How Long to Keep Therapy Records (It's Not the Number You Think)

In a storage unit across town, a retired therapist is paying $89 a month to guard boxes of client files she hasn't opened since the Obama administration. She's not sentimental about them. She's afraid of them — afraid to shred, because nobody ever told her when the clock actually runs out, so in her mind it never does. The boxes will outlast the practice, the lease, possibly the therapist. That storage unit is what happens when a profession runs on a half-remembered rule.

The half-remembered rule is this one: "HIPAA says keep records six years." You've heard it in consultation groups, read it in Facebook threads, maybe repeated it yourself. And it's wrong — not slightly wrong, but wrong about what the six years even applies to. HIPAA's six-year retention requirement covers your HIPAA compliance paperwork: your privacy and security policies, your Notice of Privacy Practices and the signed acknowledgments, your authorizations, your risk analysis. The client chart itself — the intake, the notes, the treatment plan — is not on that list. Federal privacy law never set a clock for clinical records at all. Your state did: through licensing board rules and state statutes that vary from about five years to ten or more. The most repeated retention rule in therapy answers a question nobody asked, while the real answer sits in a state regulation most of us have never read.

The layers that stack (and why the longest one wins)

Retention isn't one rule. It's several ropes tied to the same cleat, and the chart stays moored until the longest one goes slack. Working from the bottom up:

• Your state's rule is the base. Licensing boards and state statutes set the actual clinical-record clock, usually counted from the last date of service. Around seven years post-contact is a common pattern for adult clients, but states range from five to ten or more, and the number can differ by license type within the same state — the psychologist board and the counseling board don't always agree. This is the rule you must go read for your own state and your own license. Everything in this article is pattern, not statute.
• Minors get an extended clock. Most states pause or stretch the timeline for clients who were minors: keep the record until the client reaches the age of majority plus some number of years — commonly somewhere between three and seven, phrased as "until age 21" or "majority plus seven" depending on the state. More on the math below, because it surprises people.
• Payer programs can pile on. If you bill Medicare or Medicaid, program rules may require longer retention than your state does — some Medicare program contracts, for example, reach as long as ten years. The details vary by program and contract, so if you take public payers, check the participation agreement you signed rather than assuming your state's number covers you.
• Malpractice tails argue for longer still. A statute of limitations gives a former client years to bring a claim — and for minors, that window often doesn't even open until they reach adulthood. If a claim arrives in year six and you shredded the chart in year five, you've destroyed your own defense. Your record is your best witness; many attorneys and liability carriers suggest keeping it at least through the malpractice tail, even where the board would let you shred sooner.
• Professional guidance sits on top. The APA's record-keeping guidelines have suggested seven years after the last service for adults, or three years after a minor reaches majority, whichever is later — explicitly as guidance for when no law says otherwise, not as law itself. Other professions' associations offer similar aspirational numbers.

The operating principle, when the layers disagree: whichever clock is longest wins. Retention rules are floors, not ceilings. Nobody is ever sanctioned for keeping a record too long — securely. People are sanctioned for shredding too early.

The minors wrinkle, worked out with a calendar

Here's where the math bites. Say you see a 9-year-old for play therapy this year, 2026, and the family moves away in the spring of 2027. In a state whose rule is "majority plus seven," the clock doesn't even start until that child turns 18 — in 2035 — and then runs seven more years. That chart must survive until 2042. Under the gentler APA-style guidance of three years past majority, you're still holding it until 2038. A record you wrote for a fourth-grader has to outlive your current computer, probably your current EHR contract, and possibly your career.

This is why "I keep everything seven years" quietly fails a child-and-family practice. The adult charts and the minor charts are on completely different clocks, and a purge policy that treats them alike will either shred minors' records years too early or hoard adult records forever out of caution — the storage-unit ending. The fix isn't a better memory. It's a ledger.

The retention ledger: two dates per chart

A workable retention system is embarrassingly small. For every closed chart, you track two dates: the date the episode of care ended, and the date the record becomes eligible for destruction under the longest applicable rule. The first date comes from your termination note — the discharge date is what starts the clock, which is one more reason every chart deserves a real ending instead of a trailing-off. The second date is arithmetic: discharge date plus your state's number, or for minors, majority date plus the extension, or the payer's number — whichever lands latest. Write both down when you close the chart, while the dates are in front of you. A once-a-year appointment with the ledger — which charts came eligible, which get destroyed, which get held — replaces two decades of low-grade dread.

And be honest about what "the record" means, because it's more than the notes. The chart is everything documenting care: intake paperwork, signed consents, the treatment plan, progress notes, testing data and score reports, discharge summary, and — the part people miss — emails, texts, and portal messages about care, which are part of the record the moment they touch clinical content. (Psychotherapy notes, if you keep them as a formally separate set, are their own animal with their own rules — the two-record distinction is worked through in our psychotherapy notes vs. progress notes guide.) One more myth worth drowning while we're here: electronic records and paper records carry the same retention duty. Scanning a chart doesn't shorten its life, and an EHR export counts as the record just as a manila folder does — the standards in HIPAA-compliant documentation follow the information, not the medium.

Destruction done right

When a chart's date finally arrives, you don't get to just delete it. Destruction has its own rules, and they're mercifully simple:

• Secure means unrecoverable. Paper gets cross-cut shredded or handled by a destruction service that issues a certificate. Electronic records need actual secure deletion or media destruction — dragging a folder to the trash on a laptop you'll later sell is not destruction, it's distribution on a delay.
• Document it — the fact, not the content. Keep a destruction log: client identifier, date range of the record, date destroyed, method, who did it. The log proves the record was destroyed on schedule rather than lost, and it contains no clinical content, so it can be kept indefinitely.
• Never under a legal hold. If you know of pending or threatened litigation, a board complaint, a subpoena, or an investigation touching a chart, its clock freezes. Destroying a record you knew might be evidence converts a paperwork question into a spoliation problem, which is a much worse genre of problem. When in doubt, hold and call your liability carrier.

The endgame nobody plans: closure, retirement, death

Retention obligations don't retire when you do. If you close your practice, the charts must remain accessible for the rest of their clocks — former clients keep the right to request their records, and boards generally expect notice to clients about where records will live and how to get them. The usual arrangement is a records custodian: a colleague, a successor practice, or a commercial custodial service that holds the charts and answers requests after your shingle comes down.

The harder scenario is the one nobody schedules: incapacity or death. If you die with two hundred charts in a cloud account only you can log into, your grieving family inherits a HIPAA problem they can't legally open and can't legally throw away. The instrument for this is the professional will — a short document naming who takes custody of your records, how they get access, and who notifies clients. Many licensing boards require one, and most of the rest strongly urge it; the specifics vary by state and profession, so check yours. It's an afternoon of work, it costs almost nothing, and it's the difference between an orderly handoff and a locked hull sitting on the bottom with everyone's records inside.

All of this — the ledger, the destruction log, the custodian plan — gets radically easier when the whole chart actually lives in one place. If your notes are in an EHR, your consents in a scanning app, and your client emails in Gmail, "the record" is a scavenger hunt, and so is every retention decision about it. Practice Harbor keeps the full chart — intake, consents, notes, measures, messages — in one exportable thread per client, so keeping a record for sixteen years, handing it to a custodian, or destroying it on schedule is a system, not a storage unit.

The obligatory line, which in this article is genuinely load-bearing: this is education, not legal advice. Retention rules are state law and board regulation, they change, and they vary by license. Look up your board's actual rule, and when the stakes are real — litigation, closure, a contested chart — spend the hour with a health-care attorney. Your state's rule wins over every number in this post, including the ones in the FAQ below.