Record Retention Requirements

How Long Must You Keep Therapy Records?

Record retention requirements for therapists vary by state, but the general standard is:

• Adult clients: 7-10 years after the last date of service
• Minor clients: Until the client reaches the age of majority plus the standard adult retention period (often until age 25-28)
• Medicare/Medicaid clients: Minimum 6 years from the date of service or cost report

Your state licensing board sets the specific requirement. When federal and state requirements differ, follow whichever is longer.

What Must Be Retained

All clinical records, including:

• Informed consent documents
• Initial intake assessments
• Treatment plans and updates
• Progress notes and session documentation
• Termination notes and discharge summaries
• Correspondence related to treatment
• Billing records and insurance documentation
• Risk assessments and safety plans
• Authorisation forms and releases of information

Psychotherapy notes kept separately from the clinical record are also subject to retention requirements.

Secure Storage

Electronic Records

• Use encrypted, HIPAA-compliant storage with access controls
• Maintain regular backups in a secure secondary location
• Ensure your practice management software provider has a data retention policy and Business Associate Agreement
• See our HIPAA compliance guide for detailed security requirements

Paper Records

• Store in locked, fire-resistant cabinets
• Limit access to authorised personnel
• Maintain a log of who accesses records

Secure Destruction

When the retention period expires:

• Paper records: Cross-cut shredding by a certified destruction service
• Electronic records: Certified data wiping or physical destruction of storage media
• Document the destruction: Maintain a log of what was destroyed, when, and by what method

After Practice Closure

If you close your practice or retire, you remain responsible for client records until the retention period expires. Options include transferring custody to a trusted colleague, using a records custodian service, or secure storage at a records management company. Notify former clients of the arrangement.