Dental record retention: the several clocks that run at once, and the five states whose rules were read here

What it says#

There is no single dental record retention period, and there is no federal one for the chart. There are at least three different clocks running in every practice at the same time, each attached to a different kind of record, and the number most offices quote belongs to the wrong one.

Start with the one everybody has heard. The HIPAA Security Rule, at 45 CFR 164.316(b)(2)(i), requires a covered entity to "retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later." Paragraph (b)(1) is the security policies and procedures themselves, plus a written record of any action, activity or assessment the subpart requires to be documented. The Privacy Rule says the same thing about its own paperwork at 45 CFR 164.530(j)(2): six years for the policies and procedures, for any communication the subpart requires in writing, and for any action, activity or designation the subpart requires to be documented. That is the notice of privacy practices, the authorizations, the business associate agreements, the risk analysis, the training log and the complaint file. It is not the chart.

Nothing in the Privacy Rule tells a dentist how long to keep a patient's clinical record. The closest the rule comes is the right of access at 45 CFR 164.524(a)(1), which gives the individual the right to inspect and copy protected health information in a designated record set "for as long as the protected health information is maintained in the designated record set." That is a rule about access while you have the record. It sets no floor, and it does not stop the clinical clock from being set somewhere else.

Where it is set is the state. Five states' rules were read directly for this entry, and they do not agree. Florida's Board of Dentistry rule, Fla. Admin. Code R. 64B5-17.002(4), requires a dentist to keep the written dental record "for a period of at least four (4) years," calculated from the date the patient was last examined or treated, and subsection (5) puts the appointment book on the same four-year clock. Arizona's statute, A.R.S. 32-1264(E), requires six years after the last date an adult patient received dental services. New York reaches the same period through the Regents' unprofessional conduct rule, 8 NYCRR 29.2(a)(3): "all patient records must be retained for at least six years." Washington's dental rule, WAC 246-817-310(1), says a licensed dentist "shall keep readily accessible patient records for at least six years from the date of the last treatment." Minnesota is the longest of the five: Minn. R. 3100.9600, subp. 12, requires seven years beyond the last date of treatment for an inactive adult file, and for an active file the dentist "must maintain the patient's entire dental record."

The minor clock is a separate rule, it is longer where it exists, and it does not exist everywhere. Arizona keeps a child's record for at least three years after the eighteenth birthday or at least six years after the last date of service, whichever occurs later. New York requires records of minor patients to be kept at least six years "and until one year after the minor patient reaches the age of 21 years," which in practice means age 22. Minnesota keeps a minor's inactive file until the patient is 25. Washington's rule states six years from last treatment and no minor extension. Florida's rule sets four years and no minor extension.

The third clock is not a patient record at all. Under 29 CFR 1910.1020(d)(1)(i), an employer must preserve each employee medical record "for at least the duration of employment plus thirty (30) years," with a narrow carve-out for employees of less than one year whose records are handed to them on termination. The bloodborne pathogens standard repeats it at 29 CFR 1910.1030(h)(1)(iv) for hepatitis B vaccination status and post-exposure follow-up, and then sets a much shorter clock beside it: bloodborne training records are kept three years from the date of the training, under 1910.1030(h)(2)(ii). See the entry on the bloodborne pathogens standard, osha-bloodborne-pathogens-1910-1030, for what those files contain.

Selling or closing changes custody, not the clock. OSHA is explicit: under 29 CFR 1910.1020(h)(1), an employer ceasing to do business "shall transfer all records subject to this section to the successor employer," and where there is no successor, must notify affected employees of their access rights at least three months before the business ends. HIPAA treats the transaction itself as a health care operation, since the definition at 45 CFR 164.501 includes "the sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity." The states add duties of their own. Florida Statutes 456.058 orders each board to write a disposition rule with a floor of two years, and the Board of Dentistry went well past it: under 64B5-17.001, records of a dentist who terminates or relocates must be kept and made available to patients for four years from the last examination or treatment, with a patient notice published in the county's largest newspaper or posted prominently on the practice website weekly for four consecutive weeks; on a dentist's death, the estate has 90 days to place the records with another Florida licensed dentist, who holds them for four years. Arizona's 32-1264(H) requires a dentist who retires or sells, or a business entity that closes or sells, to "take reasonable measures to ensure that the patient records are retained." Minnesota requires transfer under Minn. Stat. 144.291 to 144.298 "irrespective of the status of the patient's account."

Who it applies to#

The HIPAA clocks apply to every dental practice that is a covered entity, which is nearly every practice that bills electronically. The OSHA clock applies to every practice with employees, whether or not it bills anything.

The state clinical clock applies to the licensee, and in some states to the owner specifically. Florida's rule puts the records in the hands of the owner dentist, who "shall be ultimately responsible for all record keeping requirements set forth by statute or rule," including for patients seen by an employee, associate or visiting dentist. Arizona flips the emphasis the other way at 32-1264(F): a licensee who is an associate or employee "is not responsible for storing or retaining medical records but shall compile and record the records in the customary manner." If you own the building and the software, you own the retention problem.

It does not apply the same way anywhere else. Forty-five states were not read here, and this entry publishes no number for any of them. Texas and Illinois were both attempted and neither site answered from this environment, so neither appears above. None of this is legal advice.

What changed#

First edition for this directory. In the law, the federal side has been stable: 164.316 has read the same since the Security Rule was published on February 20, 2003, and the employee medical record rule has carried the duration of employment plus 30 years since the 1988 standard. The state side keeps moving. Florida rewrote 64B5-17.002 effective October 30, 2023 to cover teledentistry encounters and to spell out how an entry may be corrected, and amended 64B5-17.001 on June 25, 2024 so that the closure notice may run on the practice website rather than only in a newspaper. Washington amended WAC 246-817-310 effective April 17, 2016 to fold in chapter 70.02 RCW and HIPAA.

What has not changed is the misconception. Six years is a HIPAA documentation number. Applying it to charts is either too long or too short depending on the state you practice in, and in New York, Arizona and Minnesota it is far too short for a child.

Where the source is#

Every rule quoted above was read from the issuing government's own site in this session. The two federal rules came from eCFR: 45 CFR 164.316, 164.524 and 164.530 in title 45, and 29 CFR 1910.1020 and 1910.1030 in title 29, both retrieved through the eCFR service and linked above at their public pages. The Florida rules are the Department of State's official Florida Administrative Code text on flrules.org, in the version effective October 30, 2023 for 64B5-17.002 and the version amended June 25, 2024 for 64B5-17.001; Florida Statutes 456.058 is on the Florida Legislature's site. Arizona Revised Statutes 32-1264 is on azleg.gov. Minnesota Rules 3100.9600 is on the Office of the Revisor of Statutes site. The New York rule is Part 29 of the Rules of the Board of Regents, on the State Education Department's Office of the Professions site; the retention sentence sits in section 29.2(a). Washington's WAC 246-817-310 and RCW 70.02.160 are on the state legislature's site. All are public documents. Two states did not answer: the Texas Administrative Code has moved to a portal that would not serve the rule text, and the Illinois General Assembly site refused every request, so no Texas or Illinois period is reported here. Rules change, five states are not fifty, and nothing on this page is legal advice.