California Hospital
Record and Data Retention
Schedule
A guidebook on which records should be kept
and for how long
Record
Retention
RecordsdRetention_2018_FrontCover_ATP.indd 1 8/13/2018 1:33:50 PM
October 2018
9th Edition
Record and Data
Retention Schedule
A guidebook on which records should be kept
and for how long
Ordering Information
For more information, visit CHA online at www.calhospital.org/publications
This publication is designed to produce accurate and authoritative information with regard to the subject matter
covered. It is sold with the understanding that CHA is not engaged in rendering legal service. If legal or other expert
assistance is required, the services of a competent professional person should be sought.
© 1997, 2002 by the California Healthcare Association
Prior editions by the California Association of Hospitals and Health Systems and the California Hospital Association.
© 2011, 2018 by the California Hospital Association
All rights reserved. Ninth edition 2018.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means,
electronic, mechanical, photocopying, recording, or otherwise, without the prior written approval of:
California Hospital Association
ATTN: Publishing
1215 K Street, Suite 800
Sacramento, CA 95814
However, hospitals that are members of the California Hospital Association may use the model forms, signs and
handouts as templates in developing their own forms, signs and handouts.
It is the intent of CHA to strictly enforce this copyright.
Published by the California Hospital Association.
Printed in the United States of America.
Liz Mekjavich, Vice President, Publishing and Education
Lois J. Richardson, Esq., Vice President and Counsel, Privacy and Legal Publications/Education
Bob Mion, Director, Publishing and Marketing
Emily Stone, Publishing Manager
CHA Publications
Several helpful publications are available through CHA including:
• California Health Information
Privacy Manual
• California Hospital Compliance Manual
• California Hospital Survey Manual —
A Guide to the Licensing & Certification
Survey Process
• Consent Manual
• EMTALA — A Guide to
Patient Anti-Dumping Laws
• Guide to Release of Patient Information
• Healthcare Workplace Violence Prevention
• Hospital Financial Assistance Policies and
Community Benefit Laws
• Mental Health Law
• Minors & Health Care Law
• Model Medical Staff Bylaws & Rules
• Principles of Consent and
Advance Directives
• Record and Data Retention Schedule
• The Cal/OSHA Safe Patient Handling
Regulation
• The California Guide to Preventing
Sharp Injuries
Plus numerous human resource and volunteer publications.
Information contained in the manual should not be construed as legal advice or used to resolve legal problems by
health care facilities or practitioners without consulting legal counsel. A health facility may want to accept all or some
of the guidebook as part of its standard operating policy. If so, the health facility’s legal counsel and its board of
trustees should review the policy prior to implementation.
Table of Contents
PREFACE ......................................................................................................................V
RECORD RETENTION CONSIDERATIONS
.............................................................. 1
I. Introduction ...................................................................................................1
II. The Importance of Having a Records Management Policy ........................1
III. Primary Considerations in Developing a Record Retention Schedule ....... 2
A. Legal Requirements and Considerations ...................................................3
B. Frequency of Use ......................................................................................7
C. Space Constraints .................................................................................... 8
D. Historical or Research Use of Records ...................................................... 8
IV. Medical Records ...........................................................................................8
A. Retention Period Options .......................................................................... 8
B. Test Results, Tracings and Recordings ....................................................10
V. Electronic Records ...................................................................................... 11
A. Electronic Medical Records Requirements ..............................................11
B. Retention of Electronic Records .............................................................. 12
VI. Duplicate, Transitory and Nonsubstantive Records .................................. 12
VII. Legal Hold ................................................................................................... 12
VIII. Deletion, Disposal and Destruction of Records ........................................13
A. Change or Deletion of Medical Information: Audit Trails ........................... 13
B. Disposal or Destruction of Personal Information ...................................... 13
C. Process ..................................................................................................15
IX. CHA’s Recommended Retention Schedule ............................................... 15
A. General Retention Period ........................................................................ 15
B. How to Interpret the Schedule ................................................................16
C. Frequently Asked Questions ...................................................................16
RECOMMENDED RECORD RETENTION SCHEDULE
........................................... 19
WHERE TO FIND THE LAWS REFERENCED IN THE MANUAL
............................. 75
Health care providers create volumes of records dealing with a variety of matters. Some
concern the corporate, business and administrative aspects of their operations. Others
document unique areas, such as medical staff activities at hospitals. Still others trace the
course of care given to patients. Providers naturally consider retaining any record that is of
more than passing interest. However, as records accumulate, they occupy valuable space
that often could be put to better use. Storing records off-site or in electronic form may
alleviate the problem. However, these alternatives are likely to be expensive and do not
address the basic question of which records should be kept and for how long.
If health care providers are to deal intelligently with the problem, they must base their
decisions upon a firm knowledge of legal requirements and policy considerations. This
guide discusses those requirements and considerations, and recommends specific periods
for the retention of various classes of records.
The guide contains two sections. The first is a discussion of retention considerations as
they pertain to various kinds of records. The second section is a Recommended Retention
Schedule. It contains tables listing typical records, legal citations applicable to each health
care provider type, and recommended retention periods. This schedule does not list every
possible record that may be produced or retained by a health care provider but rather
provides recommendations and cites legal requirements for the most common documents.
For records not specifically addressed in this guide, CHA recommends considering
retention periods for records listed that are of a similar nature or purpose and consulting
your legal counsel.
The guide is not designed to serve as a substitute for legal counsel. If there are differences
of opinion, or where the law is unclear, a provider should consult legal counsel and then
make retention decisions based on the law and its own philosophy, mission and purpose.
Lois J. Richardson, Esq.
Vice President and Legal Counsel, Privacy and Legal Publications/Education
California Hospital Association
(916) 552-7611
Preface
1
©CALIFORNIA HOSPITAL ASSOCIATION
Record Retention
Considerations
I. INTRODUCTION
Health care providers create volumes of records dealing with a variety of matters. The
question naturally arises, which records should be kept and for how long?
This section of the Record and Data Retention Schedule discusses why hospitals and other
health care providers should have a record retention policy, the pertinent factors that should
be considered when determining how long to keep various documents, and considerations
regarding record disposal and/or destruction. The second section of the Record and Data
Retention Schedule (starting on page 21) is a Recommended Retention Schedule. It
contains tables listing typical records, provider types, any applicable legal citations, and
recommended retention periods.
The information in this manual applies identically to all records, regardless of media (paper,
electronic, microfiche, microfilm, video/audio recording, magnetic tape, CD-ROM, USB
sticks, etc.).
This guide is intended to be used as a reference document. The information is accurate
at the time of publication; however, the guide does not cover every law, rule or regulation
concerning record retention — it focuses on the ones most relevant to hospitals. Due
to the dynamic nature of the law, information of this kind is subject to change at any
time. Records should never be destroyed without first verifying that retention
requirements have not changed and litigation is not pending.
All of the laws cited in this manual can be found on the Internet. (See “Where to Find the
Laws Referenced in the Manual,” page75, for instructions on finding the exact language
of the laws.)
II. THE IMPORTANCE OF HAVING A RECORDS MANAGEMENT POLICY
Hospitals and other health care providers are advised to establish and implement written
policies and procedures regarding the retention and disposal/destruction of records.
Doing so will help the provider achieve compliance with state licensure laws, federal health
care program (Medicare, Medi-Cal) requirements, contractual obligations, accreditation
organization requirements, and other statutes and regulations. Without a written policy,
a provider may retain records longer than necessary, which is costly and inefficient, or
dispose of records too soon, resulting in the inability to access important documents when
needed. Disposing of records too soon may also lead to fines or penalties. On the other
hand, keeping documents too long incurs storage fees. In addition, if a record retention
policy limits how long information is kept, the hospital will have less information to search
and review if served with a subpoena or other document request. This can save the hospital
time and money, both employee time looking through documents and attorney time spent
reviewing them.
CHA Record and Data Retention Schedule 2018
2
©CALIFORNIA HOSPITAL ASSOCIATION
The policies and procedures should be followed consistently to dispute any allegation that
the provider withheld, hid, altered or destroyed evidence relevant to a legal proceeding
(“spoliation of evidence”). Spoliation of evidence is a crime in California and at the federal
level [Penal Code Section 135; 18 U.S.C. Section 1519]. In addition, if a judge believes that a
party to a lawsuit has destroyed evidence, the judge may conclude that the evidence would
have been unfavorable to the spoliator.
An employee should be designated to be responsible for implementing and updating the
policies and procedures, as well as training and monitoring employees to ensure consistent
compliance throughout the organization. It may be helpful to establish a records management
committee to review and approve additions and updates to the policies and procedures, and
to assist in implementation, training and monitoring/auditing.
A record retention and disposal policy should contain at least the following elements:
1. A statement about the purpose of the policy;
2. Whether the policy covers the entire organization or only certain departments;
3. A statement that the destruction of relevant records will be suspended upon receipt
of legal process or other notice of pending or reasonably foreseeable investigations
or litigation, whether government or private;
4. A list of employees and/or departments responsible for maintaining and updating
the policy;
5. A list of employees and/or departments responsible for moving documents to long-
term storage and/or destroying documents in accordance with the policy; and
6. A retention period for each type of record.
III. PRIMARY CONSIDERATIONS IN DEVELOPING A RECORD RETENTION
SCHEDULE
A record retention schedule that meets the needs of a health care provider should result from
an evaluation of several important primary considerations. Providers should pay particular
attention to the following:
1. Legal requirements and considerations;
2. Frequency of use of a record;
3. Space constraints; and
4. Historical or research uses for the records.
These considerations are described more fully below.
Record Retention Considerations CHA
3
©CALIFORNIA HOSPITAL ASSOCIATION
A. Legal Requirements and Considerations
Specific Statutes and Regulations
The health care industry is highly regulated. The number of state and federal government
agencies that regulate hospitals and other health care providers is astonishing.
1
Each of these
agencies has the authority to audit hospitals, inspect their records, issue regulations that
hospitals must follow, and sanction hospitals for noncompliance.
Many state and federal government agencies have issued regulations that specify how long
hospitals and other health care providers must keep certain documents. The Recommended
Retention Schedule found in the second section of this manual lists these requirements.
Providers are required to comply with these retention periods. However, in many cases,
compliance with these minimum retention requirements is inadequate to protect the health
care provider in all situations. Additional considerations in determining an optimal record
retention period are discussed below.
Hospitals should check with county and local agencies regarding any record retention
requirements they may have, such as local water quality protection agencies or county
health departments. The CHA Recommended Retention Schedule does not include local
government retention requirements.
Medi-Cal Requirements
A state law that took effect on Jan. 1, 2018, requires hospitals and other providers of health
care services rendered under Medi-Cal or any other Department of Health Care Services
program to keep records for at least 10 years, including:
1. Billings.
2. Treatment authorization requests.
3. Copies of remittance advices that accompany reimbursement to providers for
services/supplies provided to beneficiaries.
4. Individual ledger accounts reflecting credit and debit balances for each beneficiary.
5. Copies of original purchase invoices for medication, appliances, and assistive
devices.
6. Written requests for laboratory testing and all reports of test results.
7. Book records of receipts and disbursements by the provider.
8. All medical records (including each service rendered, date of service, and
identification of the person rendering services), service reports, and orders
prescribing treatment plans.
9. Records of medications, drugs, assistive devices, or appliances prescribed, ordered
for, or furnished to beneficiaries.
1 For example, U.S. Department of Health and Human Services, Centers for Medicare & Medicaid Services, Drug
Enforcement Administration, Equal Employment Opportunity Commission, Food and Drug Administration, Internal
Revenue Service, Office for Civil Rights, Occupational Safety and Health Administration, U.S. Department of Labor,
California Department of Public Health, California Board of Pharmacy, California Department of Health Care Services,
Cal/OSHA, Fair Employment and Housing Commission, Franchise Tax Board, etc.
CHA Record and Data Retention Schedule 2018
4
©CALIFORNIA HOSPITAL ASSOCIATION
10. For providers of psychiatric and psychological services, patient logs, appointment
books or similar documents showing the date and time allotted for appointments of
each patient or group of patients, and the time actually spent with the patients.
11. Employment records including shifts, schedules and payroll records of employees.
12. Records of receipts and disbursements of personal funds of beneficiaries held in
trust by the provider, if any.
These records must be kept starting from the date the record was created and running for 10
years from the latest of:
1. The final date of the contract period between the plan and the provider,
2. The date of completion of any audit, or
3. The date the service was rendered.
Because most hospitals and other health care providers serve Medi-Cal beneficiaries, and
the contract period or audit process may add several years to the 10-year time frame, CHA’s
Record Retention Schedule shows a 15-year recommended retention period for the records
listed above. This recommendation is reflected in the fourth column of the Recommended
Retention Schedule. Providers using the Schedule that do not serve Medi-Cal patients may
wish to consider a shorter retention period. (See also “Contracts with Medicare Advantage or
Medicare Part D Plans,” page6, and “Accountable Care Organizations,” page7.)
This law applies to any individual, partnership, group, association, corporation, institution
or other entity that provides goods, services, supplies or merchandise, directly or indirectly,
including all ordering, referring and prescribing, to a Medi-Cal beneficiary and that has been
enrolled in the Medi-Cal program [Welfare and Institutions Code Section 14043.1(o)]. A health
facility or other provider that does not treat Medi-Cal patients or provide any other services
regulated by the Department of Health Care Services is not required to comply with this law.
[Welfare and Institutions Code Section 14124.1; Title 22, California Code of Regulations,
Section 51476]
Statutes of Limitations
Sometimes hospitals and other health care providers will want to be able to produce records
to defend themselves in a lawsuit. It is helpful to understand the time period during which
various types of lawsuits may be brought in order to develop an effective retention policy.
The time period during which a lawsuit may be brought is called the “statute of limitations.”
After the statute of limitations has run, it is too late for a plaintiff to bring a lawsuit, and related
records will thus not be needed to defend any such suit.
This section of the manual describes several statutes of limitations commonly applicable
in the California health care industry. However, it is not possible to list every potentially
applicable statute of limitations. Legal counsel should be consulted if a question arises
regarding the statute of limitations in a particular situation.
Medical Malpractice Action
In California, a medical malpractice lawsuit (also known as a professional negligence action)
must be brought within three years after the date of injury, or one year after the patient
discovers, or through the use of reasonable diligence should have discovered, the injury,
Record Retention Considerations CHA
5
©CALIFORNIA HOSPITAL ASSOCIATION
whichever occurs first. Minors have three years to bring a lawsuit, but a minor under the age
of six years has three years or until the eighth birthday, whichever is later. The applicable time
period is indefinite in cases of fraud, intentional concealment, or the presence of a foreign
body that has no therapeutic or diagnostic purpose. [Code of Civil Procedure Section 340.5]
It is important to note that California courts have interpreted the medical malpractice statute
of limitations fairly leniently in favor of the patient, and allowed actions to be brought many
years after the medical care at issue was provided.
Personal Injury Action
In California, a personal injury lawsuit must be brought within two years [Code of Civil
Procedure Section 335.1]. This type of lawsuit includes slip-and-fall injuries on hospital
premises, car accidents by employees in hospital-owned vehicles, etc.
Breach of Contract Action
In California, a lawsuit for breach of contract must be brought within four years if the contract
is evidenced by writing [Code of Civil Procedure Section 337]. This does not mean that the
contract must be a formal, written contract signed by both parties. It means that there must
be some written evidence (a letter, e-mail, purchase order, etc.) regarding the contract. If
the contract is not evidenced by writing, the statute of limitations is two years [Code of Civil
Procedure Section 339].
Federal Fraud and Abuse Actions
The federal government must bring an action against a health care provider for civil monetary
penalties within six years from the date on which the claim at issue was presented, the
request for payment was made, or the incident occurred [42 C.F.R. Section 1003.1570].
The statute of limitations for False Claims Act suits is also six years after the violation was
committed (or within three years after the date when material facts were known or should
have been known by the government, but in no case later than 10 years after the violation
was committed) [31 U.S.C. Sections 3729 and 3731].
However, health care providers should be aware that there are many different fraud statutes
under which the federal government may bring a lawsuit, and each has its own limitations
period — for example, criminal fraud, mail fraud, wire fraud, racketeering, etc. (see, for
example, 18 U.S.C. Sections 1031 and 3282). There are circumstances under which the
government may bring a lawsuit after more than six years have elapsed. Legal counsel
should be consulted if questions arise with respect to fraud and abuse statutes of limitations.
Internal Revenue Service Actions
The IRS must generally bring an action within three years from the date of filing of tax returns.
However, if a false or fraudulent return is filed, if a willful attempt to evade tax takes place, or
no return is filed, the IRS may bring an action at any time. [26 U.S.C. Section 6501]
Accreditation Requirements
Hospitals and other health care providers should review all relevant accreditation
requirements to determine whether they contain any record retention obligations. If they
do, the providers’ policies and procedures should be reviewed and revised as necessary to
maintain compliance.
CHA Record and Data Retention Schedule 2018
6
©CALIFORNIA HOSPITAL ASSOCIATION
The Joint Commission (TJC) generally requires that hospitals determine appropriate records
retention periods based on applicable laws, as well as anticipated uses for patient care,
legal, research, operational and educational purposes. TJC notes that documents such as
crash cart daily checks, temperature monitoring logs, and meeting minutes and agendas are
examples of documents that are not considered part of a patient’s medical record, but are
required to document compliance with TJC standards. TJC requires organizations to keep all
records needed to document compliance with standards dating back to the last full survey.
Because surveys may be no more than 39 months apart, hospitals accredited by TJC should
keep these records for at least 39 months.
Contracts and Grants
Health care providers should carefully review their contracts and grants to determine
whether they contain any record retention obligations. If they do, the providers’ policies and
procedures should be reviewed and revised as necessary to maintain compliance with the
contractual obligation.
Three common record retention contractual provisions in the health care industry are
described below.
Medicare Access Clause
A hospital may be both a Medicare-participating provider and a subcontractor under the
Medicare program at the same time, if the hospital accepts Medicare patients and also
provides services under a contract with another Medicare-participating provider.
The records a participating hospital must retain are included in the Recommended Retention
Schedule (see, for example, “Medicare cost report records,” page 29).
A hospital that is a subcontractor, or a hospital that enters into agreements with
subcontractors, must include an “access” clause in its contracts that allows federal
government agencies to access the subcontractor’s books and records. Specifically,
contracts for services between a Medicare institutional provider and a subcontractor must
contain an access clause if the value of the services is $10,000 or more over a 12-month
period. This includes contracts for both goods and services in which the service component
is worth $10,000 or more.
The clause must permit the Comptroller General of the United States, the U.S. Department
of Health and Human Services, and their duly authorized representatives to access to the
subcontractor’s contract, books, documents, and records until four years after the services
are furnished under the contract or subcontract.
If a contract subject to these requirements does not contain the clause, CMS will not
reimburse the provider for the cost of the services furnished under the contract and will
recoup any payments previously made for services under the contract.
[42 C.F.R. Section 420.302]
Contracts with Medicare Advantage or Medicare Part D Plans
Federal regulations governing the Medicare Advantage (MA) program and Medicare Part D
(Medicare prescription drug benefit) require the plans to include a provision in their contracts
with first tier, downstream and related entities to maintain records for a minimum of 10
years from the final date of the contract period or completion of audit, whichever is later [42
C.F.R. Sections 422.504(i)(2) and 423.505(i)(2)]. This includes books, contracts, computer or
Record Retention Considerations CHA
7
©CALIFORNIA HOSPITAL ASSOCIATION
other electronic systems, medical records, patient care documentation, and other records
that pertain to any aspect of services performed, reconciliation of benefit liabilities, and
determination of amounts payable under the contract [42 C.F.R. Sections 422.504(e)(2)–(4)
and 423.505(e)(2)–(4)]. Under certain circumstances, CMS may notify the contractor that
it must keep its records longer. (See also Medicare Managed Care Manual, Pub. 100-16,
Chapter 11, Section 100.5.)
Hospitals and other health care providers that have contracted with MA or Medicare Part D
plans should ensure that relevant records are maintained in accordance with contractual
obligations.
Accountable Care Organizations
Accountable Care Organizations (ACOs) must agree to retain their records for 10 years after
the agreement with the Centers for Medicare & Medicaid Services ends, or 10 years after
any audit, evaluation, or inspection is concluded, whichever is later. In addition, the ACOs
must require their ACO participants, ACO providers/suppliers, and other individuals or entities
performing functions or services related to ACO activities to do the same. Required records
include books, contracts, records, documents, and other evidence (including data related to
Medicare utilization and costs, quality performance measures, shared savings distributions,
and other financial arrangements related to ACO activities) sufficient to enable the audit,
evaluation, investigation, and inspection of the ACO’s compliance with program requirements,
quality of services performed, right to any shared savings payment, or obligation to repay
losses, ability to bear the risk of potential losses, and ability to repay any losses to CMS.
The Centers for Medicare & Medicaid Services (CMS) may notify an ACO that it must keep
its records longer. In addition, if there has been a termination, dispute, or allegation of fraud
or similar fault against the ACO, its ACO participants, its ACO providers/suppliers, or other
individuals or entities performing functions or services related to ACO activities, the ACO
must retain records for an additional six years from the date of any resulting final resolution of
the termination, dispute, or allegation of fraud or similar fault. [42 C.F.R. Section 425.314]
U.S. Department of Health and Human Services Grants
Recipients of grants from the U.S. Department of Health and Human Services must retain
financial, statistical and nonexpendable property records, and any other records pertinent
to the grants, for three years from the submission of the final expenditure report, or until
resolution of all litigation and federal audit findings. Records for real property and equipment
acquired with federal funds must be retained for at least three years after final disposition.
[45 C.F.R. Section 75.361] Subrecipients and contractors are also subject to this record
retention requirement. Recipients, subrecipients, and contractors may wish to retain many of
these records longer in accordance with the Recommended Retention Schedule.
B. Frequency of Use
When establishing retention periods, providers should consider how often records will
be needed. Records that are used more frequently should be retained in a more quickly
accessible form for longer periods of time. As the frequency of use declines, providers may
transfer more important records to an image storage media or to outside storage, or consider
whether the records should be destroyed.
CHA Record and Data Retention Schedule 2018
8
©CALIFORNIA HOSPITAL ASSOCIATION
C. Space Constraints
The Schedule acknowledges that most providers have limited storage space, both physical
and electronic. The amount of space available will influence whether a record should be
purged after the minimum required retention period or whether it should be retained longer.
D. Historical or Research Use of Records
These guidelines generally do not address the retention of records for historical or research
purposes. However, these considerations may be important to providers. Therefore, providers
should consider whether to keep records for historical documentation and/or research
activities. The costs of storage, plus the cost of employee and attorney time to review
records if a subpoena is received, should be considered.
IV. MEDICAL RECORDS
A. Retention Period Options
Some California health care providers choose to keep their medical records permanently.
However, this is not legally required.
Requirements for Providers That Treat Medi-Cal Patients
Until 2018, hospitals and other health facilities were required by CDPH licensing laws to
retain medical records of adults for 7 years after discharge or the last patient encounter, and
until the age of 19 but no less than 7 years after discharge or the last patient encounter for
minors.
However, a state law that took effect on Jan. 1, 2018, requires hospitals and other providers
of health care services rendered under Medi-Cal or any other Department of Health Care
Services program to keep all medical records of covered patients for at least 10 years starting
from the date the record was created until the latest of:
1. The final date of the contract period between the plan and the provider,
2. The date of completion of any audit, or
3. The date the service was rendered.
Because most hospitals and other health care providers serve Medi-Cal beneficiaries, and
the contract period or audit process may add several years to the 10-year time frame, CHA’s
Record Retention Schedule shows a 15-year recommended retention period for medical
records. This recommendation is reflected in the fourth column of the Recommended
Retention Schedule. Providers using the Schedule that do not serve Medi-Cal patients may
wish to consider a shorter retention period. (See also “Contracts with Medicare Advantage or
Medicare Part D Plans,” page6, and “Accountable Care Organizations,” page7.)
[Welfare and Institutions Code Section 14124.1; Title 22, California Code of Regulations,
Section 51476]
This law applies to any individual, partnership, group, association, corporation, institution
or other entity that provides goods, services, supplies or merchandise, directly or indirectly,
including all ordering, referring and prescribing, to a Medi-Cal beneficiary and that has been
enrolled in the Medi-Cal program [Welfare and Institutions Code Section 14043.1(o)].
Record Retention Considerations CHA
9
©CALIFORNIA HOSPITAL ASSOCIATION
Additionally, skilled nursing facilities that participate in Medicare or Medi-Cal must keep
records of minors until they reach the age of 21 [42 C.F.R. Section 483.70(i)].
The medical records of patients not covered by Medi-Cal or other Department of Health Care
Services programs do not need to be kept for this longer period of time (see below).
Requirements for Providers That Do Not Treat Medi-Cal Patients
State licensing laws govern how long providers must keep medical records for patients not
covered by Medi-Cal or other Department of Health Care Services programs.
Health facilities, home health agencies, primary care clinics and psychology clinics [Title 22,
California Code of Regulations, Sections 70751(c) (general acute care hospitals), 71551(c)
(acute psychiatric hospitals), 72543(a) (skilled nursing facilities), 73543(a) (intermediate
care facilities), 74731(d) (home health agencies), 75055(a)(primary care clinics), 73543(a)
(psychology clinics), 77143(c) (psychiatric health facilities) and 79351(c) (chemical
dependency recovery hospitals)] must keep medical records as follows:
1. Adults: 7 years after discharge or the last patient encounter,
2. Minors: Until the age of 19 but no less than 7 years after discharge or the last
patient encounter. However, skilled nursing facilities that participate in Medicare
or Medi-Cal must keep records of minors until they reach the age of 21 [42 C.F.R.
Section 483.70(i)].
California law is inconsistent with respect to record retention requirements for individual
practitioners. There is no required retention period for medical records maintained by a
physician in a private office setting. However, the California legislature has passed legislation
requiring other types of individual practitioners to retain medical records for the same length
of time as health facilities [Business and Professions Code Sections 2570.185 (occupational
therapists), 2620.7 (physical therapists), 2919 (licensed psychologists), 3007 (optometrists)
and 3641 (naturopathic doctors)]. Individual practitioners not specified above are advised to
retain medical records for at least seven years after the last patient encounter, and until the
patient has reached the age of 19 (but no less than seven years after the last encounter) for
minors.
There are medical record retention requirements in the Medicare Conditions of Participation
and the Interpretive Guidelines for various types of facilities and clinics. These retention
requirements are shorter than the California requirements, so they are not listed in detail in
this manual.
Alternative Retention Period
An alternative option calls for a universal 25-year record retention policy. A 25-year retention
policy has several advantages:
It relieves the provider of the need to differentiate between the medical records of adult
patients and those of minor patients, and for Medi-Cal patients and other patients, as it
satisfies applicable legal requirements for all classes.
It reduces even further the possibility that a lawsuit will be filed after the medical records are
destroyed.
It ensures the longer retention of medical records containing information regarding medical
treatment or medications received during pregnancy.
CHA Record and Data Retention Schedule 2018
10
©CALIFORNIA HOSPITAL ASSOCIATION
Each provider must weigh the appropriate factors and determine whether the simplicity and
convenience of a 25-year period outweigh the advantages of a shorter period.
B. Test Results, Tracings and Recordings
Providers regularly accumulate the results of diagnostic tests performed upon patients,
including radiological studies, laboratory analyses, and tracings and recordings of various
kinds. Most will be the subject of an interpretation or report.
California regulations require most types of health facilities to place reports of test results
in medical records [Title 22, California Code of Regulations, Sections 70749(a)(8) and (9)
(general acute care hospitals), 71549(a)(10) and (11) (acute psychiatric hospitals), 72547(a)(7)
and (8) (skilled nursing facilities), 73547(a)(8) and (9) (intermediate care facilities) and 77141(a)
(19), (20) and (21) (psychiatric health facilities)]. Accordingly, reports of all diagnostic test
results and clinical laboratory test results must be kept as long as the medical record.
X-Ray Films, CT Scans and MRI Results
Under the regulations governing the licensure of general acute care hospitals and acute
psychiatric hospitals, “X-ray films or reproduction thereof” must be preserved for at least
seven years after discharge, or one year after a minor reaches the age of 18 (but not less
than seven years) [Title 22, California Code of Regulations, Sections 70751(c) (general acute
care hospitals) and 71551(c) (acute psychiatric hospitals)]. Similarly, skilled nursing facilities,
intermediate care facilities and primary care clinics are required to keep all “exposed X-ray
film” for seven years [Title 22, California Code of Regulations, Sections 72543(a) (skilled
nursing facilities), 73543(a) (intermediate care facilities) and 75055(a) (primary care clinics)].
Most imaging no longer uses “film,” but these regulations are still on the books. Although the
law is not clear, all imaging records, including CT, PET and MRI, probably should be saved for
the prescribed period. Whether radiological studies are kept for a longer period will depend
on the same considerations discussed in III.“Primary Considerations in Developing a Record
Retention Schedule,” page2.
Clinical Laboratory Test Results
There are specific federal and state laws covering retention of laboratory test results by
clinical laboratories [Title 42, Code of Federal Regulations, Section 493.1105; Business and
Professions Code Section 1265(j)]. These regulations apply to freestanding laboratories and
laboratories situated in hospitals. The laws require laboratories to retain certain information
for minimum periods of time, ranging from two to 10 years. These time periods are described
in the Schedule.
When a hospital patient is tested at a hospital laboratory, test results will be placed in
the patient’s hospital medical record where it will be subject to the longer medical record
retention periods. A hospital laboratory, therefore, can dispose of information concerning
inpatients and outpatients as soon as the minimum legal periods pass.
The situation is different, however, with information concerning individuals who are tested
at freestanding laboratories or are referred to a hospital laboratory just to be tested or when
just the specimen goes to the hospital laboratory. These patients have no separate medical
record on the premises. Therefore, the laboratory should consider keeping its records for a
period longer than the minimum prescribed by the law.
Record Retention Considerations CHA
11
©CALIFORNIA HOSPITAL ASSOCIATION
Tracings and Recordings
There are no laws requiring a minimum retention period for tracings or recordings like EKGs,
EEGs, EMGs or videotapes of diagnostic tests, surgeries or other procedures. Depending
on the test involved, these materials can be quite bulky. Accordingly, it makes sense to
have the responsible physician identify the portions that demonstrate significant or unusual
results. The provider should keep those portions for as long as it keeps the medical record.
The remainder, which most likely would include most of the tracings or recordings, could be
disposed of as soon as the patient is discharged or the treatment is complete. If an adverse
event takes place, however, the provider may wish to retain the entire tracing or recording.
Fetal Heart Monitor Strips
Hospitals may wish to retain in the medical record just those portions of the fetal heart
monitor strips chosen by the physician. Alternatively, hospitals may choose to retain these
tracings in their entirety for at least 10 years, or even 25 years. The latter options make it
more likely that full monitoring records will be available during the period allowed by the
statute of limitations for minors to bring suit.
V. ELECTRONIC RECORDS
Many records created by health care providers formerly stored on paper are now created and
stored electronically, and communicated through electronic means both within and beyond
the provider’s location. Civil Code Section 1633.12 states that if a law requires that a record
be retained, the requirement is satisfied by retaining an electronic record, if the electronic
record accurately reflects the information set forth when the record was first generated in its
final form as an electronic record.
A. Electronic Medical Records Requirements
Providers (including hospitals, clinics and home health agencies) that use electronic systems
only must meet the following requirements (these requirements do not apply to medical
records if hard copy versions are retained):
1. Any use of electronic record keeping to store medical records must ensure the
safety and integrity of those records at least to the extent of hard copy records.
2. The provider must ensure the safety and integrity of all electronic media used to
store medical records by employing:
a. An offsite backup storage system,
b. An image mechanism that is able to copy signature documents, and
c. A mechanism to ensure that once a record is input, it is unalterable.
3. Access to electronically stored records must be made available to the Division of
Licensing and Certification of CDPH staff promptly, upon request.
4. The provider must develop and implement policies and procedures to include
safeguards for confidentiality and unauthorized access to electronically stored
medical records, authentication by signature keys and systems maintenance.
Original hard copies of medical records may be destroyed once the record has been
electronically stored. The printout of the computerized version is considered the original for
CHA Record and Data Retention Schedule 2018
12
©CALIFORNIA HOSPITAL ASSOCIATION
the purposes of providing copies to patients, the Division of Licensing and Certification of
CDPH and for introduction into evidence in administrative and court proceedings.
This law does not exempt providers from the requirement of maintaining original copies
of medical records that cannot be electronically stored. [Health and Safety Code Section
123149]
(See A.“Change or Deletion of Medical Information: Audit Trails,” page13, regarding the
requirement that electronic medical record systems must automatically record and preserve
any change or deletion of any electronically stored medical information.)
B. Retention of Electronic Records
Electronic information may be stored in greater quantities, placed in varied configurations and
retrieved rapidly when needed. Most importantly for this discussion, there may no longer be
as great a need to purge records because of space constraints. Because electronic records
require much less space, the temptation is to retain more information for longer periods.
However, the question of purging information from an electronic system is identical to that of
discarding or destroying hard copy. The same record retention periods apply irrespective of
whether a record is electronic, paper, microfiche, microfilm, etc.
Retention policies for electronic records should focus both on transferring information for
longer-term storage and on purging information from the system.
VI. DUPLICATE, TRANSITORY AND NONSUBSTANTIVE RECORDS
Health care providers create many duplicate, transitory and nonsubstantive records.
Duplicate records do not need to be retained. Only one version of a record, preferably
the original, must be retained. However, providers may prefer to retain electronic versions
of records that were originally produced on paper or other hard copy. Records may be
transferred from hard copy to electronic format without legal risk, if appropriate backup and
other security measures are maintained (see V.“Electronic Records,” page11).
Health care providers also create many transitory and/or nonsubstantive records. These are
records that do not establish policy, guidelines, or procedures; do not certify a transaction;
do not constitute a receipt; and do not contain final substantive information. Transitory
records may include personal notes, meeting notices, cover memos, lunch invitations,
preliminary drafts, telephone messages, etc.
Transitory and nonsubstantive records may be discarded when no longer needed, unless
there is a legal hold in place (see VII.“Legal Hold,” page12).
VII. LEGAL HOLD
If a hospital or other health care provider has reason to believe that it may be sued or may
be the subject of an audit or investigation, legal counsel should be consulted immediately
to determine whether to initiate a legal hold. If a legal hold (also called a “litigation hold”) is
initiated, the usual retention and disposal policies are suspended for records relevant to the
potential claim, dispute, lawsuit, audit or investigation. All potentially relevant records (paper
and electronic) should be retained in their original form until legal counsel authorizes their
destruction or deletion in accordance with the usual record retention schedule.
Record Retention Considerations CHA
13
©CALIFORNIA HOSPITAL ASSOCIATION
The occurrence of any of the following should provoke the hospital to consider a legal hold:
1. Service of legal process (subpoena, summons, or the like)
2. Learning of an investigation or audit by a government agency, government
contractor, or private entity
3. Receipt of a claim (formal or informal)
4. Receipt of a patient complaint (not including minor complaints)
5. A dispute
All records relevant to the issue should be retained. This includes paper records as well as
electronic data and documents (including e-mails). If a medical device, product, equipment,
drug, other supply, or patient specimen may be involved, it should be sequestered.
Employees and other personnel should be notified to suspend destruction of potentially
relevant records, and all steps related to compliance with the legal hold should be
documented.
VIII. DELETION, DISPOSAL AND DESTRUCTION OF RECORDS
State and federal privacy laws governing information containing protected health information
(e.g., medical records, patient-identifiable billing records, labeled prescription bottles, hospital
ID bracelets, etc.) and customer/consumer records impose on providers a duty to ensure
that records are properly destroyed and are not improperly disclosed during the destruction
process. This portion of the Record and Data Retention Schedule provides a brief, general
overview of the laws and recommended procedures surrounding destruction of records. This
information applies irrespective of whether the records are in electronic or hard copy form.
A. Change or Deletion of Medical Information: Audit Trails
An electronic health record system or electronic medical record system must automatically
record and preserve any change or deletion of any electronically-stored medical information.
The record of any change or deletion must include:
1. The identity of the person who accessed and changed the medical information,
2. The date and time the medical information was accessed, and
3. The change that was made to the medical information.
[Civil Code Section 56.101]
For purposes of this requirement, “electronic medical record” or “electronic health
record” means an electronic record of health-related information on an individual that is
created, gathered, managed, and consulted by authorized health care clinicians and staff [42
U.S.C. Section 17921(5)].
Failure to comply with the above requirements may result in significant financial penalties
under the Confidentiality of Medical Information Act (CMIA).
B. Disposal or Destruction of Personal Information
State and federal privacy laws governing individually-identifiable health information and
customer/consumer records impose a duty on health care providers to ensure that records
CHA Record and Data Retention Schedule 2018
14
©CALIFORNIA HOSPITAL ASSOCIATION
are properly destroyed, and are not improperly disclosed during the destruction process. This
portion of the manual discusses the laws and recommended procedures for destruction of
records. This information applies to records either in electronic or hard copy form.
Medical Records
The CMIA states that every health care provider, health care service plan, pharmaceutical
company, or contractor who creates, maintains, preserves, stores, abandons, destroys or
disposes of medical information must do so in a manner that preserves the confidentiality of
the information contained therein. [Civil Code Section 56.101]
Failure to comply with the requirements described above may result in penalties under Civil
Code Section 56.36, which include civil lawsuits by patients and fines of up to $250,000 per
violation. Health care facilities may also be fined up to $250,000 by the California Department
of Public Health for a privacy breach [Health and Safety Code Section 1280.15].
The HIPAA regulations do not require any particular method of destruction. However, the
Department of Health and Human Services (DHHS) has released guidance stating that if one
of the methods of destruction described below is used, and the media containing the PHI
is later released to, or accessed by, a third party, it will not be considered a breach under
the HITECH regulations. The media on which the PHI is stored or recorded must have been
destroyed in one of the following ways:
1. Paper, film, or other hard copy media have been shredded or destroyed such
that the PHI cannot be read or otherwise cannot be reconstructed. Redaction is
specifically excluded as a means of data destruction.
2. Electronic media have been cleared, purged, or destroyed consistent with NIST
Special Publication 800-88, “Guidelines for Media Sanitization,” such that the PHI
cannot be retrieved.
Providers are not required to follow the guidance. However, if the specified technologies and
methodologies are used, no breach notification obligation exists even if a breach occurs. This
is referred to as a “safe harbor.”
The Secretary of DHHS must annually update this guidance. The guidance can be found on
the DHHS website at https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.
html. DHHS has also published a document, “Frequently Asked Questions About the
Disposal of Protected Health Information,” that may be found at https://www.hhs.
gov/hipaa/for-professionals/faq/disposal-of-protected-health-information/index.html.
Federally-Assisted Substance Use Disorder Program Records
Special requirements apply when a federally-assisted substance use disorder program is
discontinued or is acquired by another entity [42 C.F.R. Section 2.19]. Legal counsel should
be consulted in these circumstances.
Customer Records
The Information Practices Act requires any business that maintains customer records which
include personal information to take all reasonable steps to destroy, or arrange for the
destruction of, such records by:
1. Shredding;
Record Retention Considerations CHA
15
©CALIFORNIA HOSPITAL ASSOCIATION
2. Erasing; or
3. Otherwise modifying the personal information in those records to make it
unreadable or undecipherable through any means.
[Civil Code Section 1798.80-1798-84]
This law applies to medical records and other records that could identify a customer, such
as records containing a name, Social Security number, contact information, insurance
policy number, driver’s license number, credit card number, certain passwords and security
questions and answers, etc.
Employee Records
The California Constitution has been interpreted to provide employees a right to privacy. It
is recommended that records containing employee-identifiable information be treated in the
same manner as records containing medical information or customer/consumer information.
Information Derived from Consumer Credit Reports
Regulations adopted under the Fair and Accurate Credit Transactions (FACT) Act of 2003
require businesses that possess consumer information derived from consumer credit reports
to properly dispose of the information. A person must take reasonable measures to protect
against unauthorized access to or use of the information in connection with the disposal.
Compliance with the Information Practices Act (described under “Customer Records,”
page14) will likely ensure compliance with the FACT Disposal Rule. However, legal counsel
should be consulted if questions arise. [16 C.F.R. part 682]
C. Process
A health care provider may dispose of records itself, or may engage an outside company to
dispose of records. Any such company would be acting as the provider’s business associate,
and a written business associate agreement should be executed. The provider has a duty to
ensure the company is competent to perform the task and its proposed method of disposal
ensures the confidentiality and security of the records and their ultimate destruction.
A certificate of records destruction should be completed for records destroyed or deleted
pursuant to the records management policy. In addition, the disposal of records should be
documented in a log. A sample certificate of records destruction that providers may adapt to
fit their needs may be found at http://library.ahima.org/doc?oid=105016#.WxceSKrruUk.
IX. CHA’S RECOMMENDED RETENTION SCHEDULE
A. General Retention Period
CHA’s Recommended Retention Schedule (starting on page 21) recommends a retention
period of six years for general records that might prove valuable for litigation, statistical or
business purposes, but are not required to support Medi-Cal or Medicare claims. CHA has
chosen this period because the utility of most records declines significantly after six years.
The six-year period meets or exceeds the normal statute of limitations for civil actions.
However, it would not be sufficient when a claimant alleges fraudulent concealment of a
wrongful act, or some other occurrence prolongs the limitation period. CHA’s Recommended
Retention Schedule recommends a retention period of 15 years for records that support
claims for Medi-Cal or Medicare services (see A.“Legal Requirements and Considerations,”
page3).
CHA Record and Data Retention Schedule 2018
16
©CALIFORNIA HOSPITAL ASSOCIATION
After establishing a general retention period, the Schedule was refined to account for
particular demands. For example, it is suggested that providers preserve annual reports
and significant statistical compilations longer, as these materials do not demand significant
storage space and may be useful for historical, research, or business planning purposes.
Additionally, special legal requirements that govern the retention of various records have been
taken into account. Also recommended is fairly lengthy retention of credentialing and other
medical staff records, as these contain information that is increasingly the subject of litigation.
Finally, a two- or three-year retention period is assigned to various other records that are
usually of only short-term interest.
NOTE: CHA’s Recommended Retention Schedule does not include record retention
requirements mandated by the U.S. Securities and Exchange Commission or the Sarbanes-
Oxley Act, which applies only to investor-owned organizations that are publicly traded. These
organizations should consult legal counsel regarding additional record retention requirements.
B. How to Interpret the Schedule
Column 1: “Record”
This column describes a document, record, or data that a hospital may generate.
Column 2: “Provider Types”
This column describes the types of providers that must comply with the retention requirement
described in the row.
Column 3: “Legal Requirements”
This column provides any legal requirements that pertain to the providers listed in column 2
regarding the document described in column 1. The provider is legally required to follow the
retention period stated in this column.
Column 4: “Recommended Retention Period”
This column provides CHA’s recommendation regarding how long to keep the document
described in column 1. Please note that this is only a recommendation, not a legal
requirement. A particular provider may wish to keep the document longer than the
recommended retention period. On the other hand, a provider may wish to destroy or delete
the document sooner than the recommended retention period. Each health care provider
should consider the factors described in III.“Primary Considerations in Developing a Record
Retention Schedule,” page2, and develop its own retention schedule. It is not mandatory
to comply with CHA’s recommended retention period.
C. Frequently Asked Questions
Q1: Is every document that a hospital may generate included in the Schedule?
A1: No. It is not possible to list every document that a hospital may generate. The Schedule
contains those documents that are commonly used by hospitals and other health care
providers, and those documents to which the government has assigned a required record
retention period.
Q2: Why is the time period under the fourth column, “Recommended Retention Period,”
sometimes longer than the legally-required retention period stated in the third column, “Legal
Requirements”?
Record Retention Considerations CHA
17
©CALIFORNIA HOSPITAL ASSOCIATION
A2: It is common to find that the retention period listed under “Recommended Retention
Period” is longer than the legally-required retention period listed in the “Legal Requirements”
column. This is because there are other factors to be considered when determining
the minimum retention period in addition to the legal requirement that is specific to that
document (see III.“Primary Considerations in Developing a Record Retention Schedule,”
page2).
Q3: Does the “Legal Requirements” column list all possible laws that apply to the document
described in the first column?
A3: No. The “Legal Requirements” column lists only the laws that are specific to the
document described in column 1. However, it does not list all of the laws that represent more
general retention considerations, such as statutes of limitations. The laws that represent
more general retention considerations are discussed under III.“Primary Considerations in
Developing a Record Retention Schedule,” page2.
Q4. How long should I keep a document that is not included in the Schedule?
A4. CHA recommends reviewing the Schedule to find a similar document or a document
used for a similar purpose, and keeping the document in question for as long as the similar
document must be kept.
19
©CALIFORNIA HOSPITAL ASSOCIATION
Record Retention Schedule
Health care providers, particularly hospitals, are among the most heavily regulated entities
in the United States. State and federal laws specify who is qualified to deliver safe and
effective health care, and under what circumstances that care may be provided. In addition,
providers are required to meet standards imposed under corporate, labor, tax, workers’
compensation, environmental, and criminal law and many, many others.
In order to show that legally-required standards are being met, facilities must document
compliance with the law. Records are required by law to be kept by every department of a
California health care provider’s facility. Sometimes the government specifies precisely how
those records are to be maintained and for how long. Most of the time the government
does not.
The Schedule that follows gives recommended retention periods for records that are
common to health care providers and have statutorily- or regulatorily-mandated retention
periods, or are representative of documents that have no legal retention requirements.
Retention Tip: For a document not listed in the Schedule, CHA recommends
using the retention period listed for a similar document or for a document required
for a similar purpose.
The Schedule gives recommendations for a wide variety of health care providers. In the
“Provider Types” column, the following definitions apply:
1. “All providers” includes:
a. Health facilities, as defined below,
b. Home health agencies,
c. Primary care clinics,
d. Psychology clinics,
e. Individual practitioners,
f. Groups of practitioners,
g. Surgery centers, and
h. Unlicensed outpatient facilities.
CHA Record and Data Retention Schedule 2018
20
©CALIFORNIA HOSPITAL ASSOCIATION
2. “Health facilities” means a facility that treats persons who are admitted for a
24-hour stay or longer. The term “health facilities” includes the following types
of providers:
a. General acute care hospitals (GACHs),
b. Acute psychiatric hospitals (APHs),
c. Skilled nursing facilities (SNFs),
d. Intermediate care facilities (ICFs),
e. Special hospitals,
f. Congregate living health facilities,
g. Correctional treatment centers,
h. Psychiatric health facilities (PHFs), and
i. Chemical dependency recovery hospitals (CDRHs).
[Health and Safety Code Sections 1250 and 1250.2]
The following acronyms are used in the Schedule:
1. “C.C.R.” means California Code of Regulations.
2. “C.F.R.” means Code of Federal Regulations.
3. “U.S.C.” means United States Code.
Retention Tip: See “Where to Find the Laws Referenced in the Manual,”
page 75, for instructions on how to find the exact language of the statutes
and regulations on the internet.
Recommended Record Retention Schedule CHA
21
©CALIFORNIA HOSPITAL ASSOCIATION
ADMINISTRATIVE RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Accident reports See “Incident reports,” page 24.
If an employee is injured, see
“Workers’ compensation claims
files,” page 50.
Accountable Care Organization
(ACO) utilization, quality and
financial records
ACO participants,
providers and suppliers
Must keep for at least 10 years
from end of contract term or
completion of audit, whichever is
later [42 C.F.R. Section 425.314]
15 years
Accreditation/licensing surveys
and plans of correction (TJC,
AOA, DNV, CMS, CDPH, IMQ,
CAP, etc.)
All providers 6 years (longer if
continuing interest)
Adverse event reports to
CDPH
Hospitals 6 years after any
appeal is concluded
Aerosol transmissible disease
and biosafety plan annual
review
All providers Must keep for at least 3 years
[8 C.C.R. Section 5199(j)(3)]. See
regulation for required content of
record.
6 years
Appraisal reports (property,
building, equipment, etc.)
All providers Life of asset plus 10
years
Arbitration resolution
documents
SNFs that particfipate in
Medicare/Medicaid
When facility and resident resolve
a dispute by arbitration, must
keep arbitration agreement
and arbitrator’s decision for at
least 5 years [42 C.F.R. Section
493.70(n)].
6 years after
discharge of patient,
longer if readmission
is anticipated.
Birth records to local
government
Hospitals, practitioners Permanent
Cancer/tumor registry Hospitals, practitioners Permanent
Census (daily) GACHs, APHs, PHFs,
CDRHs
Regulations require these facilities
to keep “patient admission
rosters,” but do not specify
a retention period [22 C.C.R.
Sections 70733, 71531, 77127,
and 79337].
6 years
Certificate of records
destruction
All providers Permanent
Committee agendas, minutes
(not otherwise specified in this
retention schedule)
All providers 6 years
Communicable disease reports
to state and local health
departments
All providers 3 years
Construction project contracts
and related documents
All providers Life of building plus
10 years
CHA Record and Data Retention Schedule 2018
22
©CALIFORNIA HOSPITAL ASSOCIATION
ADMINISTRATIVE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Contracts, leases, and
supporting documentation
All providers Contracts for services between
a Medicare institutional provider
and a subcontractor must be kept
for the life of the contract, plus 4
years, if the value of the services is
$10,000 or more over a 12-month
period. This includes contracts
for both goods and services in
which the service component is
worth $10,000 or more [42 C.F.R.
Section 420.302(b)]. Contracts
required by the HIPAA privacy
rule must be kept for 6 years
[45 C.F.R. Section 164.530(j)].
Regulations require GACHs,
APHs, PHFs and CDRHs to keep
contracts that are required by
regulation, but no retention period
is specified [22 C.C.R. Sections
70733, 71531, 77127, 79337].
Contracts that support claims for
services rendered to Medicare or
Medi-Cal patients must be kept
for at least 10 years from date
of service, end of Medi-Cal or
Medicare Advantage or Medicare
Part D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare
and Institutions Code Section
14124.1; Title 22, California Code
of Regulations, Section 51476]
Life of agreement/
lease/equipment,
plus 6 years; if
the agreement
supports Medicare
or Medi-Cal
claims, then life of
agreement/lease/
equipment plus 15
years
Corporate records, including
the following: Articles of
Incorporation or partnership
agreement; bylaws and
rules and regulations of the
governing body; minutes of
meetings of the governing
body
GACHs, APHs, PHFs,
CDRHs
Regulations require these facilities
to keep these documents, but do
not specify retention periods [22
C.C.R. Sections 70733, 71531,
77127 and 79337].
Permanent
Court orders All providers Permanent, unless
disposal approved
by legal counsel
Death records to local
government, death certificates
All providers Permanent
Deeds or titles to property All providers Permanent
Disposal of records log All providers Permanent
Recommended Record Retention Schedule CHA
23
©CALIFORNIA HOSPITAL ASSOCIATION
ADMINISTRATIVE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Donations, endowments,
trusts, bequests, contributions
All providers 6 years. If a
condition is attached
to the gift, the
records should be
kept permanently.
EHR Incentive Program data
(Medicare or Medicaid)
Hospitals, eligible
professionals
Must keep for at least 6
years (see FAQ No. 7711
under “Audits” on the CMS
Promoting Interoperability
Programs website at https://
www.cms.gov/Regulations-
and-Guidance/Legislation/
EHRIncentivePrograms/FAQ.html.)
15 years
Grants See “Health and Human Services
Agency grants,” page 23.
Grievances and resolution
documents
SNFs that participate in
Medicare/Medicaid
Must keep for at least 3 years [42
C.F.R. Section 483.10(j)(4)(vii)]
6 years
Health and Human Services
Agency grants
Health facilities Keep financial, statistical and
nonexpendable property records,
and any other records pertinent to
grants, for 3 years from the date of
submission of the final expenditure
report, or until resolution of all
litigation and federal audit findings.
Records for real property and
equipment acquired with federal
funds must be kept for at least
3 years after final disposition.
[45 C.F.R. Section 75.361]
6 years
CHA Record and Data Retention Schedule 2018
24
©CALIFORNIA HOSPITAL ASSOCIATION
ADMINISTRATIVE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
HIPAA privacy-related
documents (notice of privacy
practices; acknowledgment
of receipt of notice of privacy
practices; correspondence/
forms related to request for
access to and amendment of
protected health information
(PHI); titles of persons/offices
responsible for receiving and
processing requests for access
and amendment; accountings
for disclosures; accountings
provided to patients; titles of
persons/offices responsible
for receiving and processing
requests for an accounting,
correspondence/forms
regarding a special restriction;
authorization for use/disclosure
of PHI; correspondence/forms
related to grievances; business
associate agreements; breach
investigation and notification
reports; etc.)
All providers Must keep for at least 6 years from
the date of creation or the date
last in effect, whichever is later [45
C.F.R. Section 164.530(j)].
8 years
Incident reports All providers See also “Unusual occurrence
reports to CDPH/public health
officer (PHO),” page 28.
10 years
Inspection and approval
by state or local fire control
agencies
Medicare particiating
hospitals
Regulations require written
evidence of regular inspection and
approval by fire control agencies
to be kept, but no retention period
is specified [42 C.F.R. Section
482.41].
6 years
Inspection reports by local,
state or federal agents
GACHs, APHs, PHFs,
CDRHs
Regulations require these facilities
to keep inspection reports, but do
not specify retention periods
[22 C.C.R. Sections 70733,
71531, 77127 and 79337].
6 years
Inspection reports by local,
state or federal agents
ICFs Must keep the latest report of
inspection by state or local health
authorities with notations made of
the actions taken to comply with
any recommendations [22 C.C.R.
Section 73515].
6 years
Recommended Record Retention Schedule CHA
25
©CALIFORNIA HOSPITAL ASSOCIATION
ADMINISTRATIVE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Institutional review board (IRB)
records
All providers Must keep until research is
completed, plus 3 years [21 C.F.R.
Section 56.115]. See regulation for
required content of records. See
also 21 C.F.R. Sections 312.62
and 812.140 (2-year retention
period for related records).
Completion of
research, plus 10
years
Insurance policies, current and
expired, and related claims and
correspondence
All providers Permanent
Intellectual property: copyright,
trademark, service mark
applications, approvals, and
related documents
All providers Duration of use of
mark plus 10 years
Leases See “Contracts, leases, and
supporting documentation,” page
22.
Licenses or certificates All providers Life of license or
certificate, plus 6
years
List of contracted services Medicare-participating
hospitals
Regulations require a list of
contracted services to be kept,
but do not specify retention
periods [42 C.F.R. Section
482.12(e)].
6 years
Master patient index/medical
record index number
All providers Permanent
Meaningful use attestations
(Medicare or Medicaid) and
supporting data
Hospitals, eligible
professionals
Must keep for at least 6
years (see FAQ No. 7711
under “Audits” on the CMS
Promoting Interoperability
Programs website at https://
www.cms.gov/Regulations-
and-Guidance/Legislation/
EHRIncentivePrograms/FAQ.html).
15 years
Medical device reports (MDR)
and records of MDR reportable
events (MedWatch)
Health facilities, clinics,
home health agencies,
surgery centers
File relating to an adverse MDR
event must be kept at least 2
years from the date of the event
[21 C.F.R. Section 803.18(c)].
Life of device, plus
6 years
CHA Record and Data Retention Schedule 2018
26
©CALIFORNIA HOSPITAL ASSOCIATION
ADMINISTRATIVE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Medical device tracking
records
Health facilities, clinics,
home health agencies,
surgery centers
Keep for the period of time the
device is in use or in distribution
for use. (For example, a record
may be discarded if the device
is no longer in use, has been
explanted, returned to the
manufacturer, or the patient has
died.) [21 C.F.R. Section 821.60]
See 21 C.F.R. Section 821.30 for
a list of information that must be
kept in the device tracking record.
Life of device, plus
6 years
Meeting minutes and agendas
needed to document
compliance with accreditation
requirements
The Joint Commission
accreditation organizations
Must keep until next full survey 4 years (unless
longer period
recommended for
specific records
elsewhere in this
chart)
OSHPD reports (financial,
patient discharge data, quality)
Hospitals 20 years
OSHPD reports (seismic) Hospitals Permanent
Patient admission roster See “Census (daily),” page 21.
Patient grievances/complaints
— complaint, investigation
materials, correspondence
Facilities 6 years after
resolution
Patient property: deceased
patient’s property disposition
Health facilities Records of disposition of
deceased patient’s property
must be kept for at least 3 years
[Probate Code Section 330(d)].
See chapter 14 of CHA’s Consent
Manual for information about
disposition of deceased patient’s
property.
5 years after
discharge
Patient property: patient
cash and valuables receipts,
personal property inventory
All providers Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare
and Institutions Code Section
14124.1; Title 22, California Code
of Regulations, Section 51476]
5 years after
discharge
Patient property: receipts and
disbursements of personal
funds of Medi-Cal beneficiaries
being held in trust by the
provider
Facilities 15 years
Recommended Record Retention Schedule CHA
27
©CALIFORNIA HOSPITAL ASSOCIATION
ADMINISTRATIVE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Permits All providers Life of permit, plus
6 years
Policies and procedures GACHs, APHs, PHFs Regulations require these facilities
to keep policy and procedure
manuals, but do not specify
retention periods [22 C.C.R.
Sections 70733, 71531 and
77127]. Policies and procedures
required by the HIPAA privacy and
security rules must be kept for at
least 6 years [45 C.F.R. Sections
164.316(b) and 164.530(j)].
Life of policy or
procedure, plus 6
years. Must be kept
longer for transplant
services.
Real estate transaction
records, deeds, easements,
zoning permits, building
permits
All providers Permanent
Reports, memos,
correspondence (not otherwise
specified in this retention
schedule)
All providers 6 years (unless
desired longer for
trending or business
planning purposes)
Safe patient handling-related
documents
GACHs Must keep for at least 1 year [8
C.C.R. Sections 3203(b) and
5120(e)(1)(B)]
6 years (may also
wish to document
attendance
at training in
employee’s
personnel file)
Statistical data/reports
regarding admissions,
discharges, outpatient visits,
services rendered, transfers,
etc. (not otherwise specified in
this retention schedule)
All providers 6 years (unless
desired longer for
trending or business
planning purposes)
Statistics on admissions and
services
All providers 6 years (longer if
needed for business
planning purposes)
Summary record of decisions
not to transfer a patient to
another facility for airborne
infection isolation for medical
reasons
All providers Must keep for at least 3 years [8
C.C.R. Section 5199(j)(3)]. See
regulation for required content of
record. The information must also
be documented in the patient’s
medical record.
6 years
Survey, certification and
complaint investigation reports;
plans of correction
SNFs that participate in
Medicare/Medicaid
Must keep at least 3 years [42
C.F.R. Section 483.10(g)(11)]
6 years
Survey reports See “Accreditation/licensing
surveys and plans of correction
(TJC, AOA, DNV, CMS, CDPH,
IMQ, CAP, etc.),” page 21.
CHA Record and Data Retention Schedule 2018
28
©CALIFORNIA HOSPITAL ASSOCIATION
ADMINISTRATIVE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Training records — employees
(not otherwise specified in this
retention schedule)
All providers Regulations require GACHs to
keep documentation as described
in 22 C.C.R. Section 70214(d), but
do not specify a retention period.
6 years after date
of training (may also
wish to document
attendance
in employee’s
personnel file)
Treatment authorization
requests (TARs)
Hospitals Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare
and Institutions Code Section
14124.1; Title 22, California Code
of Regulations, Section 51476]
15 years
Unavailability of airborne
infection isolation rooms/areas
All providers Must keep for at least 3 years
[8 C.C.R. Section 5199(j)(3)]. See
regulation for required content of
record.
6 years
Unusual occurrence reports
to CDPH/public health officer
(PHO)
GACHs, APHs Must keep for at least 2 years
[22 C.C.R. Sections 70733 and
71531]. The report made to
CDPH/PHO should include only
factual information that CDPH/
PHO must have. These reports
may be obtained by plaintiffs’
attorneys from CDPH/PHO by
use of a subpoena. The facility
likely will also complete an incident
report, root-cause analysis, etc.
that may be protected from
discovery. See chapter 19 of
CHA’s Consent Manual about
the proper establishment of an
incident report or medical staff
quality assurance report system.
6 years
Recommended Record Retention Schedule CHA
29
©CALIFORNIA HOSPITAL ASSOCIATION
ADMINISTRATIVE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Unusual occurrence reports
to CDPH/public health officer
(PHO)
SNFs, primary care clinics Must keep for at least 1 year
[22 C.C.R. Sections 72541 and
75053]. The report made to
CDPH/PHO should include only
factual information that CDPH/
PHO must have. These reports
may be obtained by plaintiffs’
attorneys from CDPH/PHO by
use of a subpoena. The facility
likely will also complete an incident
report, root-cause analysis, etc.
that may be protected from
discovery. See chapter 19 of
CHA’s Consent Manual about
the proper establishment of an
incident report or medical staff
quality assurance report system.
6 years
Unusual occurrence reports
to CDPH/public health officer
(PHO)
PHFs and CDRHs Must keep for at least 3 years
[22 C.C.R. Sections 77137 and
79339]. The report made to
CDPH/PHO should include only
factual information that CDPH/
PHO must have. These reports
may be obtained by plaintiffs’
attorneys from CDPH/PHO by
use of a subpoena. The facility
likely will also complete an incident
report, root-cause analysis, etc.
that may be protected from
discovery. See chapter 19 of
CHA’s Consent Manual about
the proper establishment of an
incident report or medical staff
quality assurance report system.
6 years
Workplace violence prevention
records: hazard identification,
evaluation and correction
Health facilities, HHAs,
hospices
Must keep for at least 1 year [8
C.C.R. Sections 3203(b), 3342
and 5120(e)(1)(B)]
6 years
CHA Record and Data Retention Schedule 2018
30
©CALIFORNIA HOSPITAL ASSOCIATION
ADMITTING RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Admission and discharge
records
GACHs, APHs, PHFs,
CDRHs
Regulations require these facilities
to keep “patient admission
rosters,” but do not specify
a retention period [22 C.C.R.
Sections 70733, 71531, 77127
and 79337].
6 years
Advance Beneficiary Notice Hospitals Must keep for at least 5 years
from discharge or completion of
delivery of care [Medicare Claims
Processing Manual, Publication
100-04, Chapter 30, Section
50.6.4]. However, the original
ABN must be retained in the
medical record; thus, California
hospitals should retain the ABN in
accordance with medical record
retention requirements.
File in patient’s
medical record
Conditions of admission
agreements
Health facilities File in patient’s
medical record
Emergency department log
(must include name; date,
time and means of arrival;
age; sex; record number;
nature of presenting complaint;
disposition; time of departure;
and names of patients who are
dead on arrival)
Hospitals with emergency
departments
Hospitals that participate in
Medicare must keep for at least
5 years [42 U.S.C. Section
1395cc(a)(1)(I)(ii); 42 C.F.R. Section
489.20(r)]. Otherwise, must keep
for at least 3 years. [Health and
Safety Code Section 1317.4; 22
C.C.R. Sections 70413, 70453,
and 70651.]
6 years
Emergency department
transfer records (medical
and other records related to
individuals transferred to or
from the hospital, including
“Transfer Summary” required
by Health and Safety Code
Section 1317.2(f))
Hospitals with emergency
departments
Hospitals that participate in
Medicare must keep for at least
5 years [42 U.S.C. Section
1395cc(a)(1)(I)(ii); 42 C.F.R. Section
489.20(r)]. Otherwise, must keep
for at least 3 years. [Health and
Safety Code Section 1317.4; 22
C.C.R. Sections 70413, 70453,
and 70651.]
Medical records:
15 years — adults
25 years — minors
Other records:
6 years
Medicare secondary payer
beneficiary questionnaire
All providers Must keep for 10 years after date
of service [Medicare Secondary
Payer Manual, Chapter 3, Section
20.2.2].
15 years
Recommended Record Retention Schedule CHA
31
©CALIFORNIA HOSPITAL ASSOCIATION
BUSINESS AND FINANCE RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Accountable Care Organization
(ACO) utilization, quality and
financial records
ACO participants,
providers and suppliers
Must keep for at least 10 years
from end of contract term or
completion of audit, whichever is
later [42 C.F.R. Section 425.314]
15 years
Audit reports All providers 7 years
Bank deposits All providers 7 years
Bank statements All providers 15 years
Bond records (including how
bond-financed investments
are used and disposed of;
investment and expenditure of
bond proceeds)
Tax-exempt facilities Must keep for 3 years after final
redemption (see IRS webpage at
https://www.irs.gov/tax-exempt-
bonds/tax-exempt-bond-faqs-
regarding-record-retention-
requirements#6).
15 years after final
redemption
Budgets All providers 7 years
Cash receipts All providers Medi-Cal regulations require that
“book records of receipts and
disbursements” be retained for
10 years from the date of service,
end of Medi-Cal contract period,
or audit completion, whichever
is later [Welfare and Institutions
Code Section 14124.1; Title 22,
California Code of Regulations,
Section 51476]. A similar
timeframe exists for records
needed to support claims to
certain Medicare patients. [42
C.F.R. Sections 422.504(i)(2) and
423.505(i)(2)]. It is unclear what
“book records of receipts” means.
15 years
Cashiers’ tapes from
bookkeeping machines
All providers 2 years
Chargemaster Hospitals 15 years
Check registers All providers 15 years
Checks –– canceled
• Payroll
• Taxes, capital, purchases,
important contracts
• Other
All providers
15 years
Permanent
15 years
CHA Record and Data Retention Schedule 2018
32
©CALIFORNIA HOSPITAL ASSOCIATION
BUSINESS AND FINANCE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Claims, billings, and charges to
patients, fiscal intermediaries,
third-party payers, etc.
All providers Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare and
Institutions Code Section 14124.1;
Title 22, California Code of
Regulations, Section 51476]
15 years
Depreciation schedules —
equipment
All providers Life of equipment,
plus 15 years
Disbursements –– unclaimed/
returned
All providers Unclaimed checks and
disbursements escheat to state
after 3 years; the state then
attempts to notify recipients [Code
of Civil Procedure Section 1510 et
seq.].
7 years
Employee expense reports All providers 15 years
Employment tax records
(federal)
All providers Must keep for at least 4 years
after due date of tax, or date tax is
paid, whichever is later [26 C.F.R.
Section 31.6001–1 et seq.].
15 years
Exempt Organization Annual
Information Returns (IRS Form
990, State Form 199)
Tax-exempt organizations Permanent
Financial statements (year-end) All providers Permanent
Income –– daily summary All providers 7 years
Income tax returns All providers Permanent
Invoices — accounts
receivable/payable
Providers that participate
in Medicare Advantage,
Medi-Cal, accountable
care organizations, or
Medicare Part D
Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare and
Institutions Code Section 14124.1;
Title 22, California Code of
Regulations, Section 51476]
15 years
Recommended Record Retention Schedule CHA
33
©CALIFORNIA HOSPITAL ASSOCIATION
BUSINESS AND FINANCE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Invoices documenting
purchase or lease of clinical
laboratory equipment and test
kits, reagents, or media
Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions Code
Section 1265(j)]. (See “Invoices
— accounts receivable/payable”
above.)
15 years
Invoices — fixed assets,
equipment
All providers Permanent/life of
asset or equipment,
plus 15 years
IRS rulings, audit records All providers Permanent
Journals — general All providers 15 years
Ledgers — general All providers 15 years
Ledgers — individual ledger
accounts reflecting credit
and debit balances for each
Medi-Cal beneficiary
Facilities Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare and
Institutions Code Section 14124.1;
Title 22, California Code of
Regulations, Section 51476]
15 years
Medi-Cal remittance advices All providers Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare and
Institutions Code Section 14124.1;
Title 22, California Code of
Regulations, Section 51476]
15 years
Medicare Advantage-related
documents
All providers that contract
with a Medicare Advantage
plan
Must keep for at least 10 years
after end of contract term or
audit, whichever is later. [42
C.F.R. Section 422.504(i)(2)].
See “Contracts with Medicare
Advantage or Medicare Part D
Plans,” page 6.
15 years
CHA Record and Data Retention Schedule 2018
34
©CALIFORNIA HOSPITAL ASSOCIATION
BUSINESS AND FINANCE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Medicare cost report records Hospitals Must keep for at least 5 years
after the cost report is filed with
the intermediary. The records that
must be retained are:
1. Billing material: copies of claim
forms, supporting documents
and forms (e.g., charge slips,
daily patient census records,
and other business and
accounting records referring to
specific claims).
2. Cost report material: all
data necessary to support
the accuracy of entries on
annual cost reports including
original invoices, cancelled
checks, copies of material
used in preparing annual cost
reports, and other similar cost
items, schedules and related
worksheets, and contracts
or records of dealings with
outside sources of medical
supplies and services or with
related organizations.
3. Medical record material:
utilization review committee
reports, physicians’ certification
and recertifications, discharge
summaries, clinical and other
medical records relating to
health insurance claims.
4. Provider physician material:
provider physician agreements
on which Part A and Part B
allocations are based.
[Medicare Claims Processing
Manual, Publication 100-04,
Chapter 1, Section 110.3] See
also 42 C.F.R. Sections 413.20
and 413.24. (See also “Resident
rotation schedules — location,
nature of assignment, vacation,
leave of absence, sick time,
orientation time, classroom time,
etc.,” page 64.)
15 years
Recommended Record Retention Schedule CHA
35
©CALIFORNIA HOSPITAL ASSOCIATION
BUSINESS AND FINANCE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Medicare Part D-related
documents (prescription drug
benefit)
All providers that contract
with a Medicare Part D
plan
Must keep for at least 10 years
after end of contract term or
audit, whichever is later [42
C.F.R. Section 423.505(i)(2)].
See “Contracts with Medicare
Advantage or Medicare Part D
Plans,” page 6.
15 years
Medicare secondary payer
beneficiary questionnaire
See “Medicare secondary payer
beneficiary questionnaire,” page
30.
Patient accounting files All providers Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare and
Institutions Code Section 14124.1;
Title 22, California Code of
Regulations, Section 51476]
15 years
Payment receipt books All providers Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare and
Institutions Code Section 14124.1;
Title 22, California Code of
Regulations, Section 51476]
15 years
Payroll records See “Human Resources Records,”
page 45.
Property tax payment records All providers Permanent
Purchase orders All providers Life of item, plus 7
years
Request for payment Medicare provider or
supplier of DMEPOS, lab,
imaging, or home health
services
Must keep at least 7 years [42
C.F.R. Section 424.516(f)]
15 years
CHA Record and Data Retention Schedule 2018
36
©CALIFORNIA HOSPITAL ASSOCIATION
BUSINESS AND FINANCE RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Returned goods credits All providers Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare and
Institutions Code Section 14124.1;
Title 22, California Code of
Regulations, Section 51476]
15 years
Tax bills, statements,
payments, receipts
All providers Permanent
Tax-exempt status application,
supporting documentation,
determination letters from IRS
and FTB
Tax-exempt organizations Permanent
Tax returns All providers Permanent
Unemployment tax records All providers Must keep for at least 4 years after
due date of tax, or the date tax is
paid, whichever is later [26 C.F.R.
Section 31.6001-1; 22 C.C.R.
Section 1085–2(c)].
7 years
Volunteer funds raised See “Donations, endowments,
trusts, bequests, contributions,”
page 30.
Wage and tax statements (W-2
forms)
All providers Must keep for at least 4 years after
due date of tax, or the date tax is
paid, whichever is later
[26 C.F.R. Section 31.6001–1].
7 years
Withholding allowance
certificates (W-4 forms)
All providers Must keep for at least 4 years after
due date of tax, or the date tax is
paid, whichever is later
[26 C.F.R. Section 31.6001–1].
7 years after
termination of
employment or
new certificate
completed
Recommended Record Retention Schedule CHA
37
©CALIFORNIA HOSPITAL ASSOCIATION
DEPARTMENT RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Ambulance replenishing
records (other than linens)
Facilities Must keep for at least 5 years [42
C.F.R. Sections 1001.952(v)]
15 years
Appointment books, patient
logs, or similar documents
showing date and time allotted
for appointment of each
Medi-Cal patient or group of
patients, and time actually
spent with such patients
Psychiatric and
psychological service
providers
Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare and
Institutions Code Section 14124.1;
Title 22, California Code of
Regulations, Section 51476]
15 years
Appointment calendars
(patients’ appointments),
sign-in sheets
All providers except
providers of psychiatric
and psychological services
to Medi-Cal patients
6 years
Birth records to local
government
See “Birth records to local
government,” page 21.
Compliance audits/
investigations (internal)
All providers 6 years
Compliance hotline log (annual) All providers 6 years
Crash cart daily records The Joint Commission
accredited organizations
Must keep until next full survey 4 years
Dialysis — hemodialyzer reuse
records (procedure, training,
equipment, audit records)
Dialysis clinics Regulations require these
documents to be kept, but do not
specify a retention period
[22 C.C.R. Section 75198]. See
22 C.C.R. Sections 75189 and
75198 for details about content of
required records.
Life of dialyzer, plus
6 years
Dialysis — dialyzer reuse
records (device history records,
including patient name,
dates of treatment, dates of
disinfectant rinsing, type and
model, reuse number, results
of performance tests, initials
or other ID of reprocessing
technician, reason for dialyzer
failure and subsequent
acceptance)
Dialysis clinics Must keep for at least 6 months
after last reprocessing of dialyzer
[22 C.C.R. Section 75198(b)(5)].
See 22 C.C.R. Sections 75189
and 75198 for details about
content of required records.
Life of dialyzer, plus
6 years
CHA Record and Data Retention Schedule 2018
38
©CALIFORNIA HOSPITAL ASSOCIATION
DEPARTMENT RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Emergency department log
(must include name; date,
time and means of arrival;
age; sex; record number;
nature of presenting complaint;
disposition; time of departure;
and names of patients who are
dead on arrival)
Hospitals with emergency
departments
Hospitals that participate in
Medicare must keep for at least
5 years [42 U.S.C. Section
1395cc(a)(1)(I)(ii); 42 C.F.R. Section
489.20(r)]. Otherwise, must keep
for at least 3 years. [Health and
Safety Code Section 1317.4; 22
C.C.R. Sections 70413, 70453,
and 70651.]
6 years
EMTALA-related records,
including records of patients
transferred in or out,
emergency department log,
policies and procedures, etc.
Hospitals with emergency
departments
Hospitals that participate in
Medicare must keep for at least
5 years [42 U.S.C. Section
1395cc(a)(1)(I)(ii); 42 C.F.R. Section
489.20(r)]. Otherwise, must keep
for at least 3 years. [Health and
Safety Code Section 1317.4; 22
C.C.R. Sections 70413, 70453,
and 70651.]
6 years
Hardware and software
operating instructions,
warranties, system
requirements, configurations,
etc.
All providers Life of product, plus
2 years
Human tissue intended for
transplantation (records
regarding donor screening
and testing; records regarding
supplier, donor and lot
identification, receipt, name(s)
of recipient(s), storage
temperatures, distribution,
destruction, disposition of
human tissue, expiration dates
of all tissues, etc.)
GACHs Must keep at least 10 years after
the date of transplantation (if
known), distribution, disposition, or
expiration of the tissue, whichever
is latest [21 C.F.R. Section
1270.33].
Permanent
Infection control committee,
minutes and reports of
GACHs, APHs Regulations require these facilities
to keep their documents, but
do not specify retention periods
[22 C.C.R. Sections 70733 and
71531].
6 years
Labor room log books Hospitals Hospitals that participate in
Medicare must keep for at least
5 years [42 U.S.C. Section
1395cc(a)(1)(I)(ii); 42 C.F.R. Section
489.20(r)].
6 years
Recommended Record Retention Schedule CHA
39
©CALIFORNIA HOSPITAL ASSOCIATION
DEPARTMENT RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Medical transportation records
(must include time and date
of service for each Medi-Cal
beneficiary; odometer readings
at each pick-up and delivery
location; provider-assigned
vehicle ID code; name of
operator providing the service,
names of beneficiaries
transported in total or partial
group runs)
Medical transportation
providers
Must keep for at least 10
years from date of service,
end of Medi-Cal or Medicare
Advantage or Medicare Part
D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare and
Institutions Code Section 14124.1;
Title 22, California Code of
Regulations, Section 51476]
15 years
Meeting minutes and agendas
needed to document
compliance with accreditation
requirements
The Joint Commission
accreditation organizations
Must keep until next full survey 4 years (unless
longer period
recommended for
specific records
elsewhere in this
chart)
Motor vehicle maintenance
records
All providers Life of vehicle, plus
6 years
Policy and procedures manuals See “Policies and procedures,”
page 27.
Requisitions (internal) Health facilities Discretionary
Surgical privileges list Hospitals The surgical service of hospitals
that participate in Medicare must
keep a roster of practitioners
specifying the surgical privileges of
each practitioner, but no retention
period is specified [42 C.F.R.
Section 482.51].
Each physician’s
surgical privileges
should be kept in his
or her medical staff
file (see “Medical
Staff Records,”
page 63). The
lists provided to
the surgical service
should be retained
for at least 6 years.
Surgery
• Register of operations
• Operating room logs
GACHs Regulations require hospitals to
keep a register of operations, but
do not specify retention periods
[22 C.C.R. Section 70223(f)].
6 years
Temperature monitoring logs The Joint Commission
accredited organizations
`Must keep until next full survey 4 years
NOTE: Individual departments may wish to keep copies of the original records, which are kept at the administrative
offices. The department should keep duplicate records only as long as the records are used on a regular basis.
CHA Record and Data Retention Schedule 2018
40
©CALIFORNIA HOSPITAL ASSOCIATION
DIETARY DEPARTMENT RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Bacteriological testing of ice Health facilities 2 years
Dietetic service personnel
(number of)
GACHs, APHs Regulations require these facilities
to keep records listing the number
of dietetic service workers and
their job titles and hours worked,
but do not specify retention
periods [22 C.C.R. Sections
70275 and 71245].
2 years
Food costs Health facilities 6 years
Food purchased GACHs, APHs, SNFs, ICFs Must keep records of food
purchased for at least 1 year
[22 C.C.R. Sections 70273(g)
(6), 71243(g)(6), 72341(h) and
73333(g)].
3 years
In-service training records for
dietetic services personnel
(subject areas covered, date
and duration of each session,
attendance list)
GACHs, APHs, ICFs Regulations require these facilities
to keep these records, but do
not specify retention periods [22
C.C.R. Sections 70273(j), 71243(j)
and 73335].
6 years after date
of training (may also
wish to document
attendance
in employee’s
personnel file)
Meal counts Health facilities 2 years
Menus GACHs, APHs, SNFs, ICFs Must keep for at least 30 days
[22 C.C.R. Sections 70273(g)
(5), 71243(g)(5), 72341(g) and
73333(f)].
3 months
Recipes, including ingredients,
portion size, nutritional analysis
Health facilities 2 years after
discontinuation
Recommended Record Retention Schedule CHA
41
©CALIFORNIA HOSPITAL ASSOCIATION
ENGINEERING RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Autoclaves and sterilizers:
thermometer charts (daily
checking of recording and
indicating thermometers)
and monthly bacteriological
tests (including the bacterial
organism used) (ICFs only:
recording thermometers are
not required on portable
sterilizers and autoclaves)
GACHs, APHs, SNFs, ICFs Must keep for at least 1 year
[22 C.C.R. Sections 70833,
71637, 72619 and 73677].
Life of equipment,
plus 6 years
Building blueprints, plans,
specifications, inspections
All providers Permanent (or until
property is sold)
Calibration records (all gauging
and measuring equipment
must be regularly calibrated as
specified by the manufacturer)
GACHs, APHs Must keep for at least 2 years
[22 C.C.R. Sections 70837 and
71641].
Life of equipment,
plus 6 years
Emergency generator records
— inspection, performance,
exercising period and repairs
GACHs, APHs, SNFs, ICFs Regulations require these facilities
to keep these records, but do
not specify retention periods
[22 C.C.R. Sections 70841(e),
71645(e), 72641(f) and 73639(f)].
Life of generator,
plus 6 years
Equipment records (purchase,
operating instructions,
maintenance, inspection,
repairs, calibrations)
All providers Life of equipment,
plus 6 years
HVAC air filter maintenance
records (record of inspection,
cleaning, replacement,
including static pressure
drop. Record must include a
description of filters originally
installed, ASHRAE atmospheric
dust spot test efficiency rating,
and criteria established by
manufacturer or supplier to
determine when replacement
or cleaning is necessary. If
filter maintenance is performed
by an outside company,
the hospital may retain a
certification from the company
stating that these requirements
have been met.)
GACHs, APHs, SNFs, ICFs Regulations require these facilities
to keep these records, but do
not specify retention periods
[22 C.C.R. Sections 70839(b),
71643(b), 72639(b) and 73637(b)].
Life of air filter, plus
6 years
Inspection reports of grounds
and buildings
All providers 6 years
CHA Record and Data Retention Schedule 2018
42
©CALIFORNIA HOSPITAL ASSOCIATION
ENGINEERING RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Maintenance logs and manuals
(heating, air conditioning,
ventilation)
GACHs, APHs, SNFs,
ICFs, PHFs
Regulations require health facilities
to keep maintenance logs and a
written maintenance manual, but
do not specify retention periods
[22 C.C.R. Sections 70837(d),
71641(d), 72655(b), 73653(b) and
77155(b)].
Life of equipment,
plus 6 years
Records of inspection,
testing and maintenance of
non-disposable engineering
controls including ventilation
and other air handling
systems, air filtration systems,
containment equipment,
biological safety cabinets,
and waste treatment systems
(include name and affiliation
of person performing the test/
inspection/maintenance, date,
significant findings, actions)
All providers Must keep for at least 5 years
[8 C.C.R. Section 5199(j)(3)(F)].
Life of equipment,
plus 6 years
Work orders All providers 2 years
Recommended Record Retention Schedule CHA
43
©CALIFORNIA HOSPITAL ASSOCIATION
HOUSEKEEPING/ENVIRONMENTAL SERVICES RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Checkout, transfer, isolation
records
All providers 2 years
Cleaning records (rooms,
equipment, work surfaces,
etc.)
All providers 2 years
Environmental exposure
analysis using exposure or
medical records
All providers Must keep for at least 30 years [8
C.C.R. Section 3204(d)(1)(C)]
30 years
Environmental (workplace)
monitoring or measuring
regarding toxic substances
or harmful physical agents
(including personal, area,
grab, wipe, or other form
of sampling; collection and
analytical methodologies,
calculations, and other
background data; and
analyses)
All providers Must be kept for at least 30 years
[8 C.C.R. Section 3204]. However,
background data to environmental
monitoring or measuring, such as
laboratory reports and worksheets,
need only be kept for 1 year.
30 years
Inspection reports of grounds
and buildings
All providers 6 years
Hazardous waste (that is not
medical waste) — reports,
test results, waste analyses,
manifests
All providers that generate
hazardous waste
Must keep for at least 3 years
from due date of report or date
waste accepted by transporter [22
C.C.R. Section 66262.40].
30 years
Material Safety Data Sheets All providers Must keep for as long as a material
is used or stored at a workplace
[8 C.C.R. Sections 3204(d)(1)(B)
(2) and 5194]. Once the material
is no longer used or stored, if the
MSDS is destroyed, a record of
the identity of the substance or
agent, where it was used, and
when it was used must be kept
for at least 30 years. MSDSs must
be immediately accessible to
employes during each work shift.
30 years
Medical waste treatment and
tracking documents
Small quantity generators
of medical waste
Must keep for at least 3 years
[Health and Safety Code Section
117943]. See Health and Safety
Code Section 118040 for required
content of records.
30 years
Medical waste treatment and
tracking documents
Large quantity generators
of medical waste
Must keep for at least 2 years
[Health and Safety Code Section
117975]. See Health and Safety
Code Section 118040 for required
content of records.
30 years
CHA Record and Data Retention Schedule 2018
44
©CALIFORNIA HOSPITAL ASSOCIATION
HOUSEKEEPING/ENVIRONMENTAL SERVICES RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Pesticide handling training
programs
All providers Must keep for at least 2 years after
training program is discontinued
[3 C.C.R. Section 6724(a)]. See
regulation for required content
of training. When antimicrobial
agents are used only as sanitizers,
disinfectants, or medical sterilants,
the employer is exempt from
complying with this requirement,
and instead must comply with
Cal/OSHA requirements [3 C.C.R.
Section 6720], which require
records to be kept for at least one
year [8 C.C.R. Section 3203(b)].
6 years after date
of training (may also
wish to document
attendance
in employee’s
personnel file)
Pesticide Safety Information
Series leaflets, MSDSs,
pesticide use records,
employee exposure records,
work practice reviews
All providers Regulations require these records
to be kept, but no retention period
is specified [3 C.C.R. Section
6723]. When antimicrobial agents
are used only as sanitizers,
disinfectants, or medical sterilants,
the employer is exempt from
complying with this requirement,
and instead must comply with
Cal/OSHA requirements [3 C.C.R.
Section 6720]. See “Material
Safety Data Sheets,” page 43,
and “Employee health (medical)
records — Employees subject to
OSHA regulations,” page 46.
30 years
Recommended Record Retention Schedule CHA
45
©CALIFORNIA HOSPITAL ASSOCIATION
HUMAN RESOURCES RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Aerosol transmissible disease
training
All providers Must keep for at least 3 years after
date of training [8 C.C.R. Section
5199)(j)(2)]. See regulation for
required content of record.
6 years after date
of training (may also
wish to document
attendance
in employee’s
personnel file)
Affirmative action program
records
All providers subject
to affirmative action
requirements
Life of program, plus 1 year [41
C.F.R. Section 60-1.12]
Life of program, plus
6 years
Applications for employment See “Employee and applicant
records ...,” below.
Bloodborne pathogen training All providers Must keep for at least 3 years [8
C.C.R. Section 5193(h)]
6 years (may also
wish to document
attendance
in employee’s
personnel file)
Collective bargaining
agreements and related
documents
All providers Must keep for at least 3 years [29
C.F.R. Section 516.5].
Life of agreement,
plus 10 years
Employee acknowledgment
of child abuse and neglect
reporting requirement,
elder and dependent adult
abuse and neglect reporting
requirement
All providers File in employee’s
personnel file
Employee and applicant
records required by the
California Fair Employment
and Housing Act, Title VII
of the Civil Rights Act, the
Americans with Disabilities
Act, the Genetic Information
Nondiscrimination Act, and
the Age Discrimination in
Employment Act — any
personnel or employment
record made or kept by an
employer, including application
forms and resumes submitted
by applicants; requests for
reasonable accommodation;
records relating to recruitment,
testing, hiring, promotion,
demotion, transfer, recall,
layoff, termination, rate of
pay and other terms of
compensation, garnishment,
and selection for training or
apprenticeship programs
All providers Health facilities and primary
care clinics must keep for at
least 3 years after termination
of employment [22 C.C.R.
Sections 70725, 71525, 72533,
73527, 75052, 77119, 79333
and 87866]. Other providers
must keep for at least 2 years
from date of making record
or personnel action involved,
whichever is later [Government
Code Section 12946]. See also
29 C.F.R. Sections 1602.14 (one
year retention period required) and
1627.3(b) (3 years). Longer if a
charge of discrimination has been
filed [29 C.F.R. Section 1602.14]
Duration of
employment, plus
10 years
CHA Record and Data Retention Schedule 2018
46
©CALIFORNIA HOSPITAL ASSOCIATION
HUMAN RESOURCES RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Employee benefit plans —
pension and insurance plans
All providers Must keep for 1 year after
termination of plan [29 C.F.R.
Section 1627.3].
Permanent
Employee exposure records,
including audiometric test
results
All providers Must keep for at least 30 years [8
C.C.R. Sections 3204(d)(1)(B) and
5100(d)]
Duration of
employment plus 30
years
Employee handbook All providers Permanent
Employee health (medical)
records — Employees not
subject to OSHA regulations
Health facilities, clinics,
HHAs
Must keep these records for at
least 3 years after termination of
employment [22 C.C.R. Sections
70723, 71523, 72535, 73525,
74723, 75052, 77121 and 79331].
Duration of
employment, plus
30 years
Employee health (medical)
records — Employees subject
to OSHA regulations
All providers Federal and California OSHA
regulations require that medical
records be kept for the duration of
employment plus 30 years for all
employees who are exposed, or
potentially exposed, to hazardous
substances (including chemical
substances, biological agents, and
bloodborne pathogens) or to a
hazardous environment [29 C.F.R.
Sections 1910.1020(d)(1)(i), and
1910.1030(h); 8 C.C.R. Sections
3204(c)(5), 3204(d)(1), 5193(h)
and 5199(j)(1)]. See regulations
for required content of records.
Hazardous substances include
those listed in the latest edition of
the Registry of Toxic Effects of the
National Institute for Occupational
Safety & Health. Hazardous
environments include noise, heat,
cold, vibration, repetitive motion,
ionizing and nonionizing radiation,
and hypo- and hyperbaric
pressure. See also “Noise
exposure records,” page 47.
Duration of
employment, plus
30 years
Employee polygraph records All providers Must keep for at least 3 years
[29 C.F.R. Section 801.30]. See
regulation for required content
of report. See also Labor Code
Section 432.2 for retrictions on
employee polygraphs.
Duration of
employment, plus
10 years
Employer Information Report
EEO-1
Employers subject to Title
VII of the Civil Rights Act
of 1964 that have 100 or
more employees
Must keep the most recent annual
report [29 C.F.R. Section 1602.7].
30 years
Recommended Record Retention Schedule CHA
47
©CALIFORNIA HOSPITAL ASSOCIATION
HUMAN RESOURCES RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Employment Eligibility
Verification Form (INS Form I-9)
All providers Must keep for at least 3 years
after date of hire or 1 year after
termination of employment,
whichever is later [8 C.F.R. Section
274a.2].
Duration of
employment, plus
10 years
Equal Pay Act records —
records that relate to payment
of wages, wage rates, job
evaluations, job classifications,
job descriptions, merit
systems, seniority systems,
other matters that explain the
basis for payment of any wage
differential to employes of
the opposite sex in the same
establishment
All providers Must keep for at least 2 years
[29 C.F.R. Section 1620.32].
(Copies of seniority systems and
merit systems must be kept for
at least 1 year after termination
of the system under the Age
Discrimination in Employment Act
[29 C.F.R. Section 1627.3(b)(2)]).
Records about
specific employees:
File in employees
personnel file.
Other records: 30
years
Family Medical Leave Act
records — dates of leave,
hours of leave, employee
notices, employer policies and
practices, records of disputes,
premium payments
Providers subject to FMLA Must keep for at least 3 years [29
C.F.R. Section 825.500]. See also
Government Code Section 12946
(2-year retention period required,
longer if ongoing litigation).
Records about
specific employees:
File in employees
personnel file.
Other records: 30
years
Garnishment records All providers 7 years
Labor/management reporting
records to Office of Labor-
Management Standards
All providers Must keep for at least 5 years after
filing [29 U.S.C. Section 436; 29
C.F.R. Section 405.9].
6 years after filing
report
Log of temporary health
services personnel
SNFs Must keep for at least 3 years
[22 C.C.R. Section 72533].
6 years
Mammography personnel
qualification records
See “Mammography personnel
qualifications for physicians,
mammographic radiologic
technologists, medical physicists,”
page 52
Material Safety Data Sheets All providers Must keep while chemical is
being used by employees. When
safety data sheets are destroyed,
must keep a record of the identity
(chemical name, if known) of the
substance, where it was used, and
when it was used for at least 30
years. [8 C.C.R. Section 3204(d)
(1)(B)]
6 years after
use of chemical
discontinued
Noise exposure records All providers Noise exposure measurement
records must be kept for at least 2
years [8 C.C.R. Section 5100].
30 years
Orientation and competency
validation
GACHs Must retain in employee’s file for
the duration of employment [22
C.C.R. Section 70214(a)(4)]
Duration of
employment plus 6
years
CHA Record and Data Retention Schedule 2018
48
©CALIFORNIA HOSPITAL ASSOCIATION
HUMAN RESOURCES RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
OSHA logs, summaries and
reports; OSHA forms 300,
300A, 301 Incident Reports,
privacy case list
All providers Must keep for at least 5 years
following the end of the calendar
year that the records cover
[29 C.F.R. Section 1904.33;
8 C.C.R. Section 14300.33].
6 years
Payroll records, including:
• Employee deduction
authorizations
• Hours worked (daily)
• Leaves of absence
• Overtime, vacation and sick
leave accruals and entries
• Time cards
• Wage rates and wages paid
• Wage statements, itemized
All providers Retention of comprehensive
payroll records is required under
numerous federal and state
laws, including the Fair Labor
Standards Act, Equal Pay Act,
Age Discrimination in Employment
Act, Title VII of the Civil Rights
Act, Americans with Disabilities
Act, California Fair Employment
& Housing Act, California
Unemployment Insurance Code,
ERISA and Medi-Cal/Medicare
requirements. Although most of
the acts require retention for a
period no longer than 4 years,
ERISA requires current availability
of all payroll records necessary
to determine entitlement to
pension benefits. It is therefore
recommended that payroll records
be permanently retained. (See also
Labor Code Sections 226(a) and
247.5.) (As ERISA requirements
vary according to the type of
pension plan, facilities may wish
to have their attorneys review
their plans to determine whether
a shorter retention period may
be appropriate and to determine
which payroll records should be
retained.) See also Labor Code
Section 1174; 29 C.F.R. Sections
516.5 and 516.6; 22 C.C.R.
Sections 70725, 71525, 72533,
73527, 75052, 77119 and 79333.
Employees not
entitled to pension:
15 years
Employees entitled
to pension: life of
employee plus 6
years
Pension records All providers See box immediately above. Permanent
Recommended Record Retention Schedule CHA
49
©CALIFORNIA HOSPITAL ASSOCIATION
HUMAN RESOURCES RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Pesticide training program
records
All providers Must keep for at least 2 years
[3 C.C.R. Section 6724]. See
regulation for required content
of training. When antimicrobial
agents are used only as sanitizers,
disinfectants, or medical sterilants,
the employer is exempt from
complying with this requirement
and instead must comply with
Cal/OSHA requirements [3 C.C.R.
Section 6720], which require
records to be kept for at least one
year [8 C.C.R. Sections 3203,
5194].
6 years after date
of training (may also
wish to document
attendance
in employee’s
personnel file)
Respirator fit-testing All providers Must keep until another fit-testing
is performed on the employee
[8 C.C.R. Section 5144(m)]. See
regulation for required content of
record.
6 years
Sharps injury log All providers Must keep for at least 5 years
[8 C.C.R. Section 5193(h)]. See
regulation for required content of
log.
10 years
Sharps injury training All providers Must keep for at least 3 years
[8 C.C.R. Section 5193(h)]. See
regulation for required content of
record.
6 years (may also
wish to document
attendance
in employee’s
personnel file)
Unavailablility of vaccine
for employees who may
be exposed to an aerosol
transmissible disease
All providers Must keep for at least 3 years
[8 C.C.R Section 5199(j)(3)]. See
regulation for required content of
record.
6 years
Volunteer personnel records All providers 6 years after
termination of
volunteer status
Volunteer sign-in sheets, hours
worked, assignments
Facilities 6 years
W-2, W-4 forms See “Business and Finance
Records,” page 31.
CHA Record and Data Retention Schedule 2018
50
©CALIFORNIA HOSPITAL ASSOCIATION
HUMAN RESOURCES RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Workplace violence prevention
records: iolent incident log,
reports to Cal/OSHA and injury
investigations
Health facilities, HHAs,
hospices
Must keep for at least 5 years [8
C.C.R. Section 3342(h)(3)]
6 years
Workplace violence prevention
training
Health facilities, HHAs,
hospices
Must keep for at least 1 year [8
C.C.R. Section 3342(h)]
6 years after date
of training (may also
wish to document
attendance
in employee’s
personnel file)
Workers’ compensation claims
files
All providers Must keep for the latest of: 5 years
from date of injury; 1 year from
date compensation last provided;
until all compensation due or
which may be due has been paid;
or, if an audit has been conducted
within 5 years from the date of
injury, until the findings are final
[8 C.C.R. Section 10102]. See
8 C.C.R. Section 10101.1 for
required content of file.
6 years after all
compensation paid
Workers’ compensation claims
log
All providers Must keep for 5 years from the
end of the year to which the log
relates [8 C.C.R. Section 10103.2].
See regulation for required content
of log.
6 years
Workers’ compensation self-
insureds’ claims files
All providers Claim files must be kept for at
least 5 years from date of injury or
date on which last compensation
benefit paid, whichever is later.
Must keep indefinitely if open
future medical benefits due. Must
be kept in California unless written
permission is obtained to retain
the records out-of-state.
[8 C.C.R. Section 15400.2]
6 years after all
compensation paid
Recommended Record Retention Schedule CHA
51
©CALIFORNIA HOSPITAL ASSOCIATION
IMAGING/RADIOLOGY RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Dose surveys, air sampling,
bioassays, measurements to
evaluate release of radioactive
effluents
Health facilities and
imaging centers
Must keep for duration of license
[10 C.F.R. Section 20.103; 17
C.C.R. Section 30275]. See
10 C.F.R. Section 20.2103
for required surveys and
measurements.
Duration of license
plus 30 years. Must
keep any records
showing potential
employee exposures
for at least 30 years
(see “Environmental
(workplace)
monitoring or
measuring regarding
toxic substances
or harmful physical
agents (including
personal, area,
grab, wipe, or
other form of
sampling; collection
and analytical
methodologies,
calculations, and
other background
data; and
analyses),” page
43).
Dose to individual member of
public
Health facilities and
imaging centers
Must keep for the duration
of license [10 C.F.R. Section
20.2107; 17 C.C.R. Section
30275].
Duration of license,
plus 30 years
Equipment inspection records Health facilities and
imaging centers
Life of equipment,
plus 6 years
Fluoroscopy monitoring
readings
Imaging facilities Must keep at least 3 years [17
C.C.R. Section 30307(b)(2)] (See
regulation for required content of
logs.)
6 years
Mammograms and reports Mammography facilities Must keep in patient’s medical
record for not less than 7 years,
or not less than 10 years if no
subsequent mammograms of
the patient are performed at
the facility, unless the original
mammogram is transferred to the
patient’s health care provider or
to the patient [42 U.S.C. Section
263b(f)(1)(G)(i); 21 C.F.R. Section
900.12(c); 17 C.C.R. Section
30317.50].
File in patient’s
medical record
Mammography consumer
complaints
Mammography facilities Must keep for at least 3 years [21
C.F.R. Section 900.12(h)]
6 years
CHA Record and Data Retention Schedule 2018
52
©CALIFORNIA HOSPITAL ASSOCIATION
IMAGING/RADIOLOGY RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Mammography personnel
qualifications for physicians,
mammographic radiologic
technologists, medical
physicists
Mammography facilities Must keep for at least 2 years
after termination of employment/
medical staff membership
[17 C.C.R. Section 30319.20].
See 17 C.C.R. Sections 30315.52,
30315.50 and 30455.1 for
required qualifications. In addition,
records of personnel no longer
employed must be kept until the
next annual inspection has been
completed and the FDA has
determined that the facility is in
compliance with MQSA personnel
requirements [21 C.F.R. Section
900.12].
File in employee’s
personnel file
Mammography quality
assurance records — records
concerning mammography
technique and procedures,
quality control (including
monitoring data, problems
detected, corrective actions,
effectiveness of corrective
actions), safety and protection
Mammography facilities Must keep until the next annual
inspection has been completed
and the FDA has determined
that the facility is in compliance
with the quality assurance
requirements, or, for quality control
test records, until the test has
been performed two additional
times at the required frequency,
whichever is longer [21 C.F.R.
Section 900.12(d)].
Until next inspection,
plus 6 years
Mammography records —
calibrations, maintenance,
machine modifications (must
include date of calibration,
maintenance, or modification;
name of individual making the
record; manufacturer’s model
number, facility’s radiation
machine ID number)
Mammography facilities Must keep for at least 3 years [17
C.C.R. Section 30319.20]. See
17 C.C.R. Sections 30316.10-
30318.10 for further information
about record contents.
Life of equipment,
plus 6 years
Mammography records —
processor film strips, phantom
images, fixer retention test
films, darkroom test films,
screen-film contact test films
Mammography facilities Must keep for at least 1 year [17
C.C.R. Section 30319.20]. See
17 C.C.R. Sections 30316.10-
30318.10 for further information
about record contents.
6 years
Recommended Record Retention Schedule CHA
53
©CALIFORNIA HOSPITAL ASSOCIATION
IMAGING/RADIOLOGY RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Mammography records — QA
logs, phantom image score
sheets, fixer retention log
sheets, repeat analyses,
darkroom fog log sheets,
screen-film contact log sheets,
compression test log sheets,
darkroom cleaning logs,
intensifying screen cleaning
logs, view box cleaning logs,
medical physicist survey
reports, evaluations and
instrument calibration reports,
evaluations of new/repaired
equipment, medical outcomes
audit analyses, consumer
complaints, mobile service
provider documents
Mammography facilities Must keep for at least 3 years [17
C.C.R. Section 30319.20]. See
17 C.C.R. Sections 30316.10-
30318.10 for further information
about record contents.
6 years/Life of
equipment, plus 6
years
Mammography records —
receipt, transfer, and disposal
of radiation machines (must
include date of receipt,
transfer, or disposal; name and
signature of individual making
the records; manufacturer’s
model number; facility’s
radiation machine ID number)
Mammography facilities Must keep until facility ceases use
and disposes of the machine [17
C.C.R. Section 30319.20]. See
17 C.C.R. Sections 30316.10-
30318.10 for further information
about record contents.
Life of equipment,
plus 6 years
Manifests Health facilities and
imaging centers
30 years
NRC Form 4 — prior
occupational dose
Health facilities and
imaging centers
Must keep for 3 years [10 C.F.R.
Section 20.2104(f);
17 C.C.R. Section 30275].
Duration of
employment, plus
30 years
NRC Form 5 — occupational
monitoring
Health facilities and
imaging centers
Must keep for the duration
of license [10 C.F.R. Section
20.2106(f); 17 C.C.R. Section
30275]. Keep also in employee
health record. (See “Employee
health (medical) records —
Employees subject to OSHA
regulations,” page 46.)
Duration of license,
plus 30 years
Planned special exposure Health facilities and
imaging centers
Must keep for duration of license
[10 C.F.R. Section 20.2105; 17
C.C.R. Section 30275].
Duration of license,
plus 30 years
Radiation protection program Health facilities and
imaging centers
Must keep for the duration
of license [10 C.F.R. Section
20.2102; 17 C.C.R. Section
30275].
Duration of license,
plus 30 years
CHA Record and Data Retention Schedule 2018
54
©CALIFORNIA HOSPITAL ASSOCIATION
IMAGING/RADIOLOGY RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Radiation protection program
— audits and reviews of
content and implementation
Health facilities and
imaging centers
Must keep for at least 3 years [10
C.F.R. Section 20.2102; 17 C.C.R.
Section 30275].
30 years
Radiation source records:
disposal
Health facilities and
imaging centers
Must keep for duration of license
[17 C.C.R. Sections 30275
and 30293, 10 C.F.R. Section
20.2108].
Duration of license,
plus 30 years
Radiation source records:
receipt and transfer
Health facilities and
imaging centers
Must keep for 3 years following
transfer [17 C.C.R. Section
30293].
30 years following
transfer
Radiology reports, printouts,
films, scans, and other imaging
records
Health facilities and
imaging centers
Hospitals that participate in
Medicare must keep for at least 5
years [42 C.F.R. Section 482.26].
File in patient’s
medical record
Radioisotopes –– receipt,
transfer, use, storage, delivery,
disposal and reports of
overexposure
Health facilities and
imaging centers
Must keep for at least 3 years after
transfer or disposal of the material.
Disposal records must be kept
for duration of license. [10 C.F.R.
Section 30.51]
30 years
Reports to CDPH of unplanned
contamination events involving
licensed radioactive material,
failure of equipment designed
to prevent releases, event
requiring unplanned medical
treatment, fire or explosion
damaging licensed material,
etc.
Health facilities and
imaging centers
Must keep for duration of license
[17 C.C.R. Section 30293].
See 17 C.C.R. Section 30295
regarding reporting requirements.
Duration of license
plus 30 years. Must
keep any records
showing potential
employee exposures
for at least 30 years
(see “Environmental
(workplace)
monitoring or
measuring regarding
toxic substances
or harmful physical
agents (including
personal, area,
grab, wipe, or
other form of
sampling; collection
and analytical
methodologies,
calculations, and
other background
data; and
analyses),” page
43).
Requests for tests, procedures Health facilities and
imaging centers
Medicare-participating facilities
and imaging centers must keep
for at least 7 years [42 C.F.R.
Section 424.516(f)]
15 years
Recommended Record Retention Schedule CHA
55
©CALIFORNIA HOSPITAL ASSOCIATION
IMAGING/RADIOLOGY RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Surveys and calibrations Health facilities and
imaging centers
Must keep for at least 3 years [10
C.F.R. Section 20.2103; 17 C.C.R.
Section 30275]. See 10 C.F.R.
Section 20.2103 for required
surveys and calibrations.
Life of equipment,
plus 6 years.
Tests of residual fixer level,
darkroom fog, corrective
actions
Imaging facilities (other
than mammography or
dental)
Must keep for at least one year
from date of test [17 C.C.R.
Section 30308.1]
6 years
X–rays, other imaging data and
studies
Health facilities and
imaging centers
Must keep for time prescribed for
retention of medical records. See
“Medical Records,” page 61.
15 years – adults
25 years – minors
LABORATORY RECORDS AND SPECIMENS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Analytic system records:
• Quality control and patient
test records, including
instrument printouts, if
applicable;
• Records documenting
all analytic systems ac-
tivities specified in CLIA, 42
C.F.R. Sections 493.1252-
493.1289; and
• Records of quality control
procedures in use, including
results on standards
and reference materials
and action limits when
appropriate
Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions Code
Section 1265(j)]. See also 42
C.F.R. Section 493.1105.
6 years
Analytic system records
— records of test system
performance specifications that
the laboratory establishes or
verifies under 42 C.F.R. Section
493.1253
Freestanding and health
facility laboratories
Must keep for the period of time
the laboratory uses the test
system, but no less than 3 years
[Business and Professions Code
Section 1265(j)]. See also 42
C.F.R. Section 493.1105.
Life of system, plus
6 years
CHA Record and Data Retention Schedule 2018
56
©CALIFORNIA HOSPITAL ASSOCIATION
LABORATORY RECORDS AND SPECIMENS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Blood and blood component
records (documentation
regarding collection
processing, testing, storage,
distribution, complaints,
adverse reaction and quality
control records)
Blood banks, freestanding
and health facility
laboratories that process,
test, store or distribute
blood components
Must keep for at least 10 years
after processing or 6 months after
the latest expiration date for the
individual product, whichever is
later. When there is no expiration
date, records must be kept
indefinitely. [21 C.F.R. Section
606.160(d)] See 21 C.F.R. Section
606.160(d) for further information
about required record contents.
See also 42 C.F.R. Sections
482.27 and 493.1105.
15 years after
expiration date,
unless indefinite
retention required
(see remarks to the
left)
Blood donor histories and
pertinent records
Blood banks, freestanding
and health facility
laboratories that process,
test, store or distribute
blood components
Must keep for at least 10 years
after processing or 6 months after
the latest expiration date for the
individual product, whichever is
later. When there is no expiration
date, records must be kept
indefinitely. [21 C.F.R. Section
606.160(d)] See 21 C.F.R. Section
606.160(d) for further information
about required record contents.
15 years after
expiration date,
unless indefinite
retention required
(see remarks to the
left)
Blood: sample of transfused
blood
Health facilities Must keep for further testing in the
event of a transfusion reaction [42
C.F.R. Section 493.1271(d)
2 weeks after last
transfusion
Blood transfusion records
(including source and
disposition)
Freestanding and health
facility laboratories that
process, test, store
or distribute blood
components
Must keep for at least 10 years
after processing or distribution or
6 months after the latest expiration
date for the individual product,
whichever is later. When there is
no expiration date, records must
be kept indefinitely. [21 C.F.R.
Section 606.160(d)] See also
42 C.F.R. Sections 482.27 and
493.1105.
15 years after
expiration date,
unless indefinite
retention required
(see remarks to the
left)
Blood transfusion-related
records for which there is no
expiration date
Freestanding and health
facility laboratories that
process, test, store
or distribute blood
components
Must keep indefinitely
[21 C.F.R. Section 606.160].
Permanent
Correspondence with clinician
about malignant neoplasms
Freestanding and health
facilities labs
Must keep at least 5 years
[Business and Professions Code
1274(a)]
File in patient’s
medical record
Recommended Record Retention Schedule CHA
57
©CALIFORNIA HOSPITAL ASSOCIATION
LABORATORY RECORDS AND SPECIMENS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Cytology lab — records of
the total number of slides
examined by each employee
during each 24-hour period
and the number of hours spent
examining slides in the 24-hour
period irrespective of the site
or laboratory
Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions Code
Sections 1265(j) and 1271]. See
also 42 C.F.R. Sections 493.1105
and 493.1274(d)(3).
10 years
Cytology reports Freestanding and health
facility laboratories
Must keep for at least 10 years
[Business and Professions Code
1271(g)].
File in patient’s
medical record.
Cytology slides and cell blocks Freestanding and health
facility laboratories
Must keep for at least 5 years from
date of examination
[Business and Professions
Code 1271(g)]. See also 42
C.F.R. Sections 493.1105 and
493.1274(f). (Slides may be loaned
to proficiency testing programs
in lieu of keeping them for the
required time period, provided
the laboratory receives written
acknowledgment of the receipt
of slides by the proficiency
testing program and keeps the
acknowledgment.)
5 years
Equipment inspection,
validation, calibration, repair
and replacement records
Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions
Code Section 1265(j)]. If the
records relate to equipment
used to process blood or blood
components, see “Blood and
blood component records
(documentation regarding
collection processing, testing,
storage, distribution, complaints,
adverse reaction and quality
control records),” page 56, for
applicable retention period.
Life of equipment,
plus 6 years
Histopathology slides Freestanding and health
facility laboratories
Must keep for at least 10 years
from date of examination
[42 C.F.R. Section 493.1105(a)(7)].
10 years
Human tissue intended for
transplantation
See “Human tissue intended for
transplantation,” page 61.
CHA Record and Data Retention Schedule 2018
58
©CALIFORNIA HOSPITAL ASSOCIATION
LABORATORY RECORDS AND SPECIMENS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Immunohematology records
and reports
Freestanding and health
facility laboratories
Must keep for at least 10 years
after processing or 6 months after
the latest expiration date for the
individual product, whichever is
later. When there is no expiration
date, records must be kept
indefinitely. [21 C.F.R. Section
606.160(d); 42 C.F.R. Section
493.1105]
Reports about
individual patients:
file in patient’s
medical record.
Otherwise, keep
15 years unless
indefinite retention
required (see
remarks to the left)
Invoices See “Invoices documenting
purchase or lease of clinical
laboratory equipment and test kits,
reagents, or media,” page 33.
Nuclear medicine reports GACHs, APHs Must keep for at least 5 years
[42 C.F.R. Section 482.53(d)]
File in patient’s
medical record
Pathology test reports Freestanding and health
facility laboratories
Must keep for at least 10 years [42
C.F.R. Section 493.1105(a)(6)(ii)].
File in patient’s
medical record
Pathology specimen blocks Freestanding and health
facility laboratories
Must keep for at least 2 years from
date of examination. [42 C.F.R.
Section 493.1105]
2 years
Patient specimen testing
records (including personnel
performing the test and,
if applicable, instrument
printouts)
Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions Code
Section 1265(j)]. See also 42
C.F.R. Sections 493.1105 and
493.1283.
6 years
Procedure manuals; method
of validation (manuals, card
files, or flow charts for each
procedure performed, including
at least: name of procedure,
source or reference for the
test method, date procedure
last reviewed/modified by the
director/supervisor, current
specific instructions for test
performance, standards
and controls required, and
instructions for collecting and
handling specimens to insure
test reliability)
Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions Code
Section 1265(j)].
Life of manual/
method, plus 6
years
Recommended Record Retention Schedule CHA
59
©CALIFORNIA HOSPITAL ASSOCIATION
LABORATORY RECORDS AND SPECIMENS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Proficiency testing records Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions Code
Section 1265(j)]. See also 42
C.F.R. Sections 493.801 and
493.1105.
6 years
Quality control/assessment
documentation (documentation
regarding calibration, control
procedures, maintenance
and function tests, test result
comparison activities, workload
limit records, alarm system
checks, proficiency testing,
corrective actions, etc.)
Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions
Code Section1265(j)]. However,
quality control records for blood
and blood components and
immunohematology must be
kept for at least 10 years after
processing or 6 months after
expiration date, whichever is later.
[21 C.F.R. Section 606.160; 42
C.F.R. Section 493.1105] See also
42 C.F.R. Part 493.
6 years
Registers of tests –– logbooks
(chronological), accession logs
Freestanding and health
facility laboratories
6 years
Report of imminent life-
threatening result or panic
value (including name of
person contacted)
Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions Code
Section 1265(j)].
File in patient’s
medical record
Requests for tests/test
requisitions (patient ID, name of
submitter, dates of receipt and
report, type of test performed,
test results).
Freestanding and health
facility laboratories
Must keep for at least 10 years
from date of service, end of
Medi-Cal or Medicare Advantage
or Medicare Part D contract
period, or audit completion,
whichever is later [42 C.F.R.
Sections 422.504(i)(2) and
423.505(i)(2); 42 C.F.R. Section
424.516(f) (7-year retention
period); Welfare and Institutions
Code Section 14124.1; Title 22,
California Code of Regulations,
Section 51476]
15 years
Specimen records Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions Code
Section 1265(j)].
6 years
CHA Record and Data Retention Schedule 2018
60
©CALIFORNIA HOSPITAL ASSOCIATION
LABORATORY RECORDS AND SPECIMENS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Test procedures (must include
dates of initial use and
discontinuance)
Freestanding and health
facility laboratories
Must keep for at least 3 years
after a procedure has been
discontinued [Business and
Professions Code Section 1265(j)].
See also 42 C.F.R. Section
493.1105.
6 years after
procedure
discontinued
Test reports not otherwise
specifically mentioned (final,
preliminary and corrected)
Freestanding and health
facility laboratories
Must keep for at least 3 years
[Business and Professions Code
Section 1265(j)]. See also 42
C.F.R. Section 493.1105.
File in patient’s
medical record
Tissue specimens Freestanding and health
facility laboratories
Preserve remnants of tissue
for pathology examination until
a diagnosis is made on the
specimen [42 C.F.R. Section
493.1105].
Until diagnosis is
made. May wish
to keep longer
depending upon
type of tissue, how
it is preserved, and
clinical indications.
NOTE: State and federal laws contain detailed requirements regarding the information to be included in various
documents. Laboratories should carefully review Business and Professions Code Section 1265(j) and 42 C.F.R. Section
493.1105 (which requires documentation of compliance with CLIA, 42 C.F.R. Sections 1252-1289) to be sure all required
information is captured in the appropriate documents, and retained for the required period of time. Laboratories should
also review 21 C.F.R. Section 606.160 if blood or blood components are involved. (See “Where to Find the Laws
Referenced in the Manual,” page 75, for instructions on where to find the exact text of each statute and regulation.)
The College of American Pathologists (CAP) has developed a recommended retention schedule that addresses many
records and items not covered in this manual. Hospitals and other providers may wish to consult the CAP schedule.
Recommended Record Retention Schedule CHA
61
©CALIFORNIA HOSPITAL ASSOCIATION
MEDICAL RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Anatomical gift Hospital Permanent
Birth certificates All providers Permanent
Birth room record All providers Permanent
Cancer/tumor registry files All providers Permanent
Death certificates All providers Permanent
Electrocardiograms (EKGs) All providers Keep only those portions that are
specifically selected by the treating
provider to be included in the
patient’s medical record
File in patient’s
medical record
Electroencephalograms (EEGs) All providers Keep only those portions that are
specifically selected by the treating
provider to be included in the
patient’s medical record
File in patient’s
medical record
Electromyograms (EMGs) All providers Keep only those portions that are
specifically selected by the treating
provider to be included in the
patient’s medical record
File in patient’s
medical record
Fetal heart monitor strips Keep only those portions that are
specifically selected by the treating
provider to be included in the
patient’s medical record
File in patient’s
medical record
Human tissue intended for
transplantation
See “Human tissue intended for
transplantation (records regarding
donor screening and testing;
records regarding supplier, donor
and lot identification, receipt,
name(s) of recipient(s), storage
temperatures, distribution,
destruction, disposition of human
tissue, expiration dates of all
tissues, etc.),” page 38.
Index to patients’ medical
records
See “Master patient index/medical
record index number,” page 25.
Orders and certifications Medicare provider or
supplier of DMEPOS, lab,
imagery or home health
services
Must keep at least 7 years [42
C.F.R. Section 424.516(f)]
File in patient’s
medical record
CHA Record and Data Retention Schedule 2018
62
©CALIFORNIA HOSPITAL ASSOCIATION
MEDICAL RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Patient medical records,
including:
• Admission records
• Autopsy reports (and
consents for autopsy)
• Consent forms
• Consultation reports
• Diagnoses
• Discharge summary
• Imaging/radiology reports
• Labor and delivery records
• Laboratory reports
• Medication records
• Nurses’ notes
• Patient histories
• Patient identification
information
• Patient’s principal spoken
language
• Physical examination notes
• Physical therapy notes
• Physicians’ orders
• Progress notes
• Psychiatric records
• Reports of all other tests:
EKG, EEG, etc.
• Surgical records, complete
with:
– Anesthesia records
– Findings
– Operative report
– Pathology report
– Postoperative diagnoses
– Preoperative diagnoses
• Vital signs sheets
All providers Various types of health facilities,
home health agencies and
individual practitioners are required
to keep medical records for at
least the following periods:
• Adults and emancipated minors
— 7 years
• Unemancipated minors — 1
year after the minor has reached
age 18, and in no event less
than 7 years
[Business and Professions Code
Sections 2570.185 (occupational
therapists), 2620.7 (physical
therapists), 2919 (psychologists),
4980.49 (marriage and family
therapists), 4989.51 (educational
psychologists), 4993 (clinical social
workers), 4999.75 (professional
clinical counselors); Health and
Safety Code Section 123145;
22 C.C.R. Sections 70751(c),
71551(c), 72543(a), 73543(a),
74731(d), 75055(a), 75343(a),
77143(c) and 79351(c)]
Records that support claims for
services rendered to Medicare or
Medi-Cal patients must be kept
for at least 10 years from date
of service, end of Medi-Cal or
Medicare Advantage or Medicare
Part D contract period, or audit
completion, whichever is later
[42 C.F.R. Sections 422.504(i)
(2) and 423.505(i)(2); Welfare and
Institutions Code Section 14124.1;
Title 22, California Code of
Regulations, Section 51476]
SNFs that participate in Medicare/
Medicaid must keep records of
minors until they reach the age of
21 [42 C.F.R. Section 483.70(i)].
Prescribers of controlled
substances must keep specified
records at least 3 years [Health
and Safety Code Sections 11190-
11191].
15 years — adults
25 years — minors
Recommended Record Retention Schedule CHA
63
©CALIFORNIA HOSPITAL ASSOCIATION
MEDICAL RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Resident assessments SNFs that participate in
Medicare/Medicaid
Must keep for at least 15 months
[42 C.F.R. Section 483.20(d)]
File in patient’s
medical record
Video records of diagnostic
tests (e.g., arthroscopies)
All providers Keep only those portions that
are specifically selected by the
physician to accompany the report
in the patient’s medical record.
File in patient’s
medical record
NOTE: See “Human Resources Records,” page 45, for information about employee health records.
MEDICAL STAFF RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Bylaws and rules and
regulations of the medical staff
GACHs, APHs, PHFs,
CDRHs
Regulations require hospitals to
keep these records, but do not
specify retention periods
[22 C.C.R. Sections 70703,
70733, 71503, 71531, 77127,
79303, and 79337].
Permanent
Bylaws, rules and regulations,
and minutes of meetings of the
professional and other staff
PHFs, CDRHs Regulations require PHFs and
CDRHs to keep these records, but
do not specify retention periods
[22 C.C.R. Sections 77127 and
79337].
Permanent
Call schedules Hospitals Hospitals that participate in
Medicare must keep ED call
schedules for at least 5 years
[42 C.F.R. Section 489.20(r)].
6 years
Medical staff committee
records, including minutes,
reports and other records
GACHs, APHs, PHFs,
CDRHs
Regulations require hospitals to
keep these records, but do not
specify retention periods
[22 C.C.R. Section 70703, 70733,
71503, 71531, 79303 and 79337].
Permanent
Medical staff files (credentialing
files) for allied health providers
(non-employees), physicians,
residents, interns, fellows,
impaired practitioners
— including applications
(accepted and rejected),
credentials, complaints, CME
records, etc.
Hospitals Length of
practitioner’s career,
plus 6 years
CHA Record and Data Retention Schedule 2018
64
©CALIFORNIA HOSPITAL ASSOCIATION
MEDICAL STAFF RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Peer review records Hospitals Records regarding
individual
practitioners: length
of practitioner’s
career, plus 6 years.
Other records: 6
years
Quality assurance records,
incident reports, root-cause
analyses, etc.
Facilities See chapter 19 of CHA’s Consent
Manual about the proper
establishment of an incident report
or medical staff quality assurance
report system.
6 years (unless
desired longer for
trending purposes)
Resident rotation schedules —
location, nature of assignment,
vacation, leave of absence,
sick time, orientation time,
classroom time, etc.
Resident employers Must keep for at least 5 years after
the cost report is filed with the
intermediary. See “Medicare cost
report records,” page 29.
15 years
Surgical privileges list See “Surgical privileges list,” page
39.
Recommended Record Retention Schedule CHA
65
©CALIFORNIA HOSPITAL ASSOCIATION
NUCLEAR MEDICINE RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Calibration records (including
the model and serial number
of the instrument, date
of calibration, results of
calibration, and the name of
the individual who performed
the calibration)
All providers Must keep for at least 3 years
[10 C.F.R. Section 35.2060].
Life of equipment,
plus 6 years
Exposure records See “Employee health (medical)
records — Employees subject to
OSHA regulations,” page 46.
Interpretations, consultations,
and procedures reports
GACHs, APHs Medicare-participating hospitals
must keep for at least 5 years
[42 C.F.R. Section 482.53].
File in patient’s
medical record
Receipt and disposition of
radiopharmaceuticals
All providers Regulations require Medicare-
participating hospitals to keep
these records, but do not specify a
retention period [42 C.F.R. Section
482.53].
10 years
NOTE: See “Imaging/Radiology Records,” page 51, for additional information.
CHA Record and Data Retention Schedule 2018
66
©CALIFORNIA HOSPITAL ASSOCIATION
NURSING RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Nurse staffing data SNFs that participate in
Medicare/Medicaid
Must keep at least 18 months [42
C.F.R. Section 483.35(g)(4)]
15 years
Orientation and competency
validation
GACHs Must retain in employee’s file for
the duration of employment [22
C.C.R. Section 70214(a)(4)]
Duration of
employment plus 4
years
Staff assignment records
(including licensing/certification
status of staff, patient census
for each shift, staff assignment
records, posted nurse staffing
data)
SNFs Must keep for at least 3 years
[22 C.C.R. Section 72329.1(h)].
See also 42 C.F.R. Section
483.35.
15 years
Staffing patterns, including
methodology used
APHs Must keep for at least 6 months
[22 C.C.R. Section 71213(i)].
6 years
Staffing plan for each patient
care unit, including patient care
requirements, staffing levels
for registered nurses, and
other licensed and unlicensed
personnel. Must also record:
1. Staffing requirements as
determined by the patient
classification system for
each unit, documented on
a day-to-day, shift-by-shift
basis;
2. The actual staff and staff
mix provided, documented
on a day-to-day, shift-by-
shift basis;
3. The variance between
required and actual staffing
patterns, documented on
a day-to-day, shift-by-shift
basis;
4. The actual registered nurse,
licensed vocational nurse
and licensed psychiatric
technician assignments
to individual patients
by licensure category,
documented on a day-to-
day, shift-by-shift basis.
GACHs Must keep records of staffing
patterns for the time period
between licensing surveys. Must
keep records of actual RN, LVN,
and LPT assignments for at
least 1 year. [22 C.C.R. Section
70217(d)(2)]
6 years
Recommended Record Retention Schedule CHA
67
©CALIFORNIA HOSPITAL ASSOCIATION
PHARMACY RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Alcohol (tax-free), used for
medicinal, mechanical (analysis
or test), or scientific purposes
for patient treatment (records
of receipt, shipments, use,
destruction, and claims;
include date of transaction,
quantity and proof)
Hospitals, blood banks,
and sanitariums
Must keep for at least 3 years
following date of transaction. Must
keep records at permit premises.
[27 C.F.R. Section 22.164] See
also 27 C.F.R. Sections 22.161
and 22.162 for required content of
records.
6 years
Automated delivery device
policies and procedures
Pharmacies Must keep for at least 3 years after
last use [16 C.C.R. Section 1713].
6 years
Chemicals and products used
for compounding (records
of acquisition, storage,
destruction)
Pharmacies Must keep for at least 3 years
[16 C.C.R. Section 1735.3].
6 years
Compounded drug records Pharmacies Must keep for at least 3 years.
Records to be kept include the
master formula; date; personnel
who compounded; pharmacist
reviewing final product; quantity
of each ingredient; manufacturer,
expiration date and lot number
of each component; equipment
used; pharmacy-assigned
reference or lot number; expiration
date; and quantity compounded.
Some exceptions for products
compounded on a one-time basis
for administration to an inpatient.
[16 C.C.R. Section 1735.3]
6 years
CHA Record and Data Retention Schedule 2018
68
©CALIFORNIA HOSPITAL ASSOCIATION
PHARMACY RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Controlled substances
dispensed, prescriptions
Health facilities,
pharmacies
Must keep for at least 2 years
records showing the kind and
quantity of controlled substances
dispensed or administered, the
date of dispensing, the names
and addresses of persons to
whom controlled substances were
dispensed or administered, and
the names or initials of persons
who dispensed or administered
the controlled substance [21
C.F.R. Sections 1304.04 and
1304.22]. Prescriptions must be
kept for at least 3 years [Business
and Professions Code Section
4333; Health and Safety Code
Sections 11179 and 11205].
Prescriptions for controlled
substances must be kept
separate from prescriptions for
noncontrolled substances, and
may also need to be separated
by Schedule [Health and Safety
Code Section 11205; 21 C.F.R.
Section 1304.04(h)]. See 21 C.F.R.
part 1304 for required content of
records.
6 years
Controlled substances
inventories and records (by
registered location)
Pharmacies Must keep for at least 3 years
[16 C.C.R. Sections 1707
and 1718; 21 C.F.R. Section
1304.04(a)]. Some records may
be kept at a central location if
DEA and Board of Pharmacy
is properly notified [21 C.F.R.
Section 1304.04(a); 16 C.C.R.
Section 1707]. Prescriptions for
controlled substances must be
kept separate from prescriptions
for noncontrolled substances, and
may also need to be separated by
Schedule [Health and Safety Code
Section 11205; 21 C.F.R. Section
1304.04(h)]. See also 21 C.F.R.
part 1304.11 for required inventory
content and procedure.
6 years
Controlled substance
prescription forms (to whom
issued, number issued, etc.)
Health facilities, specified
clinics
Must keep at least 3 years [Health
and Safety Code Section 11162.1]
6 years after last
form used or
destroyed
Recommended Record Retention Schedule CHA
69
©CALIFORNIA HOSPITAL ASSOCIATION
PHARMACY RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Controlled substances records Prescribers Must keep for at least 3 years
[Health and Safety Code
Section 11191]. See Health and
Safety Code Section 11190 for
specific information that must be
documented. Prescriptions for
controlled substances must be
kept separate from prescriptions
for noncontrolled substances, and
may also need to be separated by
Schedule [Health and Safety Code
Section 11205; 21 C.F.R. Section
1304.04(h)].
6 years
Dialysis drugs and devices
for home dialysis patients
(prescriptions, invoices
showing name of drugs/
devices, quantities,
manufacturer, lot number, date,
pharmacist)
Pharmacies Must keep for at least 3 years
[16 C.C.R. Sections 1787 and
1790].
6 years
Drugs provided to health
care facility or prehospital
EMS provider for use by EMS
provider
Pharmacy, prehospital
EMS provider
Must keep for at least 3 years
[Business and Professions Code
Section 4119].
6 years
Epinephrine auto-injectors
furnished to school
districts,county offices of
education (records regarding
acquisition and disposition)
Pharmacies Must keep for at least 3 years
[Business and Professions Code
Section 4119.2].
6 years
Inspection reports by
pharmacist of emergency drug
supplies in nursing units (must
be inspected at least monthly)
GACHs, APHs Must keep for at least 3 years
[22 C.C.R. Sections 70263(f) and
71233(f)].
6 years
Invoices See “Business and Finance
Records,” page 31.
Log of destruction of
discontinued individual
patient’s drugs not supplied
by the hospital which remain
at the hospital after the patient
is discharged (must include
name of patient, name and
strength of drug, prescription
number, amount destroyed,
date of destruction, signature
of witness(es))
GACHs, APHs Must keep for at least 3 years.
Alternatively, the information may
be kept in the patient’s medical
record. [22 C.C.R. Sections 70263
and 71233]
6 years
CHA Record and Data Retention Schedule 2018
70
©CALIFORNIA HOSPITAL ASSOCIATION
PHARMACY RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Medicare Part D-related
documents (prescription drug
benefit)
All providers that contract
with a Medicare Part D
plan
Must keep for at least 10 years
[42 C.F.R. Section 423.505(i)(2)].
See “Contracts with Medicare
Advantage or Medicare Part D
Plans,” page 6.
15 years
Order form DEA 222 (Copy 3
for filled orders; also copies
returned as unaccepted or
defective)
Pharmacies Must keep for at least 2 years [21
C.F.R. Section 1305.17]. See 21
C.F.R. Sections 1305.03, 1305.13
and 1305.15 for required content
of records.
6 years
Patient medication profile
(patient name, address, phone,
date of birth, gender, allergies,
current medications, medical
conditions, etc.; prescription
and prescriber information)
Pharmacies Must keep for at least 1 year from
the date the last prescription filled
[16 C.C.R. Section 1707.1].
15 years — adults
25 years — minors
Prescriptions and prescription
records
Pharmacies Must keep for at least 3 years
[Business and Professions Code
Section 4333; Health and Safety
Code Section 11179; 16 C.C.R.
Section 1707 and 1717(f)].
Prescriptions for controlled
substances must be kept
separate from prescriptions for
noncontrolled substances, and
may also need to be separated by
Schedule [Health and Safety Code
Section 11205; 21 C.F.R. Section
1304.04(h)].
6 years
Quality assurance reviews
(investigation and analysis of
medication errors)
Pharmacies Must keep for at least 1 year
[16 C.C.R. Section 1711].
10 years
Quality assurance review
required by Board of Pharmacy
Pharmacies Must keep for at least one year [16
C.C.R. Section 1711(f)]
6 years
Recall records — records
regarding manufacturer’s
recall of drugs and records
evidencing removal of drugs
from all nursing units, satellite
pharmacies, etc.
Health facilities 6 years
Records of sale, acquisition,
receipt and disposition of
drugs (including DEA Form
222, theft and loss reports)
Health facilities, pharmacy Must keep for at least 3 years
[Business and Professions Code
Sections 4081, 4105, 4190
and 4333]. Must be kept on the
licensed premises unless a written
waiver is granted by the Board
of Pharmacy. See also 42 C.F.R.
Section 482.25; 21 C.F.R. Section
1304.22.
6 years
Recommended Record Retention Schedule CHA
71
©CALIFORNIA HOSPITAL ASSOCIATION
PHARMACY RECORDS (CONT.)
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Records regarding
prescriptions purposely
mislabeled (as part of a
research study or by order of
prescriber)
Pharmacies Must keep for at least 3 years
[Business and Professions Code
Section 4078].
Research:
30 years after
completion of
research
Order of prescriber:
15 years — adults
25 years— minors
Returned drugs — credit
memo
Health facilities,
pharmacies
A facility’s return of a drug to the
manufacturer is exempt from
legally-prohibited sale/resale if a
credit memo is created, sent to
the manufacturer, and retained [21
C.F.R. Section 203.23]. The credit
memo must be kept for at least 3
years [21 C.F.R. Section 203.60].
See 21 C.F.R. Section 203.23 for
required content of credit memo.
6 years
Self-assessment required by
Board of Pharmacy
Pharmacies Must keep for at least 3 years [16
C.C.R. Section 1715]
6 years
Sterile compounding records Pharmacies Must keep for at least 3 years
[16 C.C.R. Section 1751.1]. See
regulation for required content of
records.
6 years
Sterile injectable product
records: name, lot number,
amount, date, compounding
information.
Pharmacies Must keep for at least 3 years.
For sterile products compounded
from one or more nonsterile
ingredients, must also keep
training and competency
evaluation of employees in sterile
product procedures, refrigerator
and freezer temperatures,
certification of sterile compounding
environment, other facility quality
control logs, inspection for expired
or recalled products, preparation
records (including master work
sheet, preparation work sheet, and
end-product evaluation results).
[16 C.C.R. Section 1751.1]
6 years
Temperature monitoring logs The Joint Commission
accredited organizations
`Must keep until next full survey 4 years
CHA Record and Data Retention Schedule 2018
72
©CALIFORNIA HOSPITAL ASSOCIATION
PUBLIC RELATIONS RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Advertisements (print, radio,
television, etc.)
All providers 10 years; may wish
to retain those of
historical interest
permanently
Authorization to use/disclose
protected health information
(media interviews, etc.)
All providers HIPAA regulations require
authorizations to be kept for at
least 6 years [45 C.F.R. Section
164.530(j)].
8 years
Consent to photograph All providers HIPAA regulations require
authorizations to be kept for
at least 6 years [45 C.F.R.
Section 164.530(j)]. Thus, if the
photograph depicts a patient
(as opposed to an employee,
volunteer, or model) and is used
for purposes other than treatment,
payment or health care operations,
the consent to photograph must
comply with HIPAA authorization
requirements and must be kept for
at least 6 years.
8 years after
discontinuing use of
photograph
Marketing materials All providers 10 years; may wish
to retain those of
historical interest
permanently
Newspaper and magazine
clippings (historical)
All providers 10 years; may wish
to retain those of
historical interest
permanently
Photographs –– institutional All providers 10 years; may wish
to retain those of
historical interest
permanently
Press releases All providers 10 years; may wish
to retain those of
historical interest
permanently
Publications (in-house) All providers 10 years; may wish
to retain those of
historical interest
permanently
Recommended Record Retention Schedule CHA
73
©CALIFORNIA HOSPITAL ASSOCIATION
PURCHASING AND RECEIVING RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Invoices See “Business and Finance
Records,” page 31.
Packing slips All providers Providers may wish
to match packing
slips with invoices/
purchase orders and
retain together.
Purchase orders See “Business and Finance
Records,” page 31.
Purchase requisitions (internal
documents)
All providers 2 years
Receiving reports All providers 2 years
Returned goods credits All providers See “Business and Finance
Records,” page 31.
CHA Record and Data Retention Schedule 2018
74
©CALIFORNIA HOSPITAL ASSOCIATION
RESEARCH RECORDS
RECORD PROVIDER TYPES LEGAL REQUIREMENTS
RECOMMENDED
RETENTION
PERIOD
Contracts with study
sponsors and principal
investigators, including related
documentation
All providers 30 years after
completion of the
research
Human subject research
records
All providers Retained records should include
medical records.
30 years after
completion of the
research
Institutional Review Board
(IRB) records (research
proposals and scientific
evaluations; approved
sample consent documents;
progress reports submitted
by investigators; reports of
injuries to subjects; minutes
of IRB meetings; records of
continuing review activities;
correspondence between
the IRB and investigators; list
of IRB members, including
name, degrees, representative
capacity, experience;
any employment or other
relationship with the institution;
written procedures for the
IRB as required by 21 C.F.R.
Section 56.108 (a) and (b);
statements of significant new
findings provided to subjects,
as required by 21 C.F.R.
Section 50.25)
IRBs Must keep for at least 3 years after
completion of the research [21
C.F.R. Section 56.115; 45 C.F.R.
Section 46.115].
Records regarding
particular research
projects:
30 years after
completion of the
research
General IRB
records:
6 years
Other research reports All providers 6 years (longer if
continuing interest)
Research papers published All providers 10 years; may wish
to retain those of
historical interest
permanently
Research regarding
prescriptions purposely
mislabeled (as part of a
research study)
See “Records regarding
prescriptions purposely mislabeled
(as part of a research study or by
order of prescriber),” page 71.
Recommended Record Retention Schedule CHA
75
©CALIFORNIA HOSPITAL ASSOCIATION
Where to Find the Laws
Referenced in the Manual
All of the laws discussed in the manual can be found on the Internet.
FEDERAL LAW
A federal statute is written by a United States Senator or Representative. It is voted on by the
United States Senate and the House of Representatives, and then signed by the President.
A federal statute is referenced like this: 42 U.S.C. Section 1395. “U.S.C.” stands for “United
States Code.” Federal statutes may be found at www.gpo.gov/fdsys or at www.law.cornell.
edu.
A federal regulation is written by a federal agency such as the U.S. Department of Health
and Human Services or the U.S. Food and Drug Administration. The proposed regulation is
published in the Federal Register, along with an explanation (called the “preamble”) of the
regulation, so that the general public and lobbyists may comment on it. The federal agency
must summarize and respond to each comment it receives on the proposed regulation. The
agency may or may not make changes to the proposed regulation based on the comments.
The final regulation is also published in the Federal Register. A federal regulation is referenced
like this: 42 C.F.R. Section 482.1 or 42 C.F.R. Part 2. “C.F.R.” stands for “Code of Federal
Regulations.” Federal regulations may be found at www.ecfr.gov. The preamble, however,
is only published in the Federal Register and not in the Code of Federal Regulations. The
Federal Register may be found at www.federalregister.gov.
The Centers for Medicare & Medicaid Services (CMS) publishes its Interpretive Guidelines
on the internet. The Interpretive Guidelines include information for surveyors on how CMS
interprets the Conditions of Participation, and instructions for surveyors on how to assess
hospitals’ compliance with the Conditions of Participation. They may be found at www.cms.
gov/Regulations-and-Guidance/Guidance/Manuals/Internet-Only-Manuals-IOMs.html (click
on Publication 100-07, “State Operations Manual, then “Appendices Table of Contents”).
There are several appendices that hospitals will find useful, for example, A (hospitals), AA
(psychiatric hospitals), V (EMTALA), and W (critical access hospitals).
A federal law must be obeyed throughout the United States, including in California, unless the
federal law expressly states otherwise. As a general rule, if a federal law conflicts with a state
law, the federal law prevails, unless the federal law expressly states otherwise.
If there is no conflict, such as when one law is stricter but they don’t actually conflict with
each other, both laws generally must be followed. For example, under the Health Insurance
Portability and Accountability Act of 1996 (HIPAA), the federal law states that providers must
conform to whichever provision of federal or state law provides patients with greater privacy
protection or gives them greater access to their medical information.
CHA Record and Data Retention Schedule 2018
76
©CALIFORNIA HOSPITAL ASSOCIATION
STATE LAW
A state statute is written by a California Senator or Assembly Member. It is voted on by
the California Senate and Assembly, and then signed by the Governor. A state statute is
referenced like this: Civil Code Section 56 or Health and Safety Code Section 819. State
statutes may be found at www.leginfo.legislature.ca.gov. Proposed laws (Assembly Bills and
Senate Bills) may also be found at this website.
A state regulation is written by a state agency such as the California Department of Public
Health or the California Department of Managed Health Care. A short description of the
proposed regulation is published in the California Regulatory Notice Register, more commonly
called the Z Register, so that the general public and lobbyists may request a copy of the
exact text of the proposed regulation and comment on it. The state agency must summarize
and respond to each comment it receives on the proposed regulation. The agency may or
may not make changes to the proposed regulation based on the comments. A notice that the
final regulation has been officially adopted is also published in the Z Register. The Z Register
may be found at www.oal.ca.gov/notice_register.htm.
A state regulation is referenced like this: Title 22, C.C.R., Section 70707. “C.C.R.”
stands for “California Code of Regulations.” State regulations may be found
at https://govt.westlaw.com/calregs/Search/Index.
A state law must be obeyed in California only. As a general rule, if a California law conflicts
with a federal law, the federal law prevails, unless the federal law expressly states otherwise.
(If there is no conflict, such as when one law is stricter but they don’t actually conflict with
each other, both laws generally must be followed.)
