How long addiction treatment records are kept depends on state law, program type, payer requirements, professional rules, and the treatment organization’s retention policy. HIPAA protects records while they are maintained, but HHS specifically states that the HIPAA Privacy Rule does not set a medical-record retention period.
Does HIPAA require records to be kept for a certain number of years?
No. HHS states that HIPAA does not require covered entities to retain patient medical records for a specific length of time. State laws and other applicable requirements generally determine retention periods.
What does California require for some addiction treatment programs?
California Department of Health Care Services certification standards for alcohol and other drug programs require certified programs covered by those standards to retain client records for at least three years after termination of services. Different facility types, licenses, contracts, or professional rules may impose different or longer requirements.
That means a three-year period should not be treated as a universal rule for every California health care record.
Are records destroyed as soon as the minimum period ends?
Not necessarily. A program may keep records longer because of organizational policy, contracts, insurance requirements, litigation holds, accreditation rules, professional licensing obligations, or other legal requirements.
Does 42 CFR Part 2 set a retention period?
Part 2 primarily governs confidentiality and disclosure of protected substance use disorder records. It does not create one universal record-retention period for every treatment program. Records that remain in existence must still be handled consistently with applicable privacy protections.
Can I still request old records?
Yes, if the provider still maintains them. HIPAA gives patients a right to access protected health information in a designated record set for as long as the covered entity or its business associate maintains that information, subject to limited exceptions.
See Trinity Behavioral Health’s guide on getting copies of addiction treatment records after discharge.
What happens when records are destroyed?
HIPAA requires covered entities to use appropriate safeguards when disposing of protected health information. Paper records should not be discarded in a way that exposes identifiable information, and electronic records require appropriate disposal practices as well.
Why should I request important records sooner rather than later?
If you may need a discharge summary, medication history, billing information, or treatment documentation for a new provider, legal matter, disability claim, or personal records, it can be helpful to request it while the program is still clearly within its retention period.
Frequently asked questions
Does HIPAA require records to be kept for six years?
HIPAA has six-year retention rules for certain HIPAA-required documentation, but that is not the same as a universal six-year medical-record retention requirement.
Can a rehab keep records longer than the minimum?
Yes. Minimum retention periods do not necessarily require destruction at the first possible date.
Can I force a provider to recreate a record that was lawfully destroyed?
No. The HIPAA right of access applies to information the covered entity still maintains.
How long does Trinity Behavioral Health keep records?
Current Trinity-specific retention policy should be confirmed directly with the program’s records or privacy contact rather than inferred from a general legal minimum.
Authoritative sources
- HHS: HIPAA and Medical Record Retention
- California DHCS: Certification Standards for Alcohol and Other Drug Programs
- HHS: Disposal of Protected Health Information
This article provides general records information, not legal advice. Retention periods can vary by program type and applicable law.