The short answer
State law sets the retention period, not HIPAA. Most states require five to ten years after the last patient contact for adults, and longer for minors — often until several years past the age of majority. HIPAA itself imposes no medical record retention period, but 45 CFR 164.530(j)(2) requires six years for required HIPAA documentation such as authorizations and policies.
Does HIPAA set a retention period for charts?
No, and this is the most common misunderstanding in the industry. The HIPAA Privacy Rule does not tell you how long to keep a medical record. What it does require, at 45 CFR 164.530(j)(2), is that a covered entity retain the documentation the Rule itself demands — policies and procedures, notices of privacy practices, signed authorizations, complaint records, business associate agreements, training logs and risk analyses — for six years from the date of creation or the date it was last in effect, whichever is later.
So a signed HIPAA marketing authorization for a before-and-after photo has a federal six-year floor. The clinical chart it sits next to is governed by your state.
What do individual states require?
| State | Adult records | Authority |
|---|---|---|
| Texas | 7 years from the date of last treatment | Texas Medical Board, 22 TAC § 165.1 |
| Florida | 5 years from the last patient contact for physicians | Florida Board of Medicine rule, 64B8-10.002 F.A.C. |
| New York | At least 6 years for licensed professionals | NYS Board of Regents rules of professional conduct |
| California | No single statute for private physician offices; the Medical Board of California advises keeping records well beyond the malpractice limitations period, and Health and Safety Code section 123145 requires licensed clinics to retain records 7 years | Medical Board of California |
Minors are treated separately almost everywhere. Texas requires retention until the patient reaches 21 or for seven years from last treatment, whichever is longer. New York's rule for minors extends past the age of majority. The practical rule is to hold a minor's chart until at least three years past the age of majority, then apply the adult period on top.
Two other clocks can outrun the board rule. Your state's statute of limitations for malpractice and battery claims — often with a discovery rule that delays accrual — and, if you ever bill any federal program, the federal False Claims Act reach-back. Where the clocks disagree, keep the record for the longest one.
What counts as the record in a med spa?
More than you think. Alongside the chart note and the signed consents: the good faith exam note and patient-specific order, product lot and expiration logs, device settings and treatment parameters for lasers and energy devices, before-and-after photographs, adverse event reports, and the intake and health history. Clinical photographs are part of the designated record set when they are used to make treatment decisions, which means they are subject to the patient's right of access under 45 CFR 164.524 and must be retained accordingly.
Text messages and messaging-app threads that contain clinical content are records too. If a patient texts a photo of post-treatment swelling and your injector responds with clinical advice, that exchange belongs in the chart, not only on someone's phone.
What this means for your paperwork
Write a single retention schedule and put it in your policies and procedures manual. It should name your state's rule with the citation, state the adult period, state the minor period, state the six-year HIPAA documentation floor separately, and list every record category you actually generate — including photographs, device logs and messaging threads.
Then write the destruction half of the policy, because retention without a disposal rule creates its own liability. Specify the method — shredding for paper, documented secure deletion for electronic media — require a destruction log listing what was destroyed, when and by whom, and make clear that no record under legal hold, board inquiry or pending complaint is ever destroyed on schedule.
Finally, put retention terms in every vendor contract. If your EMR, photo storage or marketing platform holds protected health information, the business associate agreement should say what happens to that data at termination and how long the vendor keeps backups.
Related questions
This answer is educational and is not legal or medical advice. Requirements vary by state and change over time — verify with your own legal and clinical advisors before applying anything here in practice.