"How long do I have to keep this?" is one of those questions that feels like it should have a single, clean answer, and does not. Record retention for therapists and other practitioners is set by a patchwork of state laws, licensing boards, and payer rules, not one national number. This guide explains why the answer varies, the common baselines people work from, and how to store and eventually dispose of records safely. It is general information, not legal advice, so always confirm against your own state and board.
Why there is no single answer
Retention periods come from several overlapping sources:
- State law, which sets minimum retention periods and often differs from state to state.
- Your licensing board, which may set its own requirements for your profession.
- Payers, including Medicare and insurers, which can require records be kept for a set period.
- HIPAA, which is often misunderstood here (more on that below).
Because these stack, the safe practice is to follow the longest period that applies to you.
Common baselines (with a caveat)
Many practitioners work from a general baseline of retaining adult client records for around seven years after the last date of service, with longer periods for minors, often keeping a minor's records until some years past the age of majority. These are common conventions, not universal law. Your state or board may require more or less, so treat any single number as a starting point to verify, not a rule to rely on.
The key habit is to look up the exact requirement for your state and profession once, write it into your practice policy, and apply it consistently.
The HIPAA misunderstanding
A common myth is that "HIPAA says keep records for six years." What HIPAA actually requires is that certain HIPAA-related documentation, such as your policies, procedures, and notices of privacy practices, be kept for six years. HIPAA does not set the retention period for clinical records themselves. That comes from state law and your licensing board. It is an easy detail to get wrong, and worth getting right.
What counts as a record
Retention applies to more than session notes. Your client record generally includes:
- Progress notes and assessments.
- Intake forms and history.
- Signed consents and agreements.
- Treatment plans.
- Billing records and superbills.
- Correspondence related to care.
Keep the whole record for the required period, not just the notes.
Storing records safely
However long you keep records, they need to stay secure and accessible the entire time:
- Encrypt records at rest and in transit.
- Control access so only authorized people can view them.
- Back up so a lost laptop or failed drive does not erase years of records.
- Keep them retrievable, since a record you cannot produce when asked is a problem even if you technically still have it.
Paper records carry the same obligations, plus the physical risks of fire, water, and theft, which is one reason many practices move to secure digital storage. Our guide on going from paper to digital covers that shift.
Disposing of records safely
When the retention period is genuinely up, records should be destroyed securely, not just deleted or thrown away. That means shredding paper and permanently, irreversibly deleting digital files. Improper disposal of client information can itself be a privacy breach, so treat the end of the lifecycle as carefully as the start.
Keep records safe and organized with Soap Notes
Retention is really a storage and security problem stretched over years, and that is easier when everything lives in one secure place. Soap Notes keeps notes, intake forms, consents, and billing records together in an encrypted system with role-based access, so a client's full record is organized, retrievable, and protected for as long as you need to keep it. It is built for practitioners who would rather have their records safely in order than scattered across folders and filing cabinets. Look up your exact requirement once, set your policy, and let your system hold the line.
