Therapy Records Retention Requirements: How Long to Keep Client Records — and the Destruction Mistakes That Trigger Board Complaints
Most states require therapists to keep adult client records for 5 to 10 years after the last date of service, and minor client records until several years past the age of majority - sometimes into the client's mid-20s.
HIPAA does not set a retention period for clinical records.
Your state law, licensing board, and payer contracts do.
That's the answer you'll find everywhere.
Here's what it doesn't tell you: the number is only the floor.
The therapists I see get into trouble aren't the ones who kept records for six years instead of seven. They're the ones who destroyed records the wrong way, had no written retention policy when a payer audit or board complaint landed, or closed a practice with no plan for the charts left behind.
This guide covers the retention rules by source of authority - and the destruction and closure steps that actually protect your license.
Does HIPAA require therapists to keep client records for 6 years?
No - and this is the most persistent myth in behavioral health compliance.
HIPAA's six-year rule applies to your HIPAA documentation, not your clinical charts.
Under 45 CFR 164.316 and 164.530, covered entities must retain policies and procedures, Notices of Privacy Practices, authorizations for disclosure, risk assessments, business associate agreements, and breach documentation for six years from the date of creation or the date the document was last in effect, whichever is later.
For the clinical record itself - progress notes, treatment plans, diagnoses, billing records - HIPAA defers to state law and other applicable federal regulations.
So when a colleague tells you "HIPAA says six years," they're citing the wrong rule for the wrong documents.
What HIPAA does govern is how you protect records for as long as you hold them, and how you destroy them when you're done.
More on that below.
How long do states require therapists to keep records?
State law is your primary authority, and it varies more than most clinicians expect.
Most states require adult records to be kept for five to 10 years after the last date of service.
A few reference points from published state rules:
California, North Carolina, Tennessee, and Connecticut require health professionals to maintain records for seven years after the professional relationship ends
Texas requires records be kept for seven years, or five years after a client reaches the age of majority — whichever is greater
Pennsylvania requires five years since the last patient contact for both children and adults, while Illinois has no record-keeping statute at all - the state psychological association points clinicians to APA's guidelines
Two things matter more than memorizing your state's number.
First, check the rule for your license type - LCSW, LPC, LMFT, and psychologist rules can differ within the same state, which trips up group practices with mixed licenses.
Second, when multiple rules apply, the practical question is: what is the longest applicable retention period for this record?
You always follow the longest one.
Across the behavioral health practices HireGaynell supports, roughly 4 in 5 solo practices we onboard have no written retention policy at all when we start - the records are in the EHR, but nobody has documented how long they stay or when they go.
That's the gap an auditor or board investigator notices first.
How long do you keep therapy records for minors?
Longer - in every state that addresses it.
The standard structure: retain the record until the client reaches the age of majority (18 in most states), plus an additional period.
North Carolina mandates keeping hospital records until the patient reaches age 30; Texas requires retention until age 21 or 7 years after the last treatment.
Run the math on a 6-year-old client, and you can be holding that chart for 15 to 20 years.
This is why minor records deserve their own line in your retention policy, calculated from the client's date of birth rather than the discharge date.
If your EHR - SimplePractice, TherapyNotes, or TheraNest - lets you tag charts by client age at intake, use it. It's the only way to run a clean destruction review years later without opening every file.
What do the APA, NASW, and ACA recommend?
When state law is silent or vague, professional guidelines fill the gap, and boards treat them as the standard of care.
The American Psychological Association's Record Keeping Guidelines recommend maintaining full records for seven years after the last date of service, or three years after a minor patient reaches majority, whichever comes later.
NASW and the ACA don't publish specific retention timeframes; both direct clinicians to follow state guidelines.
My operating rule for the practices we manage: state minimum or seven years, whichever is longer, and minors to at least age 21.
It's simple enough that staff actually follow it, and it clears nearly every state's floor.
Do payer contracts and Medicare change your retention timeline?
Yes, and this is the layer most solo practices miss entirely.
Your participating-provider agreements typically include audit-access clauses.
If your licensing rules require seven years but a payer contract requires audit access for ten, you keep the record for ten; the longer applicable period wins.
Records tied to Medicare and Medicaid reimbursement must be retained for six years from the date of reimbursement or final cost determination, and CMS requirements for Medicare providers are commonly cited at seven years from the date of service.
If you treat substance use disorders, note that those records fall under 42 CFR Part 2, which carries stricter handling and disclosure rules than HIPAA.
This is also where retention connects to revenue.
Payers can audit and recoup on claims years after payment - the same documentation standards that win an appeal on a denied insurance claim are the ones that protect you in a post-payment audit.
If the chart is gone before the audit window closes, you can't defend the claim.
How do you destroy therapy records legally?
Destruction is where compliant practices become non-compliant in an afternoon.
Hitting "delete" is not legal destruction, and neither is a curbside recycling bin.
HIPAA requires that protected health information be rendered unreadable, indecipherable, and unable to be reconstructed.
Here's the process I run for every practice we support:
Confirm the retention clock has actually expired.
Calculate from the last date of service (or date of majority for minors), and check state law, license rules, and every active payer contract. Use the longest period.
Screen for legal holds.
Never destroy a record connected to pending or reasonably anticipated litigation, an open board complaint, an active audit, or an unresolved records request, even if the retention period has run.
Destroy by compliant method.
Paper: cross-cut shredding or a professional destruction service. Electronic: simple deletion is insufficient - use secure erasure that overwrites data, degaussing, or physical destruction of the media. If a vendor destroys for you, get a certificate of destruction and make sure a business associate agreement is in place.
Log it.
Record what was destroyed, when, how, and by whom - and keep that destruction log permanently. The log is your proof that records are gone because policy said so, not because something was being hidden.
Put destruction on a calendar.
An annual destruction review beats ad-hoc purges. It also keeps you from the opposite failure, hoarding records forever, which increases breach exposure and subpoena surface with every passing year.
Steps 2 and 4 are the ones that trigger board complaints when skipped.
A record destroyed on schedule with a log entry is a non-event. The same record destroyed with no policy and no log looks like spoliation.
What happens to client records when you close your practice?
Your retention obligations don't retire when you do.
Most states require closing therapists to transfer records to a successor provider, establish secure long-term storage, or notify clients of the closure and how to retrieve their records - and you cannot simply destroy records before retention timelines are met.
You remain responsible for record retention even after closing; options include a successor practice, a records storage company, or personal custody.
Name a records custodian in your policy now — even in a solo practice, someone must be designated to oversee storage, respond to requests, and track destruction.
If you're incapacitated or deceased, that designation is what keeps your clients from losing access to their own charts. This is exactly the kind of standing operational task that gets handled properly when it's part of a defined system rather than a someday item — it's a core piece of what full-scope operational support for private practices covers, alongside credentialing and billing.
The one-page retention policy every practice needs
You don't need a 20-page manual. You need one page that states:
What counts as the clinical record in your practice (progress notes, treatment plans, intake forms, billing records, portal messages, telehealth consents)
Retention period for adults, and the formula for minors
Where records live (your EHR, with backups) and who the records custodian is
The destruction method, schedule, and log location
The legal-hold rule: no destruction during litigation, complaints, or audits
Across the practices HireGaynell manages, building this policy and the annual destruction review takes under three hours the first time - and it converts records retention from a lurking liability into a routine task.
If your admin load already has you skimming this between sessions, our mental health practice admin FAQ covers where retention fits among the other operational obligations competing for your week, and a specialized mental health virtual assistant can own the calendar side of it - custodian tracking, destruction reviews, and documentation - so it never falls to you at 9 p.m.
Conclusion
In my experience running operations for behavioral health practices, the retention number is never what hurts a therapist - it's the absence of a written policy and a destruction log when someone official comes asking.
Keep adult records at least seven years, keep minor records past age 21, follow your longest applicable rule, destroy on schedule with documentation, and name a custodian before you need one.
Do those five things and records retention stops being a source of quiet dread.
If building and maintaining compliance systems like this is exactly the kind of work that keeps falling to the bottom of your list, this is what HireGaynell's Practice Administration service handles — retention policies, custodian workflows, and the rest of the back office - so your evenings go back to being yours.
