How Long Must Dental Practices Keep Patient Records? State-by-State

The state table below was compiled from each jurisdiction's dental board rule or statute and checked against the cited sources on October 6, 2026. It is general information, not legal advice: rules change, so confirm with your state dental board or counsel before relying on it.

Dental record retention is one of the most frequently misunderstood areas of practice compliance. Many teams assume that because HIPAA is a federal law governing protected health information, it must also tell them how long to keep a patient's chart. It does not. This article explains where retention rules actually come from, why minors are handled differently, what HIPAA does require, and how all of this shapes your backup strategy. It is general educational information and is not legal advice — confirm your specific obligations with a licensed compliance or legal professional.

Does HIPAA say how long to keep dental records?

No — HIPAA does not set a retention period for clinical dental records. This surprises a lot of practice owners, but the HIPAA Privacy and Security Rules are silent on how long a patient's chart, radiographs, or treatment notes must be kept. That decision is left to the states.

HIPAA does contain one retention rule, and it is important not to confuse it with clinical retention. Covered entities must retain the written policies and procedures, and the records of actions and assessments the HIPAA rules require to be documented (for example the security risk analysis, security incident records and outcomes, and documentation of workforce HIPAA training), for six years from the date of creation or the date it was last in effect, whichever is later (45 CFR 164.316(b)(2)(i), 45 CFR 164.530(j)(2)). This is the HIPAA documentation rule. It applies to your compliance paperwork, not to the patient record itself.

So a complete picture looks like this: HIPAA tells you to keep your compliance documentation for six years, and your state tells you how long to keep the actual patient records. The two rules run in parallel and you must satisfy both.

Why is retention set by state law, not HIPAA?

Because regulating the practice of dentistry has historically been a state responsibility. Each state licenses its own dentists, runs its own dental board, and writes its own dental practice act and medical-records statutes. Retention requirements live inside that state framework — sometimes in the dental practice act, sometimes in general medical-records law, sometimes in board rules.

The practical consequences are significant:

• The required period varies from state to state. A retention period that satisfies one state's board may fall short in another.
• The trigger date can differ. Some states count from the date of last treatment; others count from record creation.
• Multiple rules can apply to the same record. State retention law, statutes of limitations for malpractice claims, and payer or insurance-audit requirements can each impose their own timeframe. Retain for the longest applicable period.
• Multi-state groups face multiple regimes. A DSO operating across state lines must comply with each state's rules for the records generated in that state.

Because of this complexity, you cannot rely on a single number. The table below lists what we found for each jurisdiction, with its source.

Why do records for minors have special rules?

Because a minor cannot bring a legal claim until they reach adulthood, some states extend the retention clock to protect their rights. Where a dental rule addresses minors, the period often does not start running at the last date of treatment: it begins when the patient reaches the age of majority or a set age, and then a further period runs. Many states have no minor-specific dental rule at all, so a minor's chart may be governed only by the general period.

In states with such a rule, a child treated at age 6 may have a record that must be kept well into their twenties, far longer than an adult record from the same visit. The exact age, the length of the add-on period and any exceptions are set by state law, which is why the minor column below varies so much.

This is also the scenario where practices most often fall short: a chart that looks old enough to purge under adult rules may still be legally protected because the patient was a minor when treated. When in doubt, keep it.

State-by-state dental record retention

How to read this table: periods are the minimums in each jurisdiction's dental board rule or statute (or a general health-records law that covers dentists). "No minor-specific dental rule found" means we found none, not that none exists, and a dash means we found no source. Some rows cite legal-information republishers (Cornell LII, FindLaw) or a bill text rather than the official code, so check the official text. This is not legal advice.

State	Adult records	Minor records	Source
Alabama	5 years from last professional contact	Longer of 1 year after majority or 5 years from last contact	Ala. Admin. Code r. 270-X-2-.26
Alaska	7 years after the record was created (not from last treatment)	No minor-specific dental rule found	AS 08.36.315(12)
Arizona	6 years after the last date of service (general health-care records law that covers dentists)	Later of 3 years after age 18 or 6 years after last service	A.R.S. § 12-2297
Arkansas	No retention period found in the Dental Practice Act, board rules or FAQ we checked; confirm with the state board	—	—
California	No specific dental retention period found in the sources we checked; confirm with the Dental Board of California or counsel	—	—
Colorado	7 years after the last treatment or examination	7 years after the patient turns 18	3 CCR 709-1, Rule 1.9(E)
Connecticut	7 years from last treatment (the rule also refers to 3 years after the patient's death)	No minor-specific dental rule found	Regs. Conn. State Agencies § 19a-14-42
Delaware	No general period in Board Regulation 1100; 24 Del. C. § 1195(c) requires 7 years from the last entry when a patient changes dentists or leaves care	No minor-specific dental rule found	24 Del. C. § 1195
District of Columbia	At least 5 years from last contact (D.C. Code § 3-1210.11(c)); the dental regulation says 3 years, so follow the longer period	At least 5 years after reaching majority (statute); the dental regulation says 3 years after age 18	17 DCMR § 4213; D.C. Code § 3-1210.11
Florida	At least 4 years from the date the patient was last examined or treated	No minor-specific dental rule found	Fla. Admin. Code R. 64B5-17.002
Georgia	At least 10 years from the patient's last office visit	No minor-specific dental rule found	Ga. Comp. R. & Regs. 150-8-.01
Hawaii	No dental-board retention rule found (HAR ch. 16-79). HRS § 622-58 sets 7 years for health care providers, but whether it covers dentists is unclear; get legal advice	—	—
Idaho	At least 7 years from the date of the last entry (exceptions when records are transferred)	No minor-specific dental rule found	IDAPA 24.31.01.200
Illinois	10 years (the statute gives no start point)	No minor-specific dental rule found	225 ILCS 25/50
Indiana	At least 7 years (general health-records law that lists dentists; no start point stated)	No minor-specific dental rule found	Ind. Code § 16-39-7-1
Iowa	At least 6 years after the last examination, prescription or treatment	Until age 19, or 6 years after last treatment, whichever is longer	Iowa Admin. Code r. 481-574.13
Kansas	10 years after the date any professional service was provided	No minor-specific dental rule found	K.A.R. 71-1-15
Kentucky	At least 7 years from last treatment (the rule also refers to 2 years after the patient's death)	7 years after the 18th birthday	201 KAR 8:540
Louisiana	At least 6 years from last treatment; radiographs and images 3 years	No minor-specific dental rule found	La. R.S. 40:1165.1
Maine	At least 7 years from last treatment	No minor-specific dental rule found	02-313 C.M.R. ch. 12, § I(G)
Maryland	May not be destroyed for 7 years after the record is made, unless the patient is notified (counted from creation)	Not until age of majority plus 7 years, unless the parent or guardian is notified	Md. Code, Health-Gen. § 4-403
Massachusetts	At least 7 years from last treatment	7 years from last treatment or 3 years after reaching majority, whichever is later	234 CMR 5.13(3)
Michigan	At least 10 years after the last service (dental statute; the general licensee statute says 7)	No minor-specific dental rule found	MCL 333.16644
Minnesota	Active file: keep the entire record. Inactive adult file: at least 7 years after last treatment	Inactive minor file: until the patient is 25	Minn. R. 3100.9600, subp. 12
Mississippi	10 years from last treatment (2024 amendment); the older board regulation still says 7 years	No minor-specific dental rule found	Miss. SB 2873 (2024)
Missouri	At least 7 years from the last professional service	7 years from the age of majority	Mo. Rev. Stat. § 332.052
Montana	No dental-specific period: the board repealed its patient-records rule in 2021, saying state and federal law govern	—	—
Nebraska	No retention period found in the Nebraska dental regulations or statutes we checked	—	—
Nevada	5 years after the record is received or produced (NRS 629.051; counted from creation, not last treatment)	Records of anyone under 23 may not be destroyed	NRS 629.051
New Hampshire	At least 7 years from the last treatment	At least 7 years past the age of majority	RSA 317-A:27-a
New Jersey	At least 7 years from the last entry; study models 3 years	No minor-specific dental rule found	N.J.A.C. 13:30-8.7
New Mexico	At least 6 years (the rule does not say from when)	No minor-specific dental rule found	16.5.1.24 NMAC
New York	At least 6 years (rule covers all licensed professions; no start point stated)	6 years and until 1 year after age 21, whichever is longer	8 NYCRR § 29.2
North Carolina	10 years from the last treatment date (work orders 2 years)	No minor-specific dental rule found	21 NCAC 16T .0101
North Dakota	At least 6 years after the last examination, prescription or treatment	Longer of 1 year after age 18 or 6 years after last treatment	N.D. Admin. Code 20-02-01-09
Ohio	No general patient-record retention period found in the Ohio Dental Practice Act (ORC and OAC ch. 4715)	—	—
Oklahoma	7 years from the date of treatment	No minor-specific dental rule found	59 O.S. § 328.31b
Oregon	At least 7 years from the date of the last entry	No minor-specific dental rule found	OAR 818-012-0070
Pennsylvania	At least 5 years from the last dental entry	No minor-specific dental rule found	49 Pa. Code § 33.209
Rhode Island	At least 5 years from the last dental visit	At least 5 years after the minor turns 18	216-RICR-40-05-2, § 2.14.1
South Carolina	At least 5 years from the last date of treatment	No minor-specific dental rule found	S.C. Code § 40-15-83
South Dakota	7 years from the last treatment, examination or prescription	Longer of 1 year after age 18 or 7 years	ARSD 20:43:11:03
Tennessee	At least 7 years from last professional contact	Longer of 1 year after majority or 7 years	Tenn. Comp. R. & Regs. 0460-02-.12(4)(g)
Texas	At least 5 years from the last date of treatment	If under 18 at last treatment: until age 21 or 5 years from last treatment, whichever is longer	22 Tex. Admin. Code § 108.8
Utah	7 years (failure to keep records for 7 years is unprofessional conduct; no start point stated)	No minor-specific dental rule found	Utah Admin. Code R156-69-502
Vermont	7 years (failure to retain records for 7 years is unprofessional conduct, unless profession-specific law allows less)	No minor-specific dental rule found	3 V.S.A. § 129a
Virginia	At least 6 years from the last date of service	Until age 18 or emancipation, with a minimum of 6 years from the last encounter	18VAC60-21-90
Washington	At least 6 years from the last treatment	No minor-specific dental rule found	WAC 246-817-310
West Virginia	The Board of Dentistry states it has no specific rule on how long records must be retained	—	WV Board of Dentistry FAQ
Wisconsin	At least 10 years after the date of the last entry	No minor-specific dental rule found	Wis. Admin. Code DE 8.03
Wyoming	No retention period found in the Dental Practice Act or board materials we could read; the current rules could not be fully searched	—	—

What does retention mean for your backups?

It means a backup is only compliant if it actually preserves every record for the full mandated period — and can produce it on demand. A retention rule is meaningless if the underlying data has been overwritten, corrupted, or aged out of your backup system before the legal clock runs out.

That puts real requirements on how backups are designed:

• Retention-tiered storage. Backups must be kept at least as long as the longest applicable legal requirement, including the extended timelines for minors. DDSArk backup policies include a configurable retention period, set per practice.
• Immutability. Records under a legal hold or a long retention requirement should not be silently deletable. DDSArk writes immutable recovery points, so a stored record cannot be tampered with.
• Encryption and off-site copies. Protecting records across a multi-year horizon means they must survive local disasters and stay confidential. DDSArk keeps encrypted, off-site copies of your data.
• A signed BAA. Any vendor that stores PHI on your behalf is a business associate. DDSArk signs a HIPAA business associate agreement, and retention is configured per practice by you or your IT partner.

To confirm whether your current setup would actually hold up, start with our HIPAA backup audit self-check, and see is cloud backup HIPAA compliant? for how managed cloud backup fits the broader compliance picture.

The bottom line: HIPAA sets a six-year clock for your documentation, your state sets the clock for patient records, minors usually get a much longer clock — and your backups have to outlast all of them. Get the verified numbers for every state you operate in, then make sure your retention configuration meets the longest one.