How Long Should a Chiropractic Practice Keep Patient Records?

A chiropractic office may have years-old charts, diagnostic images, billing files, and records in older software. Owners and administrators need to know when each can be archived or considered for secure destruction, and how to retrieve it later.

Those records may follow different rules. State chiropractic requirements, patient age, payer terms, or practice closure can change the period or its start date. This guide shows how to identify the applicable rules and build a working schedule for medical record retention. HIPAA's six-year documentation rules apply to specific documentation, not patient charts.

How Long Must Chiropractors Keep Patient Records?

There is no single national retention period for chiropractic patient records. The applicable period depends on state and professional requirements, patient age, record type, payer terms, and other obligations. The HIPAA Privacy Rule does not set a general patient-chart deadline, as HHS explains. Check the current rules for each practice location, then calculate from the specific event named in the rule. Treat the end of a minimum period as a review date, not automatic permission to destroy a record.

Start with the rule that applies to your practice

Begin with the state where care was provided and the professional license under which it was delivered. Find the current chiropractic board rule and any state statutes or regulations covering medical records, access, minors, and practice closure. Use the official board or legislature source, record its current version or effective date, and save a copy or link with your policy. A practice in more than one state should keep a separate schedule row for each jurisdiction.

Read the rule for the record group it covers. Clinical notes, diagnostic images, intake forms, referrals, and correspondence may share a requirement or follow separate provisions. Record the exact trigger, such as last care, discharge, or a patient's age, instead of calculating from a general “last seen” date by default.

Patient charts and images

State and professional rules are the starting point for clinical charts and images. Check whether the rule covers former patients, minors, or records after closure; access, custody, and notice duties may also apply. A blank schedule field means the local requirement still needs verification.

HIPAA documentation

HIPAA's documentation periods are separate from patient-chart retention. The Privacy Rule requires certain documentation to be kept for six years from its creation or the date it was last in effect, whichever is later, under 45 CFR 164.530(j). Security Rule documentation has a similar six-year clock under 45 CFR 164.316(b). These rules apply to documentation required by those provisions, not to every patient chart.

HIPAA also requires policies and procedures for final disposition of electronic protected health information and reuse of media under 45 CFR 164.310(d)(2). The regulation does not prescribe one destruction method for every device or storage medium; follow the applicable rule and the practice's approved technical process.

Payer, billing, and program records

A chart-retention rule does not answer how long to keep every claim, remittance, authorization, or program record. Check the contract and current manual for each payer or program, along with any applicable state or federal requirement. Record the source and event that starts the period. Do not assign a payer or billing duration until the applicable terms have been verified.

Practice closure and vendor-held copies

Closing a practice can change custody and access responsibilities or trigger board and notice duties. Check current rules and name a records custodian before closure. Inventory vendor-held charts, exports, archives, and residual copies; backup arrangements do not replace the practice's review.

When a vendor is acting as a HIPAA business associate, the business-associate agreement must require return or destruction of protected health information at termination when feasible. If that is infeasible, the agreement must extend privacy and security protections and limit further uses or disclosures to the purpose that makes return or destruction infeasible, as described in 45 CFR 164.504(e)(2)(J) and HHS guidance. Review the actual agreement and service terms before a transition.

What a Florida example can show

Florida illustrates why a schedule needs both a retention period and a trigger. Florida Administrative Code Rule 64B2-17.006 provides a chiropractic-specific minimum of at least four years for records in an active practice, measured from the last date of patient care. The rule also addresses practice termination or death, so the active-practice period is not a complete closure plan. The official rule record identifies the adopted version as effective April 23, 2023. Because the rule text is not viewable in the official portal, a qualified Florida attorney or compliance professional should confirm the current wording and application before publication or practice use.

If a Florida patient's last appointment was February 10, 2025, the four-year minimum reaches February 10, 2029. This is an earliest review date, not permission to destroy the chart; a minor-patient rule, payer obligation, access duty, open matter, or custody requirement may change the decision.

A retention schedule you can adapt

Put the schedule into practice

1. Define the scope. List locations, licenses, and record groups, including paper charts, images, billing files, correspondence, and HIPAA documentation.
2. Inventory records and copies. Include active systems, scanned and paper files, archives, exports, backups, and vendor copies. Retention and retrieval are separate: note location, authorized access, retrieval method, and whether archived or exported files remain usable. Assign retrieval responsibility after a vendor change or closure.
3. Verify primary sources. Check the current board rule and relevant statutes for each jurisdiction. Save the source, version, record class, and exact trigger for each schedule row.
4. Separate requirements. Give charts, HIPAA documentation, payer or program files, and other groups separate rows when rules differ. Do not transfer a period between groups.
5. Check exceptions and holds. Before review, check for minors, closure, access requests, audits, complaints, claims, investigations, and legal holds. Pause routine destruction if preservation may be required and ask qualified counsel or compliance staff what to keep.
6. Assign ownership and approval. Name who maintains sources, checks dates and overlays, and authorizes disposition. Revisit the policy when the practice changes location, license, payer, or storage vendor.
7. Document authorized disposition. After approval, follow applicable requirements and the approved secure-disposition process. Record the records, authority, date, approver, and method. Confirm vendor-copy handling at service end.

How Practice Management Software Supports Record Retention

An EHR or practice-management system can support organized patient information and routine retrieval. ChiroTouch describes its platform as connecting EHR, billing, scheduling, and intake, and its product overview lists access to schedules, charts, and patient details. These tools can support day-to-day record workflows, but the practice still needs to determine the applicable retention rule and who may approve destruction. For archived records or a vendor transition, confirm the retrieval, export, access, and contract terms that apply to the specific product and plan.

A dependable policy starts with knowing which rule applies to each record and what event starts its clock. A clear schedule, usable access path, and review before disposition help the practice manage records over time. Revisit the policy when rules, practice locations, or technology change.

This article provides general information, not a complete state-specific retention policy. A qualified attorney or compliance professional must confirm applicable rules and the Florida example before publication or practice use. Do not authorize destruction based on this article alone.

‍