Getting and keeping medical records: access, retention and spoliation

Almost every malpractice question is answered, or left unanswerable, by the record. Before anyone can say whether care was reasonable, someone has to obtain the chart, confirm it is complete, and make sure the parts that matter will still exist when the dispute is decided. This chapter covers the practical law of that process in California: how patients and their representatives obtain records and on what timelines; how attorneys obtain them before and after a case is filed; how long providers must keep them; and what happens when records are lost, altered or destroyed.

The companion chapter on medical records as evidence explains how to read a record once it is in hand — the difference between the clinical timeline and the documentation timeline, audit trails, late entries and corrections. This chapter is about getting there.

The patient's right of access under California law

California's Patient Access to Health Records Act (Health and Safety Code sections 123100 and following) gives adult patients, and specified representatives, a right to inspect and obtain copies of their records from health care providers.

• Inspection. A provider must permit inspection during business hours within five working days after receiving a written request.
• Copies. A patient or personal representative is entitled to a paper or electronic copy of all or part of the records they may inspect, on a written request specifying the records and payment of the permitted fee. The provider must transmit the copies within 15 days after receiving the request.
• Fees. The statute allows fees to defray the costs of producing copies or a summary, and requires records to be provided without charge in specified circumstances, including where they are needed to support certain appeals for public-benefit eligibility.
• Summaries. In some circumstances a provider may prepare a summary of the record instead of copies, subject to the statute's content and timing requirements.
• Minors. A minor may inspect records relating only to care for which the minor could lawfully consent; parents' access to those records is limited correspondingly.
• Mental health records. A provider may decline to permit inspection or copies of mental health records if the provider determines there is a substantial risk of significant adverse or detrimental consequences to the patient, but must document the reasons and allow the patient to designate a licensed professional to inspect or receive the records.
• Addenda. A patient who believes a record is incomplete or inaccurate may submit a written addendum of limited length about each disputed item, which the provider must attach to the record.

Requests should be in writing, dated, and specific: the date range, the types of records (office notes, hospital records, imaging reports and images, laboratory results, medication administration records, nursing notes, messages and portal communications), and the format requested. Keeping a copy of the request and proof of the date it was received creates a record of the timeline.

The federal HIPAA right of access

The HIPAA Privacy Rule (45 C.F.R. § 164.524) gives individuals a parallel federal right to access their "designated record set," generally within 30 days of the request, with one 30-day extension if the covered entity explains the delay in writing. Covered entities must provide the information in the form and format requested if readily producible, including electronically, and may charge only a reasonable, cost-based fee for copies. Where California law and HIPAA differ, the rule more protective of the patient's access generally governs in practice, so California's shorter 15-day period for copies usually controls for California providers.

Two practical points follow. First, the designated record set is broader than the printed "chart": it includes billing records and other records used to make decisions about the individual. Second, it is not unlimited: audit logs, system metadata and internal quality materials are usually not part of the designated record set. They are obtained, if at all, through discovery once a case is pending.

Requests by attorneys before and after filing

Before a case is filed. Evidence Code section 1158 allows an attorney (or the attorney's representative) holding a written authorization signed by the adult patient — or by a guardian, conservator, parent or personal representative as the statute provides — to inspect and copy the records of a physician, hospital or other listed medical provider before any action is filed or any defendant appears. Failure to make the records available during business hours within five days after the authorization is presented can expose the provider to costs and attorney fees if a later action is needed to obtain them. Section 1158 is a common first step in pre-suit evaluation, because the 90-day notice and the statute of limitations leave little time to assemble a chart.

After a case is filed. Records of non-parties are usually obtained by deposition subpoena for business records. Because medical records are "personal records" of a consumer, Code of Civil Procedure section 1985.3 requires that the patient receive notice and an opportunity to object before records are produced in response to a subpoena. Records of parties are obtained through ordinary discovery: requests for production, inspection demands, and, where the integrity of the electronic record is disputed, targeted requests for audit trails and system information.

Deceased patients. Records of a deceased patient are generally available to the personal representative of the estate, and the persons entitled to bring wrongful death and survival claims often need them before a representative has been appointed. The authority of the requester should be documented to avoid delay.

Confidentiality: the CMIA and its limits

California's Confidentiality of Medical Information Act (Civil Code sections 56 and following) restricts disclosure of medical information by providers, plans and contractors without authorization, subject to many listed exceptions (including disclosures compelled by court order or subpoena, and disclosures for treatment and payment). For malpractice practice, the CMIA matters in three ways: it governs whether a provider may release records to a family member or attorney without proper authorization; it shapes how defense counsel and insurers obtain records from other treating providers; and it supplies remedies when information is improperly disclosed — a separate claim from malpractice. The 2026 amendments enacted by AB 1979 (Statutes of 2026, chapter 854) add provisions relating to artificial intelligence that take effect January 1, 2027; they are discussed in clinical AI accountability.

How long records must be kept

California has no single statute setting a retention period for every physician's office records, and the absence is often misunderstood. The applicable rules depend on the type of provider, the payer and the circumstances:

Retention is a floor, not a destruction instruction. A provider who knows of an adverse event, a complaint, a records request from an attorney, a Medical Board inquiry or a lawsuit must preserve the relevant records — including electronic data, audit trails and messages — regardless of whether a routine retention period has expired. Malpractice insurers commonly recommend keeping adult records well beyond the statutory minimum, and minors' records longer still, because the limitation periods for minors can run years after the care.

A physician who leaves a practice, closes a practice or retires should make arrangements, in writing, for custody of records and for patients' continued access. When the practice is a group or employer, the records ordinarily remain with the entity, but the physician's access for defending a later claim or responding to a Board inquiry should be addressed before departure.

Spoliation: what happens when records are lost or altered

California does not recognize a separate tort claim against a party for intentionally destroying evidence relevant to the litigation. In Cedars-Sinai Medical Center v. Superior Court (1998) 18 Cal.4th 1, the Supreme Court declined to create that tort, reasoning that existing remedies are adequate. Those remedies are substantial:

• An adverse inference. Evidence Code section 413 permits the jury to consider a party's willful suppression of evidence, and the pattern instruction (CACI 204) allows the jury to conclude that evidence a party intentionally concealed or destroyed would have been unfavorable to that party.
• Discovery sanctions. Courts may impose monetary, issue, evidence and in serious cases terminating sanctions for destruction or alteration of evidence once a duty to preserve exists.
• Professional consequences. Altering or creating false medical records with fraudulent intent is unprofessional conduct, and failure to maintain adequate and accurate records is itself a ground for discipline under Business and Professions Code section 2266.
• Limitation periods. Intentional concealment can toll the three-year outer limit of Code of Civil Procedure section 340.5.

Electronic records change the form of these disputes rather than their substance. A late entry, an addendum or a corrected note is not spoliation when it is clearly dated, attributed and preserves the original. Deleting or overwriting content, back-dating, or "cleaning up" a note after learning of a complaint can be. The audit trail usually shows which occurred.

A practical sequence for each reader

Patients and families. Request the complete record in writing from each provider and facility involved, specifying the dates and record types; keep copies of every request and the date sent; request imaging in viewable or native form if it matters; note any gaps. Do not wait for the records before speaking with a California attorney — the limitation periods continue to run.

Physicians and practices. Respond to patient and attorney requests within the statutory periods; do not alter records after a request or complaint; use dated addenda for genuine corrections; place a preservation hold on records, messages and audit data when an adverse event, complaint or claim arises; and confirm that departing clinicians and closing practices have custody arrangements.

Attorneys. Use Evidence Code section 1158 or a HIPAA/Patient Access Act request early; identify every provider and facility, including laboratories, imaging centers and pharmacies; compare the produced record against the expected record set; send a preservation letter that names electronic data, audit trails, messages and device data; and reserve audit-trail discovery for questions the audit trail can actually answer.

Sources

• Health and Safety Code § 123110 (inspection and copies; timelines; fees): official text; § 123145 (records when a licensee ceases operation): official text; the Patient Access to Health Records Act begins at § 123100.
• Evidence Code § 1158 (pre-filing attorney inspection): official text; § 413: official text.
• 45 C.F.R. § 164.524 (HIPAA right of access): eCFR; U.S. Department of Health and Human Services, individuals' right of access guidance.
• California Code of Regulations, title 22, § 70751 (hospital medical records): reproduction (Cornell LII).
• Code of Civil Procedure § 1985.3 (subpoenas for personal records): official text; § 340.5: official text.
• Business and Professions Code § 2266: official text; Civil Code § 56.10 (CMIA): official text.
• Cedars-Sinai Medical Center v. Superior Court (1998) 18 Cal.4th 1: opinion (Justia reproduction); CACI 204: reproduced instruction.

General legal and clinical education; not individual legal or medical advice.