Is It Illegal to Delete Medical Records in the US 2026

Deleting medical records is illegal in most circumstances, and doing so intentionally to cover up malpractice or obstruct a legal proceeding is a federal crime that can result in prison time. The legality depends entirely on who is deleting them, when, and why.

HIPAA requires healthcare providers to retain medical records for specific periods, and deleting them before those periods expire violates federal law. But the consequences get far more serious when records are deleted to interfere with litigation or regulatory audits. That’s when federal criminal statutes come into play.

Patients have limited rights to request changes to their records but generally cannot demand deletion. Providers who routinely destroy records after the required retention period are acting legally, provided they follow proper destruction protocols.

A closely related topic: Is It Illegal to Fly Another Country’s Flag in America? 2026

This article explains every legal angle: the HIPAA rules, retention requirements by state, criminal penalties, patient rights, and what courts do when records go missing during litigation.

Is It Illegal to Delete Medical Records in the United States

Deleting medical records is illegal in the United States when done before the legally required retention period expires, without following proper destruction procedures, or with intent to obstruct legal proceedings or hide negligent care. The legality of deletion depends entirely on when it happens, who does it, and why.

Healthcare providers covered by HIPAA must retain medical records for at least six years from the date of creation or from the date when the record was last in effect, under 45 C.F.R. § 164.530(j). Deleting records before that minimum period ends is a HIPAA violation subject to civil penalties.

State laws impose additional retention requirements that often exceed HIPAA’s federal minimum. A provider who deletes records in compliance with HIPAA’s six-year minimum may still violate a state law requiring ten years of retention, creating separate state-level liability.

Quick Facts:

• HIPAA minimum retention: 6 years from creation or last effective date (45 C.F.R. § 164.530(j))
• Deleting before minimum period: HIPAA civil violation; penalties up to $1.9 million per violation category
• Deleting to obstruct litigation or hide malpractice: federal criminal offense under 18 U.S.C. § 1519
• Patient requests for deletion: HIPAA provides right to restrict, not delete
• Routine destruction after retention period: legal when using proper methods

Who Can Legally Delete Medical Records Under Federal Law

Under federal law, only the covered entity that created or maintains the records can authorize their deletion or destruction, and that authorization only becomes appropriate after the legally required retention period has elapsed. No individual physician, administrator, or patient has unilateral authority to delete records outside this framework.

A covered entity under HIPAA is a healthcare provider, health plan, or healthcare clearinghouse that transmits health information electronically. Covered entities can also authorize their business associates (third-party vendors with access to PHI) to destroy records on their behalf, but only when the retention period has passed and when proper destruction procedures are followed.

Improper deletion by any employee, including system administrators, IT staff, or clinical staff, creates liability for the covered entity. The entity is responsible for its workforce’s actions. An employee who deletes records without proper authorization exposes the employer to HIPAA penalties even if the employer didn’t direct the deletion.

Who has authority over medical record deletion:

Any deletion outside this framework creates legal exposure, even when the person deleting the record believes they had a legitimate reason for doing so.

HIPAA Rules on Deleting Patient Medical Records

HIPAA does not authorize the deletion of medical records during the required retention period under any normal operational circumstance. The HIPAA Privacy Rule at 45 C.F.R. § 164.530(j) requires covered entities to retain required documentation for six years from creation or the date it was last in effect, whichever is later. This retention obligation applies to the documentation of HIPAA policies and procedures, but courts and regulators routinely treat it as part of the broader obligation to maintain patient records.

The HIPAA Security Rule at 45 C.F.R. § 164.310(d)(2) requires covered entities to implement policies and procedures addressing the final disposition of electronic protected health information (ePHI) and the hardware or electronic media it’s stored on. This means deletion must be done through approved, documented processes, not ad hoc erasure.

HIPAA also requires that when deletion does occur at the end of the retention period, it must render the PHI unreadable, undecipherable, and otherwise cannot be reconstructed. Simply pressing delete on a file doesn’t satisfy this requirement. Proper electronic destruction includes overwriting, degaussing, or physical destruction of the storage media.

HIPAA deletion requirements summary:

• No deletion of records during the required retention period
• After retention period: deletion must render PHI unreadable and unrecoverable
• Electronic media: overwriting, degaussing, or physical destruction required
• Physical records: cross-cut shredding or incineration required
• Documentation: destruction must be documented with a certificate of destruction
• Business associates: must comply with covered entity’s destruction policies

Key Takeaway: HIPAA prohibits deletion of medical records during the required retention period and requires that when records are eventually destroyed, the process must render PHI completely unrecoverable and must be formally documented.

How Long Must Doctors and Hospitals Keep Medical Records

The minimum federal retention period for medical records under HIPAA is six years from the date of creation or the date the record was last in effect, under 45 C.F.R. § 164.530(j). However, state laws frequently impose longer retention requirements that override this federal minimum.

Most states require adult patient records to be retained for 7 to 10 years. Some states extend this to 10 years for specific record types or for records related to minors (often until the minor reaches adulthood plus the standard retention period). Medicare and Medicaid providers face additional federal requirements: CMS requires Medicare records to be retained for 10 years.

For pediatric records, most states require retention until the patient reaches age 18 plus the standard adult retention period (often 7 to 10 years), meaning a record created for a 2-year-old must sometimes be kept until the patient is 25 or 28. This longer period accounts for the extended malpractice statute of limitations that applies to minors in most states.

Medical record retention requirements by federal program:

Deleting records before these periods expire creates liability under the applicable federal program rules on top of any HIPAA violation.

Medical Record Retention Requirements by State

State medical record retention laws vary significantly and often exceed the federal HIPAA minimum. Healthcare providers operating in states with longer retention requirements must comply with the more restrictive state standard, not just HIPAA’s six-year baseline.

California Health and Safety Code § 123111 requires patient records to be retained for a minimum of 10 years from the date of service. Texas Health and Safety Code § 241.103 requires hospital records to be maintained for 10 years following the date of service. New York Education Law § 6530 requires physician records to be maintained for 6 years from the date of service or 3 years after the patient reaches majority, whichever is longer.

State medical record retention requirements (selected states):

Deleting records before the applicable state retention period expires creates both HIPAA liability and state regulatory liability, including potential actions by state medical licensing boards.

HIPAA Violation Penalties for Deleting Medical Records

HIPAA civil penalties for improper deletion of medical records are tiered based on the covered entity’s knowledge and intent, ranging from $100 to $50,000 per violation with annual caps up to $1.9 million per violation category. The HITECH Act of 2009 (42 U.S.C. § 17934) significantly increased these penalties and strengthened enforcement.

The four-tier civil penalty structure under HITECH applies based on culpability:

These penalties are assessed per violation category per year. A single incident of improper record deletion that affects thousands of patients can result in penalties that quickly reach the annual cap. The Office for Civil Rights (OCR) at the Department of Health and Human Services enforces these penalties.

Beyond financial penalties, OCR can require covered entities to implement corrective action plans, subject them to ongoing monitoring, and refer willful violators to the Department of Justice for criminal prosecution.

Criminal Charges for Illegally Deleting Medical Records

Criminal charges for illegally deleting medical records are possible when the deletion involves intent to obstruct justice, defraud a federal program, or cover up illegal conduct. Multiple federal statutes create criminal exposure in these scenarios.

18 U.S.C. § 1519, part of the Sarbanes-Oxley Act, makes it a federal crime to knowingly alter, destroy, mutilate, conceal, or cover up any record or document with intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of a federal department or agency. Healthcare investigations by HHS, Medicare audits, and fraud investigations all qualify. Penalties include up to 20 years in federal prison.

18 U.S.C. § 1347 (healthcare fraud) applies when records are deleted as part of a scheme to defraud Medicare, Medicaid, or any other federal healthcare program. Healthcare fraud carries up to 10 years in prison per count, increasing to 20 years if serious bodily injury results and life imprisonment if death results.

Federal criminal statutes for medical record deletion:

Deleting Medical Records to Hide Malpractice or Obstruct Litigation

Deleting medical records to conceal medical errors, hide malpractice evidence, or obstruct a patient’s ability to pursue a legal claim is one of the most serious medical record violations under both federal and state law. This conduct simultaneously violates HIPAA, triggers federal criminal statutes, and creates significant civil liability in malpractice litigation.

When a provider discovers a medication error, surgical complication, or other adverse event and then deletes or alters records related to that event before a patient can obtain them, that action constitutes obstruction and evidence tampering. Federal investigators and plaintiffs’ attorneys specifically look for discrepancies between original records and later versions, and deletion often leaves audit trail evidence that forensic examination can detect.

Something similar worth reading: Is It Illegal to Get a Happy Ending? 2026 State Laws

State medical licensing boards treat deliberate record alteration or destruction as a ground for license revocation independent of any criminal prosecution. A physician who deletes records to hide malpractice faces license suspension, civil damages in the malpractice case, and potential criminal charges, all arising from the same act.

Consequences of deleting records to hide malpractice:

• HIPAA civil penalty: up to $1.9 million per violation category per year
• Federal criminal charge (18 U.S.C. § 1519): up to 20 years in prison
• State medical board action: license suspension or revocation
• Civil malpractice damages: spoliation creates adverse inference; jury assumes deleted records were unfavorable
• Punitive damages: deliberate concealment supports punitive damage awards in civil cases

Key Takeaway: Deleting medical records to conceal malpractice creates simultaneous exposure to federal criminal prosecution, HIPAA civil penalties, state medical board discipline, and devastating civil consequences including the loss of the right to a fair trial defense.

Spoliation of Medical Records in a Lawsuit

Spoliation of evidence refers to the destruction, alteration, or failure to preserve evidence that a party knew or should have known would be relevant to litigation. When medical records are destroyed after a lawsuit is filed or reasonably anticipated, courts treat the destruction as spoliation and impose serious sanctions.

The most powerful sanction for medical record spoliation is an adverse inference instruction to the jury. Under this instruction, the judge tells the jury that they may presume the destroyed records contained information unfavorable to the party who destroyed them. In a medical malpractice case, this effectively tells the jury that the provider’s deleted records contained evidence of negligence.

Courts have dismissed entire cases, entered default judgments against the spoliating party, and excluded key expert witnesses as sanctions for medical record destruction. The Federal Rules of Civil Procedure Rule 37(e) specifically addresses electronically stored information (ESI) spoliation and authorizes adverse inference instructions or dismissal when records are destroyed with intent to deprive the opposing party of the information.

Spoliation sanctions courts can impose:

• Adverse inference instruction: jury may assume deleted records were unfavorable
• Dismissal of the defendant’s defenses: preventing the provider from defending the case
• Default judgment: entering judgment in the plaintiff’s favor without a trial
• Monetary sanctions: fines paid to the opposing party for costs of discovering the deletion
• Expert exclusion: barring the spoliating party’s expert witnesses from testifying

The litigation hold obligation begins when a lawsuit is filed or when litigation is reasonably anticipated. Deleting records after receiving a demand letter from a patient’s attorney, for example, can constitute spoliation even before a formal lawsuit is filed.

HITECH Act and Medical Record Deletion Penalties

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009 as part of the American Recovery and Reinvestment Act (42 U.S.C. § 17934), dramatically strengthened HIPAA enforcement specifically regarding electronic medical records. The HITECH Act established the tiered penalty structure described earlier and expanded enforcement authority.

HITECH also created the Breach Notification Rule, which requires covered entities to notify affected patients, HHS, and in some cases the media when unsecured PHI is improperly disclosed or destroyed. An improper deletion of medical records that affects 500 or more individuals in a state or jurisdiction must be reported to prominent media outlets in addition to HHS and the affected patients.

HITECH imposed audit trail requirements that make improper record deletion harder to conceal. Electronic health record systems must maintain comprehensive logs of access and modification, and these audit trails are preserved separately from the records themselves. Even when records are deleted, the audit trail showing who accessed and deleted them typically remains, creating evidence of the deletion.

HITECH Act key provisions for medical record deletion:

• Tiered penalty structure: up to $1.9 million per violation category per year
• Breach notification: deletion of unsecured PHI affecting 500+ must be publicly reported
• Audit trail requirements: EHR systems must log all access and modification
• State attorney general enforcement: HITECH gave states authority to pursue HIPAA violations
• Business associate direct liability: business associates face HIPAA penalties directly, not just through covered entities

State attorneys general received new authority under HITECH to bring civil actions on behalf of state residents for HIPAA violations, including improper record deletion. This creates a second enforcement pathway beyond federal OCR enforcement.

Can Patients Request Deletion of Their Medical Records

Patients cannot demand the deletion of their medical records under HIPAA. HIPAA provides patients with rights to access, copy, and request amendment of their records, but it does not include a right to require deletion. This distinguishes US healthcare privacy law from the European Union’s GDPR, which includes a “right to be forgotten.”

What patients can do under HIPAA’s 45 C.F.R. § 164.522 is request a restriction on certain uses and disclosures of their PHI. A covered entity may, but is not required to, agree to the restriction (with one exception: providers must agree to a restriction when the patient has paid out-of-pocket in full and requests that the information not be disclosed to their health plan). Even agreed-upon restrictions do not require deletion of the underlying records.

Patients also have the right to request an amendment to records they believe are inaccurate or incomplete under 45 C.F.R. § 164.526. The covered entity must respond within 60 days. If they deny the amendment request, the patient can submit a statement of disagreement that is appended to the record. This right to amend is distinctly different from a right to delete.

Patient rights regarding medical records under HIPAA:

HIPAA Right to Amend Versus Delete Medical Records

The HIPAA right to amend and the concept of deletion are fundamentally different, and understanding the distinction helps both patients and providers avoid confusion about what the law requires.

Amending a medical record means adding to or correcting it, not erasing the original entry. When a provider accepts an amendment request, they typically add a note or correction to the record while preserving the original entry. The original documentation remains as part of the record’s history. This approach protects the integrity of the medical record as a historical document while allowing for corrections.

Deletion, by contrast, removes information entirely. HIPAA does not contemplate deletion as a patient right because medical records serve multiple purposes beyond the individual patient relationship: they support continuity of care across providers, support public health surveillance, and serve as evidence in legal proceedings. Allowing patients to delete records would compromise all of these functions.

Amendment vs. deletion compared:

Providers who receive patient requests for record deletion should document the request, explain in writing that HIPAA does not provide a deletion right, and offer the amendment and restriction rights that HIPAA does provide.

Key Takeaway: Patients have no right under HIPAA to delete their medical records; they can request amendments to inaccurate entries and restrictions on certain disclosures, but the underlying records must be maintained for the full retention period regardless of patient preference.

What Happens When Medical Records Are Destroyed After the Retention Period

Routine destruction of medical records after the required retention period has expired is legal and in fact required as part of proper PHI management. However, even legal destruction must follow specific procedures to avoid HIPAA violations related to the method of destruction.

When the retention period ends, covered entities must use methods that render PHI unreadable and unrecoverable. The HHS Office for Civil Rights specifically identifies acceptable destruction methods: for paper records, cross-cut shredding or incineration; for electronic media, clearing, purging, or physical destruction of the media. Simply deleting a file or formatting a drive does not meet the HIPAA standard for secure destruction.

Along the same lines: Is It Illegal to Walk Around Without ID? 2026 Laws

Covered entities must maintain a record of what was destroyed, when, and how. A destruction log or certificate of destruction serves as documentation that the disposal was done properly and at the appropriate time. This documentation protects the covered entity if questions arise later about whether records were destroyed prematurely.

Legal post-retention-period destruction requirements:

• Paper records: cross-cut shredding or incineration required
• Electronic records: clearing, purging (e.g., degaussing), or physical media destruction
• Simple deletion: not sufficient; data remains recoverable and creates HIPAA exposure
• Document destruction: maintain a destruction log with date, method, and records destroyed
• Third-party destruction: requires business associate agreement; vendor must certify destruction
• Verification: covered entity retains ultimate responsibility even when using a vendor

Can a Hospital or Doctor Face Criminal Prosecution for Deleting Records

Yes, a hospital or doctor can face federal criminal prosecution for deleting medical records in specific circumstances, primarily when the deletion is intended to obstruct a federal investigation, defraud a federal healthcare program, or conceal evidence of patient harm.

The Department of Justice’s Health Care Fraud Prevention and Enforcement Action Team (HEAT) actively investigates healthcare fraud, and evidence destruction is a common component of these cases. DOJ prosecutes physicians, hospital administrators, and billing staff who destroy records to obstruct Medicare and Medicaid audits or federal investigations.

Individual physicians can be prosecuted personally under 18 U.S.C. § 1519 even if they claim they were following hospital policy when deleting records. The statute applies to any person who destroys records with obstruction intent, and the employer’s policy does not provide a legal defense to individual criminal liability.

Criminal prosecution scenarios for medical record deletion:

• Doctor deletes records before Medicare audit: 18 U.S.C. § 1519 (obstruction); up to 20 years
• Hospital destroys billing records during fraud investigation: 18 U.S.C. § 1519 + § 1347
• Staff member deletes records after patient files complaint: federal and state charges possible
• IT administrator wipes servers during HHS investigation: criminal conspiracy charges possible
• Provider deletes records after malpractice demand letter received: spoliation; state criminal exposure

In healthcare fraud prosecutions, record destruction charges are often added alongside the underlying fraud charges. The obstruction charge demonstrates consciousness of guilt and typically results in enhanced sentences.

State-Specific Medical Record Destruction Laws

Beyond federal HIPAA requirements, most states have enacted their own medical record destruction statutes that impose additional requirements for how records must be destroyed and what documentation must accompany the destruction. Some states go significantly further than HIPAA in their destruction requirements.

California’s Confidentiality of Medical Information Act (CMIA) at Civil Code § 56.101 imposes specific obligations on providers to protect patient records and can create civil liability for improper disposal. Texas Health and Safety Code § 241.103 requires written policies for record destruction and specific destruction methods for different media types.

Some states have established criminal penalties under state law for medical record destruction that are separate from federal HIPAA penalties. A provider who destroys records in violation of state law faces both federal HIPAA civil penalties and state criminal or administrative penalties.

State medical record destruction requirements:

State medical licensing boards have independent authority to investigate and sanction providers for record destruction violations, separate from federal enforcement. A provider who violates both federal and state record destruction laws faces penalties from both HHS and the state medical board.

Legal Ways to Dispose of Medical Records After Retention Period Expires

Legal disposal of medical records after the retention period expires requires following specific procedures that both HIPAA and most state laws mandate. The method of destruction must render PHI unreadable, undecipherable, and unrecoverable.

For paper records, cross-cut shredding is the minimum acceptable method. Cross-cut shredding produces small confetti-like pieces that cannot be reassembled, unlike strip shredding which produces longer strips that could theoretically be reconstructed. Incineration is also acceptable and is commonly used for large volumes of records.

For electronic records, the HHS Office for Civil Rights identifies three acceptable methods: clearing (using software tools to overwrite the data), purging (degaussing or exposing the media to a strong magnetic field), and physical destruction of the storage media. Cloud-stored records require coordination with the cloud provider to ensure actual deletion rather than archiving.

Legal medical record destruction methods:

After destruction, the covered entity must maintain a destruction certificate documenting: what was destroyed, the date of destruction, the method used, and who performed or supervised the destruction. This certificate should be retained for several years as evidence that destruction was done properly and at the appropriate time.

Frequently Asked Questions

Is it illegal to delete medical records in the United States?

Deleting medical records before the required retention period expires is illegal under HIPAA and violates state medical record laws in most states.
HIPAA civil penalties reach up to $1.9 million per violation category per year.
Deleting records to obstruct a federal investigation or hide malpractice is a federal crime under 18 U.S.C. § 1519, carrying up to 20 years in prison.

How long are healthcare providers required to keep medical records?

HIPAA requires a minimum retention period of 6 years from the date of creation or last effective use under 45 C.F.R. § 164.530(j).
Most states require longer retention periods: California requires 10 years, Texas requires 10 years, and Medicare providers must retain records for 10 years.
Minor patient records often must be kept until the patient reaches adulthood plus the standard adult retention period, which can extend to 25 years or more in some states.

Can a patient request that their medical records be deleted?

No, patients do not have a HIPAA right to demand deletion of their medical records.
HIPAA provides patients with rights to access, copy, amend, and request restrictions on certain disclosures of their records, but not to delete them.
The right to deletion exists under Europe’s GDPR but has not been incorporated into US healthcare law as of 2026.

What are the criminal penalties for destroying medical records illegally?

Destroying medical records to obstruct a federal investigation violates 18 U.S.C. § 1519 and carries up to 20 years in federal prison.
Healthcare fraud charges under 18 U.S.C. § 1347, often accompanied by record destruction, carry up to 10 years per count, increasing to life imprisonment if a patient death resulted.
State criminal penalties for record destruction vary but include misdemeanor to felony charges depending on the circumstances and state law.

What is spoliation of medical records and what happens in court?

Spoliation of medical records refers to the destruction or alteration of records that were relevant to pending or anticipated litigation.
When courts find medical record spoliation, they can issue adverse inference instructions telling the jury to assume the destroyed records contained evidence unfavorable to the destroying party.
Courts can also dismiss a party’s case, enter default judgment against them, or impose substantial monetary sanctions for deliberate medical record destruction.

Closing

The legal framework around medical record deletion in 2026 is multilayered but clear in its core principle: records must be retained for the required period, destroyed through approved methods when that period ends, and never deleted to conceal patient harm or obstruct legal proceedings. The penalties for getting this wrong range from civil fines to federal prison time.

Bookmark this article and share it with anyone working in healthcare compliance, medical practice management, or healthcare law. The statute citations and penalty tiers here reflect the current enforcement environment and give providers and patients an accurate picture of what the law actually requires.

This may also interest you — Is It Illegal to Have a Crack in Your Windshield? 2026