Updated November 2026 · Southern New Hampshire
How to dispose of old medical records in New Hampshire
To dispose of old medical records correctly, a New Hampshire practice checks the retention clock first and shreds second, and a patient keeps what still matters and shreds the rest. This guide gives practices and families the rule text, a sorting flow and the disposal methods federal guidance accepts.
99¢ per pound at our Tewksbury drop-off. Certificate of Destruction on every job.
- 99¢ per pound
- Since 2007
- BBB A+ rated
- HIPAA BAA on request
Quick answer
Before you dispose of old medical records in New Hampshire, confirm the retention period: the NH Board of Medicine rule Med 501.02(f)(8) requires physicians to keep a complete copy of patient records for at least 7 years from the patient’s last contact, and HIPAA itself sets no retention period. Once the clock has run out, HHS says paper records should be shredded, burned, pulped or pulverized so they cannot be read or reconstructed, never left in a dumpster. New Hampshire Document Shredding destroys paper records at 99 cents a pound plus $34.90 per job with a Certificate of Destruction, as part of its medical shredding service.
Retention first: how long NH records must be kept
The worst disposal mistake is not a bad shredder. It is shredding a chart the practice still had to keep. So the first job is never “how do we destroy it.” It is “are we allowed to yet.”
HIPAA does not answer that. The HHS FAQ on the question is blunt: the Privacy Rule “does not include medical record retention requirements,” and state laws generally govern how long records are kept. What HIPAA does require is that you protect the records for as long as you hold them, and through disposal, under 45 CFR 164.530(c).
For physicians, New Hampshire answers it in the Board of Medicine rules. Med 501.02(f)(8) says the licensee “shall retain a complete copy of all patient medical records for at least 7 years from the date of the patient’s last contact with the licensee.” The one exception the rule names is a patient who asked, before that date, for the file to be transferred to another provider.
| Record | Minimum before you destroy it | Where the rule lives |
|---|---|---|
| Patient records of a physician licensed in NH | 7 years from the patient’s last contact | Med 501.02(f)(8), NH Board of Medicine rules |
| HIPAA policies, training records, BAAs, other required documentation | 6 years from creation or the date last in effect, whichever is later | 45 CFR 164.530(j)(2) |
| Records of dentists, therapists, chiropractors, pharmacies, home health and other licensees | Set by each license, not by the physician rule | Your own licensing board’s rules, plus your malpractice carrier and payer contracts |
| Practice payroll and employment tax records | At least 4 years after the tax is due or paid, whichever is later | IRS, How long should I keep records |
Our full document retention guide covers business and household records beyond the medical ones. When a rule is unclear, ask your licensing board or your malpractice carrier before you shred. Shredding is permanent.
Reading the clock: last contact, not first visit
The NH physician rule runs from the patient’s last contact, which changes how you sort a records room. A chart opened in 2009 is not old if the patient came in last spring. A chart opened in 2017 can be past its clock if the patient was last seen in 2018.
A worked example
A patient’s last visit was in October 2018. Seven years from that date is October 2025. As of November 2026, that chart has passed the board’s minimum, as long as no other rule, contract or pending matter applies. A patient last seen in December 2019 is not past it until December 2026.
Sort by the last date, not the folder
Older paper systems often file by name, not by date. Before a purge, pull the last-visit date for each chart from your practice management system, print a list of charts past the clock and pull only those. Leave the rest on the shelf.
Minors and patients with guardians need extra care. Med 501.02(f)(5) and (f)(6) govern releasing those records to the person legally responsible for the patient. The physician rule does not set a separate retention period for minors, so check your board, your carrier and any payer contract before you treat a pediatric chart like an adult one.
Billing paper runs on its own clocks. Explanations of benefits, remittance advice and claim forms often sit in different cabinets from the charts. Our post on EOB and billing record retention covers that paper on its own.
How to dispose of old medical records: the methods HHS accepts
Once a record is past its clock, the rules turn to how you destroy it. HHS does not mandate one method. Its disposal FAQ lists examples instead, and draws a hard line at what you cannot do.
Paper
For paper records HHS lists “shredding, burning, pulping, or pulverizing the records so that PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed.” Cross-cut shredding, which we run at our Tewksbury office, meets that description.
HHS also names using a disposal vendor as a business associate to pick up and shred the records. That is why we sign a Business Associate Agreement on request.
What is not allowed
Covered entities, HHS says, “are not permitted to simply abandon PHI or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons.” An open recycling tote behind the building counts.
Anyone who disposes of PHI, or supervises people who do, must be trained on your disposal procedures. That includes volunteers.
Records on electronic media follow the Security Rule at 45 CFR 164.310(d)(2)(i) and (ii), which covers final disposition of electronic PHI and wiping media before reuse. Old hard drives, imaging CDs and USB sticks go in a separate bag. They are physically destroyed and quoted per item, as described on our hard drive destruction page. X-ray film is its own case, covered in our post on whether to shred medical x-rays.
A sorting flow for the records room
A purge goes wrong when people sort as they box. Decide first, box second. The flow below works for a solo practice with one closet or a group with a basement full of cartons.
- Pull the listRun a report of patients whose last contact is more than 7 years ago, or whatever your own board requires. Print it and date it.
- Check for holdsAsk the front desk, billing and the practice owner about open records requests, audits or legal matters. Anything on that list stays.
- Pull and boxPull only the listed charts. Do not remove staples, clips or folders. Do remove three-ring binder hardware and hanging-folder frames.
- Log the rangeOn one sheet, write the date, the number of boxes and the last-contact range they cover. That log and the certificate are your proof.
- Seal and lockTape each box shut and keep the boxes in a locked room until they leave. Never stage them by a back door.
- Shred and fileBring them in, book a pickup or book a witnessed session. File the Certificate of Destruction with the log and your HIPAA policies.
For a bigger cleanout with a schedule attached, see our illustrative medical practice records purge plan, and for the rule-by-rule checklist read HIPAA shredding requirements.
Closing or leaving a practice
Closings are where old records pile up fastest, because everything ages out at once and the lease ends on a fixed date. The Board of Medicine rule sets the order of operations before anything is destroyed.
Under Med 501.02(f)(9), a licensee who “retires, moves from the area or decides to stop treating a patient or group of patients” must notify active patients, make sure their records can be transferred to another provider at the patient’s request, and, whenever possible, give that notice at least 30 days before care stops. Med 501.02(f)(10) then relieves the licensee of further copy requests once records are transferred in line with (f)(9).
Patients own the information
New Hampshire RSA 332-I:1 says medical information in a provider’s records “shall be deemed to be the property of the patient,” and the patient is entitled to a copy on request, as regulated by HIPAA.
Copies have deadlines
The same statute requires records to reach a requestor within 30 days. When the requestor is the patient’s new health care provider, the transfer must be made within 14 days at no cost.
HHS suggests a pickup window
According to the HHS disposal FAQ, a covered entity winding up a business may wish to give patients the chance to pick up their records before disposal.
Only after notices, transfers and the retention clock are handled does the shredder enter the plan. Then one large job is cheaper than several small ones, because the $34.90 per-job fee is charged once and you get one certificate covering the whole closing.
Patients and families: your own old medical records
Patients collect medical paper too: visit summaries, lab printouts, bills, insurance statements and the folder of records you requested when you switched doctors. Your provider keeps the official chart, so most of your copies are convenience copies. Some still deserve a place in the file cabinet.
The FTC’s advice on medical identity theft is to keep medical and health insurance records in a safe place and shred them before you throw them away. For things that are hard to shred, like a prescription bottle, it suggests blacking out medical and personal details with a marker.
Read each explanation of benefits before it goes in the shred pile. The FTC lists a bill or statement for care you never received as one of the signs of medical identity theft.
- Keep records of chronic conditions, surgeries, allergies, immunizations and major imaging reports. Your next doctor may want them.
- Keep medical receipts you deducted on a tax return for as long as you keep that return. The IRS usual period is 3 years.
- Shred visit summaries, appointment letters, pharmacy printouts and duplicate statements once you have checked them.
- Black out names and prescription numbers on pill bottle labels, or peel the label off and shred it.
- Put X-ray film, imaging CDs and old phones with patient portal apps in a separate bag. They are not paper.
Our post on how to shred medical paperwork at home covers the small weekly stack. Clearing a parent’s house after a death usually means far more, and our guide to shredding after a death explains what an executor should keep first.
Three ways to dispose of old medical records once the clock runs out
All three end in the same place: cross-cut shredding at our office at 1215 Main Street, Unit 115, Tewksbury, MA, a Certificate of Destruction and recycling of the shred. We have no drop box or office in New Hampshire, and nothing is shredded at the curb.
| Service | Price | Fits |
|---|---|---|
| Drop-off, walk in weekdays 10 a.m. to 5 p.m. | 99¢ per lb under 10 boxes, $15 small or $20 large box at 10+, plus $34.90 per job | A family’s file box, or a practice near the state line with a few cartons |
| Pickup by appointment | Same shredding rates plus $129.95 (Zone 1), $159.95 (Zone 2) or $199.95 (Zone 3), plus $34.90 per job | A records room or a closing where staff cannot carry boxes |
| Witnessed, by appointment | $1.99 per lb, $100 minimum, plus $34.90 per job | A small amount of sensitive files, such as therapy notes, when the owner wants to watch |
As a guide, one banker’s box of about 30 pounds dropped off comes to $64.60 and five come to $183.40. Ten boxes at the flat rate come to $234.90. If you want to watch the last of a closed practice’s files go through, read about witnessed shredding. Therapy practices have their own concerns, covered in our page on mental health records shredding.
Frequently asked questions
How long must a New Hampshire doctor keep medical records?
The NH Board of Medicine rule Med 501.02(f)(8) says physicians must keep a complete copy of patient records for at least 7 years from the date of the patient’s last contact. The exception is a patient who asked, before then, for the file to go to another provider. Other licensees, such as dentists or therapists, follow their own board’s rules.
Does HIPAA say how long to keep medical records?
No. HHS says the Privacy Rule does not include medical record retention requirements and that state laws generally govern them. HIPAA does require you to safeguard records for as long as you keep them, including during disposal, and to keep HIPAA documentation such as policies and agreements for six years under 45 CFR 164.530(j)(2).
What is the right way to dispose of old medical records?
For paper, HHS lists shredding, burning, pulping or pulverizing so the information cannot be read or reconstructed. Covered entities may not abandon records or put them in dumpsters or containers the public can reach. Using a disposal vendor as a business associate is one of the HHS examples. Electronic media follow separate Security Rule standards.
Can I throw my own old medical records in the recycling?
Shred them first. The FTC tells consumers to keep medical and insurance records in a safe place and shred them before throwing them away. For a prescription bottle, it suggests blacking out the medical and personal details with a marker. A few pages fit a home shredder. A full file box is easier to drop off by the pound.
What should a practice do before closing?
Under Med 501.02(f)(9), notify active patients, make sure records can be transferred to another provider at the patient’s request, and give at least 30 days of notice whenever possible. Name a custodian for records still inside their retention period. Shred only what is past its clock, in one job, and keep the Certificate of Destruction with the closing paperwork.
Who owns medical records in New Hampshire?
RSA 332-I:1 says the medical information in a provider’s records is deemed the property of the patient, and the patient is entitled to a copy on request. Records must be provided within 30 days of a request, and a transfer requested by the patient’s new health care provider must be made within 14 days at no cost.
Do I need to remove staples and folders before shredding records?
No. Staples, paper clips, binder clips, rubber bands and file folders can stay in. Remove three-ring binder hardware, hanging-folder frames and anything that is not paper. Put X-ray film, CDs, drives and phones in a separate bag, since media is physically destroyed and quoted per item. Tape each box shut before it leaves the office.
What proof do we get that the records were destroyed?
Every job comes with a Certificate of Destruction, covered by the $14.95 HIPAA filing fee within the $34.90 per-job fees. File it with a short log of the date, the number of boxes and the last-contact range they covered. Together they show which records were destroyed, when and by whom.
Sources
- New Hampshire General Court: Board of Medicine rules, Med 501.02 (f)(5), (f)(6), (f)(8), (f)(9) and (f)(10) (checked November 2026)
- New Hampshire RSA 332-I:1, Medical Records (checked November 2026)
- HHS: What do the HIPAA Privacy and Security Rules require of covered entities when they dispose of protected health information? (checked November 2026)
- HHS: Does the HIPAA Privacy Rule require covered entities to keep patients’ medical records for any period of time? (checked November 2026)
- Federal Trade Commission: What To Know About Medical Identity Theft (checked November 2026)
- IRS: How long should I keep records (checked November 2026)
Records past their clock? Clear them in one job
Check the dates, log the range and bring the boxes to Tewksbury, or book a pickup by zone. Ask for a Business Associate Agreement when you book, and file the Certificate of Destruction with your log.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
Three ways to shred: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.