How long to keep therapy notes (and where the rules come from)
If you have ever stared at a closed file and wondered whether it is finally safe to shred, you already know the honest answer to therapy note retention requirements: it depends, and it depends on more sources than most clinicians realize. There is no single number. There are at least three separate rulebooks pointing at your records at once, they rarely agree, and the gap between them is where most retention mistakes live.
This post maps those three sources, shows how to resolve the conflicts between them, and walks through building a written policy you can actually follow. It is editorial, not legal advice — retention periods vary by jurisdiction and payer, so confirm the specifics with your licensing board, your insurers, and an attorney who knows your state.
Where therapy note retention requirements actually come from
When people ask “how long do I keep records,” they usually want one rule. In reality, three different bodies are making demands on the same file, each for its own reason.
1. State law and your licensing board. This is the source most clinicians anchor to, and it is genuinely binding on your license. State statutes and board regulations set a minimum retention period for clinical records — often some number of years after the last date of service for adult clients. These rules exist to protect clients and to give boards something to review during a complaint or investigation. The catch: the number varies widely from state to state, and some states are silent for certain license types, which does not mean “keep nothing.” Because these rules differ by jurisdiction, treat any general figure as a starting point, not the answer that binds you.
2. Federal rules, mainly HIPAA. Here is the surprise that trips people up. HIPAA does not set a retention period for the clinical record itself. The well-known six-year HIPAA requirement applies to HIPAA documentation — your policies, your Notice of Privacy Practices, records of disclosures, security risk analyses — not to the treatment record. So HIPAA tells you to keep your compliance paperwork for six years from creation or last effective date, while staying silent on the chart. Treating “six years” as the answer to “how long do I keep my notes” is a common and consequential mix-up.
3. Payers, contracts, and liability exposure. Insurance contracts, Medicare and Medicaid rules, EAPs, and your own malpractice considerations all impose their own clocks. A payer may require you to retain records long enough to support a claim audit. And from a defensive standpoint, the practical question is not only “what is the minimum” but “how long could someone reasonably bring a claim, and will I have the record to defend myself.” That liability window can outlast every statutory minimum.
When the rules conflict, default to the longest
These three clocks almost never line up. Your state board might name one period, your malpractice carrier might suggest a longer one, and a payer contract might specify something else again.
The working rule among careful practitioners is simple: when retention periods conflict, keep the record for the longest applicable period. A shorter clock never excuses you from a longer obligation that also applies. Destroying a chart at the state minimum does you no good if a payer contract or a still-open liability window required you to have kept it.
When the rules disagree, the longest defensible period wins. You are rarely faulted for keeping a record too long; you are exposed when you destroy one too soon.
This is also why a vague “I think it’s about seven years” is risky. You are not following one rule — you are satisfying the strictest of several overlapping ones.
Minors’ records need their own clock
Records for clients who are minors deserve separate, explicit treatment, because the retention clock often does not start when treatment ends. In many jurisdictions it starts when the client reaches the age of majority, and then the standard retention period runs from there.
The practical effect is long. A child seen at eight may have a record you are obligated to keep well into their twenties. A reasonable mental model:
- Identify the age of majority in your state (commonly 18).
- Find your normal post-treatment retention period.
- For minors, treat the clock as starting at majority, then add that period on top.
So a file is not “old enough to destroy” just because the sessions were years ago. For minors, do the arithmetic from adulthood, not from the last appointment. As always, confirm how your own state frames the minor’s clock, because the rules vary.
Building a written retention policy
A retention policy is not bureaucratic theater. It is what lets you destroy records confidently instead of accumulating decades of files out of fear, and it is the kind of document an auditor or board actually wants to see. A workable policy answers a short list of questions.
| Question | What to specify |
|---|---|
| What counts as the record? | Progress notes, intake, assessments, treatment plans, correspondence, and where audio fits |
| How long for adults? | The longest applicable period across state, payer, and liability |
| How long for minors? | Clock starting at age of majority |
| How are records stored? | Encrypted, access-controlled, with a clear custodian |
| How and when destroyed? | Secure destruction method and a destruction log |
| What happens if you close or die? | A custodian-of-records plan |
Two details people forget. First, destruction must be documented and secure — a destruction log shows you disposed of records intentionally and on schedule, not carelessly. Second, define what the record even is. Audio recordings, for instance, are a distinct category with their own shorter retention logic; I have written separately on how long to keep session audio, and your policy should name audio explicitly rather than leaving it ambiguous.
It also helps to be precise about which documents you are retaining and why. Your formal progress notes and your private process notes are not the same thing and are not always treated the same way under the rules — the distinction between psychotherapy notes and progress notes is worth getting right before you set a single retention number, because the two categories can carry different obligations.
One more consideration sits underneath all of this: where the record lives. The longer your retention obligation, the longer something sensitive has to stay protected, and every cloud copy is one more place a record could be exposed over a multi-decade clock. That is part of why CouchNotes keeps transcription and note drafting on your own Mac — fewer copies in fewer hands is simply easier to defend over a long retention horizon. The clinician still reviews, edits, and signs every draft; the tool keeps the surface area small and leaves the clinical judgment where it belongs.
Retention is one of those quiet obligations that feels optional until the day it isn’t — an audit, a subpoena, a board complaint. Write the policy once, default to the longest clock, give minors their own math, and document your destructions. None of that replaces checking the specifics, so confirm the actual numbers with your board, your payers, and counsel, because those are the only sources that can tell you the figure that binds you. Do that work once and revisit it when your licenses, contracts, or states change, and the closed file on your desk stops being a question you dread and becomes one you can answer with a date.