How long to keep therapy and treatment records in Texas, by license type

Retention by license type

Texas has no single records-retention law for every provider. Each license follows its own board's or agency's rule, and a facility license adds its own on top of the clinicians' rules. Texas's age of majority is 18, so "5 years after the client reaches the age of majority" means age 23.

Who	Minimum to keep records	Source
Licensed professional counselors (LPC, LPC Associate)	7 years after services end, or until a minor client turns 23, whichever is later.	Behavioral Health Executive Council (BHEC) guidance, Ethics and Practice FAQs; confirm in 22 TAC chapter 681
Marriage and family therapists (LMFT, LMFT Associate)	7 years after termination of services, or 5 years after the client reaches the age of majority, whichever is greater.	22 TAC 801.48
Social workers (LCSW, LMSW, LBSW)	The same BHEC standard: 7 years, or until a minor client turns 23, whichever is later.	BHEC guidance; confirm in 22 TAC chapter 781
Psychologists	7 years after termination of services, or 5 years after the client reaches the age of majority, whichever is greater, unless another law requires longer.	22 TAC 465.22
Licensed chemical dependency treatment facilities (IOP, PHP, residential SUD programs licensed by HHSC)	At least 6 years; adolescents' records at least 5 years after the client turns 18. Keep a log of destroyed records.	26 TAC 564.508(h)–(i)
LCDCs in private practice	We couldn't confirm a separate retention period for individual LCDCs as of this update. Records you keep in a licensed facility follow the facility's rule. On your own, use the BHEC standard (7 years / age 23) as a floor and confirm with HHSC, which licenses LCDCs.	Check with HHSC's counselor licensing program
Physicians (including psychiatrists)	7 years from the last treatment; for a patient last treated before 18, until age 21 or 7 years, whichever is longer. Confirm the current text with the Texas Medical Board.	Texas Medical Board rule, 22 TAC 165.1
Nurse practitioners	Follow the Board of Nursing's rules, your delegating physician's practice policy and your payer contracts; when in doubt, use the longest that applies.	Check with the Texas Board of Nursing
HIPAA documentation (everyone)	6 years from creation or last effective date: policies, risk analyses, BAAs, training records, breach files. This isn't a rule for the clinical record itself.	45 CFR 164.316(b)(2), 164.530(j)

Supervision records: BHEC's supervision FAQ says its rules don't set a retention period for them. Keep them at least as long as the clinical records they relate to, since they show who was responsible for the care.

Keep-until calculator

Enter the client's date of birth and the date of their last service or discharge. The date is the earliest the record may be destroyed under that rule, if nothing else (a payer contract, a hold, a pending request) requires longer.

Whose rule LPC, LMFT, LCSW or psychologist (BHEC) Licensed SUD treatment facility (HHSC) Physician (Texas Medical Board) Our program's policy (7 years / age 25) Date of birth Last service or discharge

Enter the last service or discharge date to see the keep-until date.

The calculator runs in your browser; nothing you type is sent or saved. It doesn't know about payer contracts, holds or other laws.

Minors, worked out

The minor rules are where practices most often get it wrong, because the clock can run years past the usual one. Three examples with made-up dates:

Client	Rule	Keep until
Adult, last seen March 1, 2026	BHEC (7 years)	March 1, 2033
12-year-old, born January 10, 2014, last seen January 10, 2026	BHEC: 7 years (2033) or age 23 (2037)	January 10, 2037: age 23 is later
15-year-old in an SUD program, born March 2, 2011, discharged September 15, 2026	26 TAC 564.508: 6 years (2032) or 5 years after 18 (2034)	March 2, 2034. Under our program's stricter policy (7 years or age 25): March 2, 2036

Our own licensed SUD program keeps adult records 7 years from discharge and minors' records until age 25, whichever is later. That's longer than the state's facility minimum, and it covers the BHEC rule for the counselors who work in the program, so one date works for every chart.

When you must keep records longer

• Payer contracts. Many contracts set their own retention period. Medicare Advantage plans must keep records for 10 years (42 CFR 422.504(d)) and pass that down to the providers they contract with. Read the records clause of each contract you sign; our credentialing team checks it in every contract review.
• Legal holds. When you learn of a lawsuit, investigation, audit or subpoena, or reasonably expect one, stop destroying the records involved until it's over, whatever the retention date.
• Pending requests. Don't destroy a record while a client's request for it, or a request to amend it, is open.
• Federal programs and grants may set their own periods in the award terms.

The simplest policy is one period for every chart that meets the longest rule you're under, written into your records policy and applied by your EHR. In Cima EHR that's a keep-until date on every discharged chart.

Where records must be kept

• In the United States. Since January 1, 2026, Texas requires electronic health records to be stored physically in the US, including by vendors and cloud services (Health and Safety Code chapter 183, added by SB 1188). Ask your EHR, backup and file-storage vendors where the data sits.
• Licensed SUD facilities: 26 TAC 564.508(b) says original client records are kept in Texas and active records at the facility, protected from loss, tampering and unauthorized access, with reliable backup for electronic records. If you use a cloud EHR, ask HHSC how it applies the in-Texas language to your setup and keep its answer.
• Retrievable for the whole period. A record you can't produce for a surveyor, a client or a court doesn't count as kept. That's the trap when you change EHRs (see below).

Destroying records the right way

1. Run a destruction list from your EHR or files: every chart past its keep-until date with no hold and no open request.
2. Have the privacy officer approve the list.
3. Destroy so the records can't be read or rebuilt: cross-cut shredding, pulping or burning for paper, or a shredding vendor that signs a BAA and gives a certificate of destruction. For electronic media, follow NIST SP 800-88: clear, purge or physically destroy the drive. Deleting a file or emptying the trash isn't destruction. HIPAA requires safeguards for disposal (45 CFR 164.310(d)(2)(i)).
4. Log it. A licensed SUD facility must keep a log of destroyed records with the client's name, record number, date of birth and admission and discharge dates (564.508(i)). Every practice should keep one, with the date, method and who did it. Keep the log permanently.

When a practice or program closes

Closing doesn't end the duty to keep records or to answer requests for them. Before the doors close:

• Name a custodian of records: you, a colleague or a records storage company under a BAA. Put the arrangement in writing, and include how long they'll keep the records and how clients reach them.
• Tell clients how to get their records and where the records will be kept. Check whether your board requires a specific notice, and give active clients a copy or send records to their new provider with their signed release.
• Substance use programs follow 42 CFR 2.19: on closing or being taken over, a program removes patient-identifying information or destroys the records unless the patient consents to transfer them to the new program, or a law requires them to be kept. Records kept for that reason are sealed or stored encrypted, labeled with the program's name, the law requiring them and the destroy-by date, then destroyed on that date. Our Part 2 guide has the details.
• Licensed facilities discharge or transfer every client before closing (26 TAC 564) and notify HHSC as its rules require.
• Keep access to the EHR, or export everything first. Don't let an EHR subscription lapse with records you still have to keep inside it.

Our guide to starting a private practice in Texas covers the policies you'll want in place from day one, including the records policy.

Getting your records out of an EHR

Switching EHRs or closing is when records get lost. The retention clock keeps running on charts you've left behind in an old system. Before you cancel:

1. Read the contract's exit terms: how long you can export after canceling, in what formats, and whether there's a fee.
2. Export everything: the structured data (clients, visits, diagnoses, claims) and every chart as PDF, with signatures, dates and addenda visible. Ask for the audit trail too; a chart without its signature history is weaker evidence.
3. Check the export opens and spot-check ten charts against the old system before you lose access.
4. Store it encrypted, in the US, somewhere only you control or with a vendor under a BAA, with a note of what it contains and its destroy-by date.
5. Bring current clients' key documents (intake, latest treatment plan, releases) into the new system.

Our guide to switching EHRs lays out the whole cutover in about two weeks.

How Cima keeps records

We built Cima EHR around the records policy our own program follows:

• A keep-until date on every discharged chart: 7 years from discharge, or the client's 25th birthday if that's later, which meets or beats the Texas minimums in the table above. Cima never deletes a chart on its own; the date tells you when you may.
• Legal holds show as a red notice at the top of the chart, and while a hold is on, Cima never treats the chart as clear to destroy, whatever its date. Placing and releasing a hold are logged.
• Nothing is deleted. Signed notes are locked; a mistake is marked "entered in error" and corrected by a dated addendum. Forms a client signs on their phone are kept exactly as sent.
• Exports any time: the whole practice in one file (every client, visit, note with its signatures, claim, payment and the access log), any client's chart as a PDF, or a client's record as data when they ask for an electronic copy. Each export is logged.
• After you cancel, nothing is deleted: you can still sign in, read and export. When the service ends, records stay available to export for at least 90 days, then are returned or destroyed, as our Business Associate Agreement says.
• Backups are encrypted and kept 6 years, hosted in the US. See how Cima protects records.

Questions

How long do LPCs have to keep records in Texas?

The Behavioral Health Executive Council's guidance is at least 7 years after services end, or until a minor client turns 23, whichever is later. Confirm the current text of the LPC rules in 22 TAC chapter 681, and keep longer if a payer contract requires it.

How long must Texas keep a minor's therapy records?

For LPCs, LMFTs, LCSWs and psychologists: 7 years after the last service or until the client turns 23, whichever is later. For a licensed chemical dependency treatment facility: at least 5 years after the client turns 18, and at least 6 years in all. For physicians: until 21 or 7 years, whichever is longer.

Does HIPAA say how long to keep medical records?

No. HIPAA requires keeping its own documentation (policies, risk analyses, BAAs, training records) for 6 years, but the retention period for the clinical record comes from state law, your licensing board and your contracts.

Can I shred paper records after I scan them?

Usually, if the scan is complete, legible, kept in a secure system for the full retention period and your policy says the scanned copy is the record. Licensed SUD facilities should check 26 TAC 564.508's requirement that original records stay in Texas. Keep a log of what was scanned and shredded.

What do I do with records when a therapist leaves a group practice?

Records usually belong to the practice, not the therapist, so they stay with the practice under its retention policy. Put that in each clinician's agreement, and let clients choose to have copies sent to a departing therapist with a signed release.

Who keeps the records if a solo practitioner dies?

Whoever the practitioner named as custodian of records, which is why a written custodian plan matters. Without one, the estate inherits the problem. Name a custodian, give them access, and tell your board if its rules require it.

Sources

• Texas Behavioral Health Executive Council, Ethics and Practice FAQs, Supervision FAQs and 2024 rule changes
• 22 TAC 801.48 (marriage and family therapists); 22 TAC 465.22 (psychologists)
• 26 TAC 564.508 (licensed chemical dependency treatment facilities)
• eCFR, 45 CFR 164.316, 164.310, 42 CFR 422.504 and 42 CFR Part 2 (including 2.19)
• SB 1188 (2025), Texas Health and Safety Code chapter 183
• NIST, SP 800-88, Guidelines for Media Sanitization