Closing a medical practice: what can ever be licensed?

Of every industry on this list, a closing practice has the least room. Patient records are protected health information, they have state retention periods, and the practice must plan for where they go. What is left is narrow: front-office workflows, scheduling patterns with no patient detail, policy manuals and internal training material. A practice that wants to license anything built on patient records needs de-identification to a legal standard first.

What's my data worth?

Rules to read first

The federal standard is at 45 CFR 164.514. Retention of the chart itself is a state question, and it is the first one to answer.

Source	What it asks of a closing practice
45 CFR 164.316(b)(2)	HIPAA policies and required documentation are kept for six years from the date they were created or last in effect, whichever is later. This covers the practice’s documentation, not the medical records themselves.
45 CFR 164.514	Health information counts as de-identified only through Safe Harbor, which removes 18 kinds of identifiers, or through an expert’s written determination that the risk of identification is very small.
State medical records law	Each state sets how long a practice keeps patient records and what it must do when it closes: notice to patients, a named custodian and often a notice to the licensing board.

What is not patient data

Even these need a read-through. Staff emails drift into patient detail, and a scheduling export can hold a date and a diagnosis code on the same row.

Policy and procedure manuals, including how the front desk handles insurance questions.
Training material for new staff.
Scheduling templates and capacity patterns, with no patient names or dates of service.
Internal memos on workflow changes and how they were decided.
Vendor and supply correspondence.

Where it sits, and the trap

A practice’s records live in an electronic health record, a practice management system, a patient portal and email. The trap in a closing is the health record vendor: the practice often cancels the subscription and loses access to charts it must still keep. Ask the vendor about a read-only archive, a data transfer to a named custodian and the cost of each, before the final month.

If a license of de-identified patient data is ever considered, it needs the HIPAA method documented, a re-identification test on the result and a written promise from the buyer not to re-identify. See the United States rules and the page on de-identification.

What stays out

Record	Why it stays out
Charts, notes and test results	Protected health information with state retention periods.
Billing and claims with patient identifiers	They tie a person to a diagnosis and an insurer.
Patient portal messages	They are patient communications.
Images and recordings of patients	They identify a person by face or voice.

Questions about closing a medical practice: what can ever be licensed?

Is the six year HIPAA period the chart retention period?

No. It covers HIPAA policies and required documentation. Chart retention is set by state law and by payer contracts.

Can we license de-identified patient notes?

Only if the data meets the federal standard through Safe Harbor or an expert determination, the state allows it and the practice has the right to release it. Most closing practices decide not to.

Who holds the records after we close?

A custodian named in the closing plan, often another practice or a records storage company, as your state requires.

Didn't find your question? Ask us directly.