skip navigation
Arizona Medical Board
Arizona Medical Board
Official Website of the
Arizona Medical Board
The Board's mission is to protect public health and safety.

The following is based solely on Arizona Law, is Not Comprehensive and does not address any Federal requirements Note: All medical records and payment records (A.R.S. § 12-2292) are privileged and confidential and may be disclosed only as authorized by state or federal law or written authorization signed by the patient or the patient’s healthcare decision maker.

How long do I need to maintain my patient's records?

The statutes (A.R.S. § 12-2297) require a physician to retain the original or copies of a patient’s medical records for a minimum of six years past the last visit if the patient is an adult. If the patient is a child, a doctor must maintain the records until the child is 21 or for at least six years past the last patient visit - whichever is longer.


How should patients make their requests for their medical records?

The statutes (A.R.S. §12-2292)require that a physician must make medical records available when a patient submits a request in writing. Patients often sign a release form, but a written request is sufficient.


Once we have a written request for medical records, how soon must my office provide them?

Yes. It is unprofessional conduct for a physician to fail to make medical records “promptly available.” (A.R.S. §1401(27)(rr)) Three weeks is a reasonable amount of time unless there are extenuating circumstances.


If a patient asks for copies of his records, may I charge for making them?

A doctor may not charge for making copies of a patient’s medical records if another physician, the patient, or the healthcare decision maker requests them for continuity of care. Under other circumstances, a physician may charge a patient or healthcare decision maker a reasonable fee for the production of the records. And a doctor may require the payment of the fee in advance. (A.R.S. §12-2295)


The patient has had other providers before becoming a patient of mine. When the patient requests the medical records, do I need to give him all the records or just the ones I’ve created for his/her care?

The definition of “Medical Records” in the statutes (A.R.S. § 12-2291(5))“means all communications related to a patient’s physical or mental health or condition that are recorded in any form or medium and that are maintained for purposes of patient diagnosis or treatment, including medical records that are prepared by a health care provider or other providers.” So, if the patient asks for his/her medical records, that includes everything in the chart, whether you created it or not.


If the patient owes my practice money for visits or treatment, is it okay to withhold his requested medical records until he pays his bill?

A.R.S. §12-2293(B and C)specifies six conditions under which a health care provider may deny a request for access to or copies of medical records or payment records. Delinquent balances are not an identified reason for withholding records.


Are there times that I can refuse a patient’s request for his medical records?

According to A.R.S. §12-2293 a doctor may deny a request if he determines that release of the records would likely endanger the life or physical safety of a patient or another person, or if they make reference to a person other than a healthcare professional and would likely cause substantial harm to that other person, or if the records would likely cause substantial harm to the patient, or if they would reveal information obtained under a promise of confidentiality with someone other than a healthcare professional. There are other exceptions for clinical research and correctional institutions. Note: If you deny a request for medical records, you must note this determination in the patient’s records and provide the patient or the healthcare decision maker with a written explanation of the reason for denying access.


Are there other times when I would be required to release a patient’s medical records to third parties without the patient’s written authorization?

Yes. A.R.S. §12-2294 and §12-2294.01 require physicians to disclose medical records without the patient’s written authorization as required by law or when ordered by a court or tribunal of competent jurisdiction. This includes subpoenas. When required for diagnosis or treatment of the patient, a physician may disclose the medical records without written authorization from the patient to other healthcare providers. And the doctor may disclose them to other healthcare providers who have previously treated the patient without the patient’s written approval. Doctors may also release them to ambulance attendants, to a private agency that accredits healthcare providers, to the Arizona Medical Board, to healthcare providers for peer review, to a person or entity that provides billing and administrative services, to an attorney for the purpose of obtaining legal advice, to the patient’s third party payor, or to the Industrial Commission of Arizona.


A patient has died. To whom may I release his records if I receive a written request?

A doctor may release records to the patient’s personal representative or administrator of his estate (A.R.S. §12-2294(D)) If no one has been appointed, a physician may release the records to the persons identified in A.R.S. §12-2294(D).


What if I provide the records as the law requires and then I am sued?

A healthcare provider who acts in good faith is not liable for damages in any civil action for the disclosure of medical records.(A.R.S. § 12-2296).


I’m planning to retire (and/or sell my practice) in the next year or so. What should I do with the medical records?

When a health care provider retires or sells the provider’s practice, the provider shall take reasonable measures to ensure that the records are retained for the appropriate period of time (see above). (A.R.S. §12-2297(B))Additionally, A.R.S. §32-3211 requires a healthcare professional to “prepare a written protocol for the secure storage, transfer and access of the medical records.” This protocol must specify the procedure by which you “will notify each patient in a timely manner” before you terminate or sell the practice “in order to inform the patient regarding the future location of the patient’s medical records and how the patient can access those records.” You may dispose of unclaimed medical records after the specified period of time (see above) and after you have made “good faith efforts to contact the patient.” The statute states that not complying with the requirements is an act of unprofessional conduct. Also, once your practice address and practice phone numbers are no longer accurate, state law (A.R.S. §32-1435)requires you to update your contact information with the Arizona Medical Board in writing within 30 days. There is a “Change of Address” form available on this Web site (under “Physician Center” in the homepage menu) for you to use. You may provide the Board with a mailing address for patients to request medical records after you are no longer practicing in Arizona or anywhere.


Please note: These answers are meant as a baseline guide and are not an exclusive list of all the legal requirements regarding record retention and release. Please read the entire content of the statutes cited above and consult with your own legal counsel for proper legal advice in any given situation.