How Long Must a Dietitian Keep Client Records in the US? HIPAA Does Not Say

Does HIPAA require dietitians to keep client records for six years?

No. HIPAA sets no medical-record retention period at all. The six years that appears in nearly every retention chart is the time limit in 45 CFR 164.316(b)(2)(i), which requires a covered entity to "retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect". Paragraph (b)(1) is about "the policies and procedures implemented to comply with this subpart". The Privacy Rule carries an identical six-year clock at 164.530(j)(2), again for policies, communications and required designations.

HHS has answered the question directly. Its FAQ 580 states: "No, the HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained." What HIPAA does require is that safeguards apply "for whatever period such information is maintained", including through disposal.

A 2010 CMS Medicare Learning Network podcast on record retention prints an accurate sentence, "HIPAA rules require a Medicare Fee-For-Service provider to retain required documentation for six years", under the heading "How long should medical records be retained?" The sentence is about required documentation, not medical records, and vendor pages have repeated the heading ever since.

Whether HIPAA governs the practice at all is a separate question with a narrower answer than most guidance gives. See whether a private-practice dietitian is a HIPAA covered entity.

What does Medicare require a dietitian to keep, and for how long?

Seven years of ordering and referral documentation, on the face of the regulation. 42 CFR 424.516(f) requires “a provider or a supplier that furnishes covered ordered, certified, referred, or prescribed Part A or B services” to “maintain documentation for 7 years from the date of service”, and defines that documentation as the written and electronic records “relating to written orders, certifications, referrals, prescriptions, and requests for payments”. Medicare medical nutrition therapy is available only on physician referral, so a dietitian furnishing it is a supplier of a referred Part B service and the referral file is exactly what the rule names. No CMS statement applying the rule to dietitians by name was located, but nothing in its words excludes them. The duty is scoped to the order, referral and payment-request documentation, not the whole clinical chart. The referral rules, and what Medicare pays, are in which US insurers cover dietitian services.

Medicare Advantage adds a ten-year horizon by a different route. The plan itself must keep its records for ten years, and must require its first-tier and downstream contractors to agree that HHS's audit right "will exist through 10 years from the final date of the contract period". That flows to a dietitian through the participation agreement they sign with the plan, not through the Code of Federal Regulations, so the period that binds is the one written in the contract.

Two other federal numbers are facility rules and do not reach a solo practice: the five years after closure of a cost report, and the hospital conditions of participation. The False Claims Act's limitation period, which runs to "in no event more than 10 years after the date on which the violation is committed", is not a retention duty, but it is the practical reason billing records are commonly kept for a decade.

Which states set a record-retention period for dietitians?

Of the sixteen states examined, one binds the chart itself. New York's Board of Regents rule on unprofessional conduct applies to every profession "licensed, certified or registered" under Title VIII, and its enumeration names "dietetics/nutrition" expressly. Under it, "all patient records must be retained for at least six years", and records of minor patients "for at least six years, and until one year after the minor patient reaches the age of 21 years". The rule is written for dietetics rather than borrowed from physicians, and it reaches certified dietitian-nutritionists even though New York certifies rather than licenses the profession.

Michigan will be the second. Its Public Health Code requires every Article 15 licensee to keep each patient record "for a minimum of 7 years from the date of service to which the record pertains", with no minors provision. Dietitian licensure was added by 2024 PA 39, effective April 2, 2025, but no license has yet issued, and until one does no Michigan dietitian is a "licensee". The Michigan Academy of Nutrition and Dietetics gives October 17, 2027, as the deadline for applications and October 27, 2027, as the start of the practice restriction.

Everywhere else the answer is that no dietitian retention period exists, and the reason varies. Florida’s dietetics rule requires written patient records with assessment, counseling plan and progress notes, and states no term. Pennsylvania, which licenses dietitian-nutritionists under its State Board of Nursing, requires records “in accordance with the acceptable and prevailing standard of recordkeeping”. Ohio’s standards require documentation that is “complete, relevant, accurate and timely”. Illinois’s practice act requires “appropriate record retention” and defines neither the period nor the event. Georgia, North Carolina and Massachusetts have board rules that reach confidentiality and nothing further. Texas is the one state where a second rule applies. Its board rules reach confidentiality only, but Texas’s telehealth standards for dietitians require a licensee to keep documentation of consent, data collection and data sharing for at least five years, or as long as the program’s own rules require. The duty covers telehealth records, not the chart, and binds only a dietitian who holds the Texas license. Washington’s only duty is one year following receipt of an authorization to disclose. California has no board and no rule. New Jersey has a licensing statute and, as of September 2026, no licenses and no board regulations. Colorado, Virginia and Arizona do not regulate the profession at all.

Why do retention charts say Texas 7 years and Florida 5 years?

Because they copy physician and hospital rules into the dietitian row. The "Texas 7 years" figure is the Texas Medical Board's rule for physicians, which was repealed effective January 9, 2025, and never bound dietitians in the first place. The Texas licensing department's own dietitian records page points readers to the state privacy chapter and names no period. "Florida 5 years" is the Board of Medicine's rule for a physician relocating or closing a practice. The dietetics council's own rule requires records and states no term. Georgia's ten years binds physicians. North Carolina's eleven years binds hospitals. Washington's hospital rule is now 26 years, not the ten still printed on most charts, and binds hospitals only.

Two states are traps in the opposite direction. Arizona's statute reads like a general "health care provider" rule with a six-year period, but its definition of provider is restricted to persons "licensed pursuant to title 32", and Arizona licenses no dietitians, so the rule reaches no solo dietitian in the state. Virginia's general records statute hooks on a credential issued by one of the Department of Health Professions boards, none of which regulates dietetics, and the statute sets no retention period in any case.

How long should a dietitian actually keep records?

Long enough to defend a claim, which in most states is longer than any rule requires of a dietitian. Retention floors and limitation periods run on different clocks. New York's malpractice period is two years and six months from the act or the end of continuous treatment, but the infancy toll can run up to ten years after the cause of action accrues, and medical malpractice is expressly carved out of the exception to that cap. A New York practice that destroys a child's chart at the six-year minimum, or an adult's at six years, can find itself defending a live claim with no record.

California's MICRA period is three years from injury or one year from discovery, whichever comes first, with a minors rule that can run to the child's eighth birthday. Whether it applies to a California dietitian at all is unresolved, because its definition of "health care provider" uses the same "licensed or certified pursuant to Division 2" phrase whose reach to dietitians is unsettled; if it does not, ordinary negligence periods apply instead. For billing records the federal False Claims Act's ten-year outer limit is the horizon most practices that bill Medicare plan around.

The Academy of Nutrition and Dietetics publishes no client-record retention period. Its closest guidance, a 2021 practice article, says each private practice should maintain "a comprehensive medical records retention policy" with a retention schedule, and gives no number. The retention period is therefore a policy decision, informed by the state rule where one exists, the payer contracts the practice has signed, and the limitation periods it could face.

Records of minors deserve their own line in that policy, because the only binding dietitian rule found, New York’s, treats them differently from adults, and most limitation periods are tolled during minority. The Canadian rules run on entirely different clocks: see how long a Canadian dietitian must keep client records. Licensure, privacy, entity and tax are among the other state rules a new practice has to settle.