For how many years must records containing personal health information be retained?

The correct answer is that records containing personal health information must be retained for 10 years, or until the patient reaches the age of 20 if they were a minor at the time of treatment. This retention period is based on the need to ensure that health information is available for appropriate follow-up care and for legal and administrative purposes.

For adults, retaining records for 10 years is a standard practice intended to provide a sufficient window for any potential inquiries or issues that may arise after treatment. In the case of minor patients, the age of 20 is used to allow continued access to their health information as they transition into adulthood, ensuring continuity of care.

This approach balances the need to safeguard personal health information and the practical considerations of healthcare delivery, allowing access to important medical histories while also addressing privacy concerns. Retention periods that are too short could hinder ongoing patient care, while indefinite retention may pose privacy risks and administrative burdens.