A medical practice closure and records custody plan is the written timeline, patient notice, records custody arrangement and retention schedule a practice puts in place before it closes, sells, merges or loses a physician. The rules are state-specific, and the sources IHS opened do not agree. Integral Healthcare Solutions (IHS) drafts the plan, the notice templates and the retention schedule for your counsel and physicians to approve.
IHS is a consulting firm, not a law firm. Your counsel advises on your state's law, any sale documents and HIPAA.
Last updated: November 2026
What is a medical practice closure and records custody plan?
A closure and records custody plan answers five questions in writing: who tells patients and when, who holds the records, how long they are kept, what happens to unclaimed records, and which payers and vendors must be told.
The governing text is state board guidance, one state rule and three federal provisions, all opened on 2026-11-06: the North Carolina Medical Board position statement 2.1.2 (amended January 2025), the Washington Medical Quality Assurance Commission guideline GUI2017-02, the Washington osteopathic board guideline OP04-29 (revised 9/11/2020, for osteopathic physicians), the Ohio Administrative Code rule 4731-27-03, 45 CFR 164.530(j), 45 CFR 164.504(e)(2) and 42 CFR 424.516(d). IHS opened no other state's law, so this page shows how three states differ and states no national rule.
| Topic | North Carolina 2.1.2 | Washington GUI2017-02 | Ohio 4731-27-03 |
|---|---|---|---|
| Kind of text | Board position statement | Commission guideline | Administrative rule; paragraph (C) covers a physician who is an independent contractor, an employee or owner at a practice that is not a health care entity, or has an ownership interest in a health care entity; failure to give notice, as determined by the Ohio medical board, counts as a departure from minimal standards of care |
| Notice timing | Reasonable advance notice, at least 30 days | At least 30 days in advance, with 90 days the best practice | No later than thirty days before the last date the physician will see patients or upon actual knowledge of the departure, whichever is earlier; after acute illness or unforeseen emergency, within thirty days of the determination that the physician will not return |
| Who is notified | No specific rule; a reasonable option is active patients seen in the past 1-2 years | Active patients and patients seen within three years | All patients who received physician services from the physician within the two years before the last date for seeing patients |
Each text has scope limits. Ohio paragraph (D) exempts several physician groups, such as a physician who served a patient on an episodic basis or in an emergency department when related future service should not reasonably be expected. The Washington Commission says its closing recommendations do not apply to practitioners who leave a multi-practitioner practice, where the remaining physicians typically retain the records, or to specialists without ongoing patient relationships. A plan written for one state cannot be copied into another.
How long must a practice keep medical records?
No source IHS opened gives one retention period for every chart. The Washington Commission states there is no general law in Washington requiring a specific period, and it concurs with the Washington State Medical Association recommendation that practitioners retain records for at least ten years from the date of a patient's last visit, prescription refill, telephone contact, test or other patient contact; 21 years from the date of a minor patient's birth; six years from the date of a patient's death; or indefinitely if the practitioner has reason to believe the patient is incompetent, there are any problems with a patient's care, or the patient may be involved in litigation. Both Washington documents say to verify the retention time your malpractice carrier requires.
The HIPAA six-year period is a different rule. Section 164.530(j)(2) states: "A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later." Paragraph (j)(1) covers privacy policies and procedures, communications and actions the subpart requires to be written or documented, and documentation sufficient to meet the burden of proof under 45 CFR 164.414(b). IHS reading, November 2026: the list does not name the patient chart, so HIPAA's six years covers compliance documentation, including the closure plan and notices, while chart retention comes from state law, board guidance and your carrier. Counsel confirms.
Who needs it and what triggers it
The work starts when a change ends a practice's ordinary hold on its records.
- A physician retires, or the practice is sold.
- A group closes a site, merges, or loses a physician.
- A death or incapacity means someone must hold the records. Washington's Commission says the practitioner's estate becomes the owner of the records.
- A landlord or vendor ends the arrangement that stores the records.
Payers and vendors also matter. Under 42 CFR 424.516(d), physicians, nonphysician practitioners, and physician and nonphysician practitioner organizations must report a change of ownership, any adverse legal action, or a change, addition or deletion of a practice location to their Medicare contractor within 30 days, and all other enrollment changes within 90 days. A business associate contract must provide that, at termination of the contract, if feasible, the business associate returns or destroys all protected health information it received or created on the covered entity's behalf and still maintains in any form, and retains no copies, "or, if such return or destruction is not feasible, extend the protections of the contract to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible" (45 CFR 164.504(e)(2)(ii)(J)).
How IHS helps
Thomas G. Goddard, JD, PhD, IHS founder and former URAC Chief Operating Officer and General Counsel, leads the work. IHS runs three practice lines, Accreditation Consulting, Compliance Services and Program Development, and this work is Compliance Services. Related: HIPAA privacy rule program, release of information, policy and procedure architecture.
The process
- Gap assessment. IHS compares your records practice with your state's guidance and rule.
- Records inventory. IHS lists every record location, paper and electronic, with its owner and contract.
- Drafting. IHS drafts a closure timeline, patient notice templates for your counsel to approve, a records custody and retention schedule, an unclaimed-records disposal procedure, a custodian designation checklist and a transition evidence file.
- Mock review. IHS reads the finished file as a board reviewer or successor custodian would.
What you supply
You supply your patient list, definition of an active patient, records inventory, vendor and EHR contracts, malpractice carrier requirements, payer contracts and the name of your custodian.
The real limit
IHS does not give legal advice and does not decide the retention period. State law, the board and your malpractice carrier do. IHS does not contact medical boards, Medicare contractors or payers, and does not send notices. IHS drafts; your practice decides, sends and files.
What to have ready
- The planned closing or sale date.
- Your definition of an active patient and the list of patients in your state's look-back window.
- An inventory of every records location, paper and electronic, with the contract that covers it.
- The person or company who will hold the records.
- The retention period your state law and board require, confirmed by counsel, including the rules for minors and deceased patients.
- Your malpractice carrier's required retention length.
- Your Medicare enrollment record and the 30-day reporting date for a change of ownership or practice location.
- Each EHR or storage vendor contract with its return-or-destroy terms.
- A procedure for unclaimed records, and the plan for a physician's death or incapacity.
With the list in hand, the free introductory call is where IHS walks through it with you.
How it compares
| Document | What it covers | Relation to this plan |
|---|---|---|
| Board guidance and rules (NC, WA, OH examples) | Notice, written policy, retention | The source this plan follows for the state concerned |
| A general compliance program | Ongoing compliance duties | Broader; see compliance program development |
This page differs from the nearest live pages in its trigger: a closing, sale, merger or departure with a date, not an ongoing build.
What it costs
None of the board or rule texts IHS opened states a fee for a closure plan, so no authority fee is quoted. Storage, transfer and copying costs fall under your records contracts. IHS scopes each engagement after a free introductory call; scope moves with sites, patients to notify, paper records, vendor contracts to unwind and states involved.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm, and does not set the retention period for your state.
- It is not a national rule. The sources are three states, and Washington's osteopathic guideline covers osteopathic physicians only.
- It is not a guarantee of any outcome with a board, a payer or a malpractice carrier.
- IHS does not contact medical boards, Medicare contractors or payers. IHS drafts; your practice sends.
Frequently asked questions
How much notice must we give patients before closing a practice?
It depends on the state. North Carolina's position statement says at least 30 days. Washington's Commission says at least 30 days, with 90 days the best practice. Ohio's rule says no later than thirty days before the last date the physician will see patients or upon actual knowledge of the departure, whichever is earlier.
Which patients must be notified?
North Carolina has no specific rule and names patients seen in the past 1-2 years as a reasonable option. Washington's Commission says active patients and patients seen within three years. Ohio's rule says all patients who received physician services from the physician within the two years before the last date for seeing patients.
Does the HIPAA six-year rule set how long we keep patient charts?
In IHS's reading, no. Section 164.530(j)(2) applies the six years to the documentation that paragraph (j)(1) requires, such as privacy policies and required records of actions. Chart retention comes from state law, board guidance and your carrier.
How long must medical records be kept?
No single period applies. Washington's Commission says no general Washington law sets one and recommends at least ten years from the last patient contact, 21 years from a minor's birth and six years from a patient's death, with longer or indefinite retention in some cases.
What should a written closure policy contain?
North Carolina recommends written policies on secure maintenance, storage, transfer, data sharing and retrieval of records, and says at a minimum they state how long records are retained, how unclaimed records are disposed of, and what happens on a licensee's death or incapacity.
What happens to the records if the physician dies?
Washington's Commission says that if the practice closes due to the practitioner's death, the estate becomes the owner of the medical records and should notify patients. North Carolina asks the written policy to say how the executor, administrator, personal representative or survivor will do so.
Do we have to tell Medicare when the practice closes or moves?
Under 42 CFR 424.516(d), physicians, nonphysician practitioners and their organizations must report a change of ownership, any adverse legal action, or a change, addition or deletion of a practice location to the Medicare contractor within 30 days, and all other enrollment changes within 90 days. IHS does not contact Medicare contractors.
What happens to records held by an EHR or storage vendor?
If the vendor is a business associate, its contract must provide that at termination, if feasible, it returns or destroys all protected health information it received or created on the covered entity's behalf and still maintains in any form, and retains no copies, or, if that is not feasible, extends the contract's protections to the information (45 CFR 164.504(e)(2)(ii)(J)).