason for withholding records.
Are there times that I can refuse a patient’s request for his medical records?
According to A.R.S. §12-2293 a doctor may deny a request if he determines that release of the
records would likely endanger the life or physical safety of a patient or another person, or if they
make reference to a person other than a healthcare professional and would likely cause substantial harm
to that other person, or if the records would likely cause substantial harm to the patient, or if they
would reveal information obtained under a promise of confidentiality with someone other than a healthcare professional.
There are other exceptions for clinical research and correctional institutions. Note: If you deny a request for medical records,
you must note this determination in the patient’s records and provide the patient or the healthcare decision maker with a written
explanation of the reason for denying access.
Are there other times when I would be required to release a patient’s medical records to third parties without the patient’s written authorization?
Yes. A.R.S. §12-2294 and §12-2294.01 require physicians to disclose medical records without
the patient’s written authorization as required by law or when ordered by a court or tribunal of competent jurisdiction. This includes
subpoenas. When required for diagnosis or treatment of the patient, a physician may disclose the medical records without written
authorization from the patient to other healthcare providers. And the doctor may disclose them to other healthcare providers who have
previously treated the patient without the patient’s written approval. Doctors may also release them to ambulance attendants, to a
private agency that accredits healthcare providers, to the Arizona Medical Board, to healthcare providers for peer review, to a person
or entity that provides billing and administrative services, to an attorney for the purpose of obtaining legal advice, to the patient’s
third party payor, or to the Industrial Commission of Arizona.
A patient has died. To whom may I release his records if I receive a written request?
A doctor may release records to the patient’s personal representative or administrator of his estate (A.R.S. §12-2294(D))
If no one has been appointed, a physician may release the records to the persons identified in A.R.S. §12-2294(D).
What if I provide the records as the law requires and then I am sued?
A healthcare provider who acts in good faith is not liable for damages in any civil action for the
disclosure of medical records.(A.R.S. § 12-2296).
I’m planning to retire (and/or sell my practice) in the next year or so. What should I do with the medical records?
When a health care provider retires or sells the provider’s practice, the provider shall take
reasonable measures to ensure that the records are retained for the appropriate period of time
(see above). (A.R.S. §12-2297(B))Additionally, A.R.S. §32-3211 requires a healthcare professional to “prepare a written protocol for the secure storage, transfer and access of the medical records.”
This protocol must specify the procedure by which you “will notify each patient in a timely manner”
before you terminate or sell the practice “in order to inform the patient regarding the future location
of the patient’s medical records and how the patient can access those records.” You may dispose of
unclaimed medical records after the specified period of time (see above) and after you have made
“good faith efforts to contact the patient.” The statute states that not complying with the requirements
is an act of unprofessional conduct. Also, once your practice address and practice phone numbers are
no longer accurate, state law (A.R.S. §32-1435)requires you to update your contact information with
the Arizona Medical Board in writing within 30 days. There is a “Change of Address” form available on
this Web site (under “Physician Center” in the homepage menu) for you to use. You may provide the Board
with a mailing address for patients to request medical records after you are no longer practicing in
Arizona or anywhere.
Please note: These answers are meant as a baseline guide and are not an exclusive list of all the legal requirements regarding record retention and release. Please read the entire content of the statutes cited
above and consult with your own legal counsel for proper legal advice in any given situation.