How long must a hospice keep patient records is a question with more than one answer running at the same time, and for California agencies the answer changed in June 2026. A federal floor sits under every Medicare-certified hospice, a longer state period now governs in California, and a separate Medicare clock runs on the ordering and certifying documentation regardless of either.
Most published guidance stops at the federal number, which is how an agency on the Peninsula ends up destroying charts years before it was permitted to. Below are the questions hospice administrators and compliance leads ask most often about record retention, answered with the periods and the citations behind them.
1. How Long Must a Hospice Keep Patient Records Under Federal Rules?
The federal floor is six years. Under 42 CFR 418.104(d), patient clinical records must be retained for six years after the death or discharge of the patient, unless state law stipulates a longer period of time. That is the minimum for every Medicare-certified hospice in the country, and it is measured from the death or the discharge rather than from the last visit.
The same provision covers what happens if the agency stops operating. A hospice that discontinues operation must have policies providing for the retention and storage of clinical records, and it must tell its state agency and its CMS regional office where the records will be kept and how they can be accessed. Closing the doors does not close the obligation.
2. Does California Require a Longer Retention Period Than the Federal Rule?
Yes. California hospices are generally required to retain patient records for at least ten years, not six, under the California Department of Public Health’s emergency hospice licensing regulations at Title 22, sections 74800 through 74908, which took effect on June 22, 2026. Additional requirements apply to the records of minors.
Where state law is longer, the more stringent period governs, which 418.104(d) says directly. A California hospice therefore keeps ten. These are emergency regulations and remain temporary by design: CDPH must complete standard rulemaking, expected to include a public comment period, before the same requirements become permanent. Until that happens the current regulations are fully in force, and there is no general grandfather period for agencies licensed before June 2026.
3. Why Did California’s Hospice Record Requirements Change in 2026?
The change came out of a fraud enforcement effort, not a records initiative. A 2022 California State Auditor report found numerous indicators of fraud and abuse among hospice agencies, particularly in Los Angeles County. The Legislature responded with a moratorium on new hospice licenses and directed CDPH to write emergency regulations implementing the auditor’s recommendations.
The scale of the enforcement behind it explains why documentation is now a licensing matter. According to the Office of Governor Gavin Newsom in March 2026, California has revoked more than 280 hospice licenses over the past two years, with roughly 300 additional providers under investigation. Records obligations do not disappear when a license does, which is part of why the new framework specifies how records must be kept, completed, corrected, and stored rather than leaving it to each agency’s custom.
4. What Other Record Deadlines Come With the California Framework?
Retention is one clock among several. The same California framework sets deadlines for completing, correcting, releasing, and storing the record, and those are the requirements a surveyor can check during an unannounced inspection without waiting six or ten years to do it:
- Documentation must be completed and authenticated within 30 days following discharge, transfer, or death.
- Errors must be corrected within 48 hours of discovery, as structured, signed, timestamped addenda that stay distinct from the original entry rather than overwriting it.
- A copy of the record must be provided to a patient within 15 days after a valid request for release of information.
- Records may be stored off site only where the regulatory requirements are met and CDPH approval has been obtained where it is required.
The confidentiality standards in the new framework are expressly aligned to the Confidentiality of Medical Information Act, so the state privacy statute and the state licensing standard now point in the same direction (Link to: [Cybersecurity for Home Care Agencies, pending]). For agencies that have treated CMIA and licensing as separate compliance tracks, they are now one.
5. Does HIPAA’s Six-Year Rule Apply to Hospice Clinical Records?
No. HIPAA’s six-year rule applies to the agency’s own paperwork, not to patient charts. Under 45 CFR 164.530(j)(2) the covered entity must retain its Privacy Rule documentation for six years, and under 45 CFR 164.316(b)(2)(i) the same period applies to Security Rule policies and procedures. Neither provision has ever governed clinical records.
This is the single most expensive misreading in hospice record retention. An agency applies the HIPAA six-year rule to charts, lines it up with the federal hospice six-year period, and destroys records years before either the federal or the California period has actually run. In California, destroying a chart at six years is now four years early.
6. Does the 50-Year Protection Period Mean You Must Keep Records for 50 Years?
No. HHS stated in the final rule that the 50-year period of protection for a decedent’s information is not a record retention requirement, and that covered entities may destroy such records at the time permitted by state or other applicable law. Protection and retention answer different questions, and the HIPAA rules for deceased hospice patients cover the protection side.
One consequence is worth stating plainly. A record you are permitted to destroy is still fully protected until you actually destroy it. Reaching the end of the retention period does not relax access controls, does not end the minimum necessary standard, and does not make an old chart safe to leave on a shared drive while somebody decides what to do with it.
7. How Long Must a Hospice Keep Ordering and Certifying Documentation?
Seven years from the date of service. Under 42 CFR 424.516(f), a provider furnishing covered ordered, certified, referred, or prescribed Part A or Part B services must maintain the documentation relating to those written orders, certifications, referrals, prescriptions, and requests for payment for seven years, and must provide access to it on request from CMS or a Medicare contractor.
Read what that provision is before applying it. It is a condition of maintaining Medicare enrollment rather than a clinical record rule, so it does not extend the 418.104(d) period for the chart as a whole, and any guidance describing it as a general seven-year patient record requirement is overstating it. The practical point still stands: it reaches the certification of terminal illness directly, so a hospice that purges everything at six years loses documents it is separately required to produce.
8. Do All Records in a Hospice Follow the Same Retention Clock?
No, and assuming they do is how combined agencies get caught. At least four separate clocks run inside a California hospice that also operates a home health line, and a single retention policy written to one of them will be wrong for the others:
- Hospice clinical records: six years after death or discharge under 42 CFR 418.104(d), or at least ten years in California.
- Home health clinical records: five years after discharge under 42 CFR 484.110(c)(1).
- Ordering and certifying documentation: seven years from the date of service under 42 CFR 424.516(f).
- Personnel records: at least four years after the individual’s separation from employment under the California framework.
Agencies running both service lines tend to adopt whichever number they learned first and apply it across the organization. Write the policy by record type instead, and state the clock, the trigger date, and the authority for each one, so the person executing it in 2032 does not have to reconstruct the reasoning.
9. How Should a Hospice Destroy Records Securely at the End of the Period?
Destroy securely and document the destruction. The ability to show what was destroyed, when, by whom, and under which authority is what answers a later request, whether that request comes from a surveyor, a payer, or a family. An undocumented destruction and a lost record look identical from the outside.
The practical difficulty is knowing what you are actually destroying. Consider an administrator asked for the chart of a patient who died in 2019, held in an electronic medical record the agency stopped using in 2023. The record may exist in an export, in a migration file, in SharePoint, or in a Microsoft 365 mailbox, and a deletion performed in the current system reaches none of those copies.
Bring backups and archives inside the retention schedule for the same reason. California’s framework requires electronic health records to be backed up at least every 24 hours and to carry an audit trail tracking authorship, dates, times, and corrections, which means a record deleted in the live system can persist in a backup that nobody ever mapped. Our guidance on backing up Microsoft 365 and Google Workspace data and on building an ePHI asset inventory covers how to find those copies before a retention decision depends on them.
10. How Can an IT Partner Help With Hospice Record Retention?
An IT partner cannot set your retention policy. The periods come from federal rule, state licensing regulation, and Medicare enrollment conditions rather than from a system setting, and choosing them is the agency’s decision. What an IT partner supplies is the ability to execute and prove whatever policy you set.
In practice that comes down to four things:
- An audit trail that can show what happened to a record and who reached it.
- Access controls and exports that survive a change of electronic medical record platform.
- The ability to produce a chart from a system the agency no longer uses.
- Documented, verifiable destruction when the retention period ends.
Documentation timeliness belongs on that list too. California’s 30-day completion and 48-hour correction windows are system behaviors before they are staff behaviors, and a workflow that surfaces an incomplete record on day 25 prevents a finding that a reminder email does not.
Agencies should expect an IT provider to help support HIPAA compliance rather than to hold it. One question sorts the field quickly: do you work with hospices specifically, or with medical practices generally? Hospice carries record clocks, survey exposure, and workforce categories that a medical practice does not.
“The agencies that get hurt here are not careless. They picked a number years ago, wrote it into a policy, and never looked at it again. This is where having a strong technical partner with home hospice experience adds value. They can help you stay on top of your technical requirements as well as build and maintain the infrastructure needed to meet those requirements.”
Brendan Duebner, President of IT Total Care
Need Help Making Your Retention Policy Match the Record?
IT Total Care works with hospice, home health, and home care agencies throughout the San Francisco Bay Area on the systems a retention policy depends on: audit trails, access control that outlasts a platform migration, backup and archive visibility, and documented destruction. Our home-based care IT support covers the infrastructure side of record obligations, and you can read more about our approach to healthcare IT.
Who may receive a record after a death is a separate question, answered in our article on the HIPAA rules for deceased hospice patients, and workforce obligations are covered in our guide to training hospice volunteers on HIPAA.
Contact Us to talk through what your agency needs.
