Illustrative plan · Updated November 2026 · Southern New Hampshire
A medical practice records purge plan: retention, PHI, schedule and cost
This medical practice records purge plan walks a small New Hampshire office from a room of old charts to a signed Certificate of Destruction in six steps. It is an illustrative plan, built on the Board of Medicine rule, the HIPAA text and our real prices, not the story of any client.
99¢ per pound, or $20 per banker’s box at 10+. BAA on request and a certificate on every job.
- 99¢ per pound
- HIPAA BAA on request
- Since 2007
- BBB A+ rated
Quick answer
A medical practice records purge plan has six steps: check each chart against its retention period, lock down PHI while you pull it, bag electronic media separately, schedule one pickup or drop-off, budget for it, and file the certificate with a purge log. For New Hampshire physicians, Board of Medicine rule Med 501.02(f)(8) requires keeping a complete copy of patient records for at least 7 years from the patient’s last contact, and HIPAA requires reasonable safeguards for PHI during disposal under 45 CFR 164.530(c). New Hampshire Document Shredding charges $20 per banker’s box at 10 boxes or more plus $34.90 per job, so an illustrative 25-box purge costs $534.90 by drop-off or $694.85 by Zone 2 pickup, through its medical shredding service.
What sets the clock in a medical practice records purge plan
Every purge decision comes down to one date: the day a chart can be destroyed. Get that date wrong in one direction and you shred a record a patient, a payer or a court still needs. Get it wrong in the other and you pay to store paper, and carry the privacy risk, for years longer than necessary.
The New Hampshire Board of Medicine rule
For physicians licensed by the Board, Med 501.02(f)(8) says the licensee “shall retain a complete copy of all patient medical records for at least 7 years from the date of the patient’s last contact with the licensee.” The clock runs from the last contact, not from the first visit or the date the chart was opened. The rule names one exception: a patient who asked before that date for the file to be transferred to another provider.
What HIPAA adds
HIPAA does not set a retention period for the charts themselves. It sets one for HIPAA documentation such as policies and agreements: 45 CFR 164.530(j)(2) requires keeping it “for six years from the date of its creation or the date when it last was in effect, whichever is later.” It also sets the disposal standard, covered in Step 2.
Other licensees follow their own boards. Dentists, therapists, chiropractors, optometrists and pharmacies each answer to a different licensing body, and payer contracts or your malpractice carrier may ask for longer. The Board of Medicine rule also sets no separate retention period for the records of minors, so ask your carrier how it wants pediatric charts handled before you include them.
We shred records. We do not give legal advice and cannot tell you when a particular chart is safe to destroy. If a period is unclear, ask your licensing board or malpractice carrier first. Shredding is permanent, and the certificate proves you did it.
The illustrative practice in this plan
To show the steps with real numbers, we use an illustrative practice. It is a composite, not a client, and every detail about it is an assumption chosen to make the math concrete. The prices are our actual rates.
The office
A small primary care practice in southern New Hampshire with two physicians, a practice manager and a front desk staff of three. It moved to electronic records years ago, but the paper charts from before the switch are still in a back room.
The paper
About 25 banker’s boxes of paper charts and old billing files whose patients have had no contact in more than 7 years, plus a shelf of charts that still fall inside the period.
The extras
A bag of X-ray film and imaging CDs, two retired desktop computers from the front desk and a drawer of old backup drives. None of it can go through a paper shredder.
The plan runs over about six weeks so the manager can work it around clinic hours. A larger practice follows the same steps with more boxes. A smaller one may finish in two afternoons and one drop-off.
Step 1: Run the retention check chart by chart
Start in the practice management system, not on the shelves. Run a report of every patient whose last contact was more than 7 years ago. That list, checked against the paper charts, becomes the purge list. Charts not on the list stay where they are.
| Record type | Rule to check | Purge when |
|---|---|---|
| Patient charts (physician practice) | Med 501.02(f)(8), NH Board of Medicine | At least 7 years after the patient’s last contact, and only after your carrier’s period if longer |
| Charts of minors | No separate period in Med 501.02 | Confirm with your malpractice carrier before including them |
| HIPAA policies, BAAs, training records | 45 CFR 164.530(j)(2) | Six years after creation or last effective date, whichever is later |
| Billing files, EOBs, remittance advice | Payer contracts and audit terms | After the longest payer audit window you are bound by |
| Payroll and employment tax records | IRS: at least 4 years after the tax is due or paid | After 4 years, or longer if your accountant advises |
| Practice tax returns and support | IRS: generally 3 years, 6 or 7 in specific cases | After the period that applies to that return |
In our illustrative practice, the manager runs the report, prints it and marks each chart as it is pulled. Charts of patients who asked for a transfer are set aside so the transfer record can be checked. Anything with a note about a lawsuit, a complaint or a records request in progress stays on the shelf.
Charts that stay on the shelf, even past 7 years
- Any chart tied to a lawsuit, a board complaint or a payer audit that is open or expected.
- Charts with a pending records request or transfer that has not been completed.
- Pediatric charts, until your malpractice carrier tells you how it wants them handled.
- Records your carrier or a payer contract tells you to keep longer than the board minimum.
- Anything the physician who owns the chart has not signed off on. One signature per batch is enough.
When in doubt, leave it on the shelf for the next quarterly run. A chart kept a few months too long costs almost nothing. A chart destroyed too early cannot be brought back.
Billing paper deserves its own pass. Our post on EOB and patient billing retention covers how long to keep it, and our guide on how to dispose of old medical records covers the retention check from the patient’s side too.
Step 2: Handle PHI from the shelf to the box
The riskiest stretch of any purge is not the shredder. It is the week charts spend off the shelf, in boxes, waiting. The HIPAA Privacy Rule at 45 CFR 164.530(c) requires a covered entity to “reasonably safeguard protected health information from any intentional or unintentional use or disclosure” that breaks the rules. A box of charts by the back door is the unintentional kind.
Keep the circle small. In the illustrative practice, only the manager and one front desk staff member pull and pack charts. They work in the records room with the door closed, and every filled box is taped shut and numbered before it leaves the room.
HHS guidance on disposal says paper PHI can be shredded, burned, pulped or pulverized so it cannot be read or reconstructed. Cross-cut shredding at our Tewksbury office meets that description, and a Business Associate Agreement, available on request, covers the vendor relationship under 45 CFR 164.502(e) and 164.504(e).
Who touches charts
Two trained people at most. Fewer hands on the charts means fewer chances for a page to go astray or be read.
Where boxes wait
A locked room or closet, never a hallway, garage or car. Book the pickup or drop-off close to the packing date.
What stays in
Staples, paper clips, binder clips, rubber bands and folders. Pulling them only means more eyes on more charts.
What comes out
Three-ring binder hardware, hanging-folder frames and anything that is not paper, which moves to Step 3.
- Sign the BAA before the first box leaves the office.
- Write the box count and date on the purge log as boxes are sealed.
- Keep boxes labeled by number only, never by patient name.
- Do not put charts in a general office shred bin that a cleaning crew empties.
Our post on HIPAA shredding requirements turns these rules into a short checklist for staff.
Step 3: Bag the media and film separately
Paper is only part of a practice’s records. Old computers, backup drives, imaging CDs and X-ray film hold the same patient information and need their own handling. The HIPAA Security Rule at 45 CFR 164.310(d)(2)(i) tells covered entities to “Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.”
Drives and devices
Retired desktops, laptops, backup drives, USB sticks and old phones are physically destroyed and quoted per item. Pull the drives or bring the whole machine, list each item when you book, and keep them in a separate bag from the paper. Our hard drive destruction page explains what we accept.
Film and imaging CDs
X-ray film and imaging CDs follow the same retention check as the charts they belong to. Once past their date, bag them separately for destruction. Our post on whether to shred medical x-rays covers film in more detail.
Media is where purges most often leave a gap. Paper gets all the attention, while the old front desk computer sits in a closet with years of scheduling data on its drive. Ask the person who handles your IT to list every retired device before week 3, and treat that list as part of the purge, not a separate project for later.
In the illustrative practice, the manager lists two desktops, one bag of backup drives and one bag of film and CDs on the booking. They travel with the paper but are priced and destroyed as their own items.
Step 4: Schedule the purge around clinic hours
A purge goes wrong when it is squeezed into one frantic weekend. Spread over six weeks, it fits around patient care and leaves room for the checks that matter. Here is the illustrative schedule.
- Weeks 1 and 2: report and pullRun the last-contact report, pull charts in batches between clinic sessions and check each against the list.
- Week 3: paperwork and mediaSign the Business Associate Agreement. List and bag drives, film and CDs.
- Week 4: seal and lockTape and number every box, record the count and keep everything in the locked records room.
- Week 5: handoverDrive the boxes to Tewksbury on a weekday or have our driver collect them by appointment.
- Week 6: close outFile the certificate, update the purge log and set the date for the next quarterly run.
Tell the whole staff the purge is happening, even the people not doing it. Front desk and clinical staff should know that charts on the cart are going to the locked room, not the recycling, and that any question from a patient about an old chart goes to the manager during the purge weeks.
Pickups run by appointment, and material is shredded after it arrives at our Tewksbury office. Drop-off paper is shredded the same business day it reaches the counter. We never promise same-day collection, so book week 5 when you start week 1.
Step 5: Budget the purge
Prices are simple, so the budget is too. A banker’s box of paper weighs about 30 pounds. Under 10 boxes, you pay 99 cents per pound. At 10 boxes or more, it is $15 per small box or $20 per large banker’s box. Every job adds $34.90: a $14.95 HIPAA filing fee that covers the Certificate of Destruction paperwork and a $19.95 environmental fee for recycling. Pickups add a transport fee by zone.
| Boxes | Drop-off | Zone 1 pickup | Zone 2 pickup | Zone 3 pickup | Witnessed |
|---|---|---|---|---|---|
| 5 boxes (about 150 lb) | $183.40 | $313.35 | $343.35 | $383.35 | $333.40 |
| 10 large boxes | $234.90 | $364.85 | $394.85 | $434.85 | $631.90 |
| 25 large boxes | $534.90 | $664.85 | $694.85 | $734.85 | $1,527.40 |
Drive or book a pickup? A rule of thumb
For five boxes or fewer, drive. A practice in Salem, Pelham, Windham or Hudson is a short trip down I-93 or Route 38 to our Tewksbury office, staff help you unload, and you skip the transport fee. For twenty boxes or more, book the pickup and keep your staff in the office. Between those two, it depends on who is free on a weekday between 10 a.m. and 5 p.m.
Zone 1 covers the Tewksbury area and the New Hampshire border towns such as Salem, Pelham, Windham and Plaistow. Zone 2 covers greater Nashua and Manchester. Zone 3 covers the Seacoast and points farther north. For towns not named here the zone is confirmed when you book, and our post on pickup zones and distance explains how it works.
For a practice within a short drive of the line, the drop-off saves the transport fee entirely. For a practice with no staff to spare during clinic hours, the pickup is worth it. Witnessing 25 boxes costs nearly three times the drop-off and adds nothing HIPAA asks for. If an owner wants to watch, witness the few most sensitive boxes and send the rest the standard way. Our off-site shredding page covers how pickups are scheduled, and our post on medical shredding cost runs monthly budgets for ongoing paper.
Step 6: File the certificate and keep the purge log
When the job is done, you get a Certificate of Destruction at no extra charge beyond the $14.95 HIPAA filing fee. On its own it proves a job happened. Paired with your purge log, it proves which records were destroyed.
The purge log
The date of the run, the report criteria used (last contact before a set date), the number of charts and boxes, who pulled and packed them, and the media items listed separately.
The certificate
Attach it to the log entry for that run. Scan a copy into the practice’s compliance folder and keep the original with your HIPAA records.
How long to keep both
HIPAA documentation follows the six-year rule in 45 CFR 164.530(j)(2). Keeping the log and certificates on the same schedule keeps everything in one place for an auditor.
What an auditor or payer may ask, and where the answer lives
- Which records did you destroy, and when? The purge log, with the report criteria and the box count.
- How were they destroyed? The Certificate of Destruction attached to the log entry.
- Who handled them before they left? The names on the log and your disposal policy.
- Was the vendor under contract? The signed Business Associate Agreement, filed with your HIPAA policies.
Our page on the certificate of destruction walks through what the document covers, and our post on chain of custody shredding covers what happens between your door and the shredder.
Keep the medical practice records purge plan running every quarter
The big purge clears the backlog once. A quarterly run keeps it from coming back. Each quarter, the manager reruns the last-contact report, pulls the charts that crossed the 7-year line since the last run and boxes them.
For most small offices that is a box or two. Two boxes dropped off once a quarter cost $94.30 per job, about 60 pounds at 99 cents per pound plus the $34.90 per-job fees. Front desk paper with PHI, such as sign-in sheets, intake forms and phone slips, goes into a locked shred console and rides along on the same trip.
Dental and therapy offices
The same six steps apply with a different retention rule. Our guides to dental office shredding and mental health records shredding cover the paper those offices hold.
Nashua-area practices
Greater Nashua falls in Zone 2 for pickups. Our post on medical office shredding in Nashua runs the numbers for a typical office there.
If the purge is part of closing or selling a practice, the Board of Medicine rule adds a notice duty. Under Med 501.02(f)(9), a licensee who retires, moves or stops treating patients must give active patients notice, at least 30 days ahead whenever possible, and make sure records can be transferred to another provider at the patient’s request. Plan those letters before you plan the purge.
Frequently asked questions
How long must a New Hampshire medical practice keep charts before a purge?
For physicians licensed by the NH Board of Medicine, Med 501.02(f)(8) requires keeping a complete copy of patient records for at least 7 years from the patient’s last contact. Other licensees, such as dentists and therapists, follow their own boards. Payer contracts and malpractice carriers may ask for longer. Confirm your period before you destroy anything.
Is this purge plan based on a real practice?
No. The practice in this plan is illustrative, a composite we use to show the steps and the math. It is not a client, and no client names or results are described. The rules come from the NH Board of Medicine and the HIPAA regulations, and the prices are New Hampshire Document Shredding’s current rates.
Does HIPAA say how long to keep medical records?
Not for the charts themselves. HIPAA’s six-year rule in 45 CFR 164.530(j)(2) covers HIPAA documentation such as policies, Business Associate Agreements and training records. Retention periods for charts come from state rules, licensing boards, payers and your malpractice carrier. HIPAA does require reasonable safeguards for PHI during disposal under 45 CFR 164.530(c).
How much does a 25-box medical records purge cost?
At $20 per banker’s box at 10 or more boxes, plus $34.90 in per-job fees, 25 boxes cost $534.90 by drop-off at our Tewksbury office. A pickup adds $129.95 in Zone 1, $159.95 in Zone 2 or $199.95 in Zone 3, so a Zone 2 pickup totals $694.85. Electronic media is quoted per item on top.
Will you sign a Business Associate Agreement before the purge?
Yes. New Hampshire Document Shredding signs a Business Associate Agreement on request for covered entities and business associates. Ask for it when you book online or call (978) 636-0301, and have it signed before the first boxes leave your office. File the signed copy with your HIPAA policies.
Do we need to remove staples and folders from the charts?
No. Staples, paper clips, binder clips, rubber bands and file folders can stay in. Remove three-ring binder hardware, hanging-folder frames and anything that is not paper. Less sorting saves staff time and keeps fewer people reading patient records. Tape each box shut, number it and keep it in a locked room until it leaves.
Can you destroy old computers and X-ray film with the charts?
Yes, but separately from the paper. Drives, computers, phones, USB sticks, imaging CDs and X-ray film are physically destroyed and quoted per item. Bag them apart from the charts and list them when you book. HIPAA’s Security Rule at 45 CFR 164.310(d)(2)(i) requires a policy for the final disposition of electronic PHI and the media it sits on.
Do you shred at our practice?
No. All shredding happens at our office at 1215 Main Street, Unit 115, Tewksbury, Massachusetts, about 15 minutes south of the New Hampshire line. You can drive the boxes down on a weekday, book a pickup by zone, or book a witnessed session and watch the shredding in Tewksbury. We have no drop box or shredder in New Hampshire.
Sources
- New Hampshire General Court: Board of Medicine rules, Med 501.02(f)(8) and (f)(9) (checked November 2026)
- 45 CFR 164.530, HIPAA administrative requirements, paragraphs (c) and (j) (govinfo.gov) (checked November 2026)
- 45 CFR 164.310, HIPAA physical safeguards, paragraph (d) device and media controls (govinfo.gov) (checked November 2026)
- IRS, How long should I keep records? (checked November 2026)
Plan your practice’s purge with us
Tell us how many boxes and which media items you have. We will set up the pickup or tell you when to drive down, sign the Business Associate Agreement and send the Certificate of Destruction for your HIPAA records.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front, and staff help you unload.
Monday to Friday, 10 a.m. to 5 p.m. Pickups and witnessed sessions outside these hours by appointment.
Three ways to shred: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.