How Long Should You Keep Patient Photos? Rules in the US, UK, UAE, Australia and Saudi Arabia

Keep patient photos for as long as your state’s medical records law requires. HIPAA, the US health privacy law, does not set a number of years. Your state law usually decides. For example, New York’s rule is that patient records must be kept for at least 6 years. In Florida, doctors must keep records at least 5 years after the last contact with the patient.

To set your photo retention period, do these 3 things:

1. Find your state’s medical records rule for your license type, and check the rule for minors.
2. Keep each signed marketing authorization for at least 6 years, as HIPAA requires. This is the form where a patient allows you to use their photo in your marketing.
3. Write the retention period into your clinic’s written policy. Delete photos only after that period has passed.

This guide explains what HIPAA says, how state rules work and when the clock starts. A short section covers the UK, UAE, Australia and Saudi Arabia.

Key principle: HIPAA does not say how long to keep patient photos. It does say you must protect them for as long as you keep them.

Usually, yes. A photo you take to diagnose, plan or check treatment is part of the patient’s record. HIPAA’s “designated record set” includes records used to make decisions about patients (45 CFR 164.501).

So think of a clinical photo as part of the chart. The sections below explain how long to keep the chart. To learn when a photo counts as protected health information, read our guide Are patient photos PHI?.

HIPAA sets no retention period for medical records. HHS says so directly: “the HIPAA Privacy Rule does not include medical record retention requirements.“

HHS adds that state laws “generally govern how long medical records are to be retained.” (HHS FAQ)

HIPAA does set 2 related rules:

• Protect records for as long as you keep them. HHS says you must protect patient information the whole time you hold it, including when you dispose of it. The rule behind this is 45 CFR 164.530(c), which requires appropriate administrative, technical and physical safeguards.
• Keep HIPAA paperwork for 6 years. Policies, procedures and other required documents must be kept for 6 years (45 CFR 164.530(j)(2)). The clock runs from when the document was created or “last was in effect, whichever is later.”

Signed authorizations fall under the 6-year rule (45 CFR 164.508(b)(6)). That includes marketing authorizations for before-and-after photos.

You may have heard “HIPAA says 6 years.” That covers the paperwork, not the photos.

Each state sets its own rule, and it can differ by license type. Here are some examples from state rules:

These rules are about patient medical records. They apply to licensed health professionals, such as doctors, and not to every business. Some also cover nurses and other licensed staff, so check the rule for each kind of licensed professional in your clinic.

Other states use different periods, and some set longer ones for minors. To find yours:

• Check the rule for each license in your practice, such as physicians, nurses and physician assistants.
• Check your state medical board and, for nurse injectors, your nursing board.
• Ask your malpractice insurer. Many recommend keeping records longer than the legal minimum.
• Keep the longest period that applies. If two rules apply, the longer one wins.

Important: If your clinic has locations in more than one state, check the rule in each state. The periods can be different. If you want one policy for every location, use the longest period.

In many states, the count for a patient’s records, including photos kept in the chart, starts from the patient’s last visit or last treatment. Here is what some state rules say:

• Florida: from the last patient contact.
• Texas: from the date of last treatment.
• Pennsylvania: from the date of the last medical service.
• New Jersey: from the date of the most recent entry in the record.

Other states may start from a different date or may not say. To find the rule for your state, check with your state medical board.

If the period starts from the patient’s last visit, returning patients may need their older photos kept for longer. For example, photos taken in 2019 may need to stay with the record while the patient continues receiving care. Keep the full photo history together.

Children’s records may need to be kept longer, based on the patient’s age. The New York example needs care: different rules apply to physicians, hospitals and other health professionals, so “one year after turning 21” should not be presented as the rule for every practice.

There are 2 parts to a marketing photo:

• The clinical original stays in the patient record and follows your state’s rule.
• The marketing copy on your website or social media follows the patient’s authorization.

Keep the signed authorization for at least 6 years (45 CFR 164.508(b)(6)). If the patient withdraws it in writing, stop future marketing use of the photo when your practice receives the withdrawal (45 CFR 164.508(b)(5)). Keep the original clinical photo in the patient record for the required medical-record retention period.

Before you delete anything:

1. Check the retention period has passed for that patient. Count from the date your state’s rule uses, which is often the last visit.
2. Check nothing is open, such as a complaint, a possible legal claim, or a request from a lawyer or your licensing board. If there is, do not delete until it is settled, and ask your insurer or lawyer first, as the malpractice insurer MedPro Group advises.
3. Find every copy, including exports, staff phones, email and backups.
4. Securely remove patient photos before disposing of or reusing a device. Use a method that makes the photos unreadable and prevents recovery. This may involve overwriting the data or physically destroying the device. HHS gives several examples but does not require one specific method.
5. Record what was deleted. Note which patients’ records were deleted, the dates those records covered and when they were deleted.Do not delete patient photos before the required retention period ends just to free up storage. They may be needed later to review treatment or respond to a patient complaint.To help keep patient photos out of staff phone galleries, readIs a phone gallery HIPAA compliant?.

The UK, UAE, Australia and Saudi Arabia each set the rule in a different way.

• United Kingdom: private clinics can use the NHS Code for guidance. UK GDPR also says not to keep data longer than you need it (Article 5(1)(e)).
• Australia: other states and territories may have different rules, so check yours. The Australian privacy regulator lists which privacy laws apply in each state and territory.

Ticking every box does not prove your clinic follows the law. Retention periods differ by state and country. This checklist is general information, not legal advice. Last reviewed: 3rd November 2026.

CureCast is a clinical photo app for plastic surgery, dermatology and medical spas. Photos are saved in the patient’s record, organized by visit date. The audit trail records views, downloads, shares, exports and consent activity, with the staff member, device and time.

Your clinic decides how long to keep photos, based on your state’s rule. CureCast does not decide this for you. CureCast supports HIPAA-compliant workflows and provides a signed BAA, starting from your 14-day trial.

No software makes a clinic compliant on its own. See how CureCast supports HIPAA workflows for US practices.

Does HIPAA say how long to keep patient photos?

No. HIPAA does not set how long to keep medical records. Photos are usually part of the patient record, so your state’s rule usually applies.

Is the 6-year HIPAA rule about photos?

No. The 6-year rule covers the papers HIPAA requires you to keep, such as your privacy policies and each signed marketing authorization. Photos are usually part of the patient record, so your state’s rule decides how long to keep them.

Can we delete old photos to save storage space?

Not before your state’s retention period has passed. A clinical photo is usually part of the patient record, so check your policy, check nothing is open and log the deletion.

Do photos of children need to be kept longer?

Yes, in many states. Clinical photos are usually part of the patient’s medical record, so the longer retention period for children also applies to them. The exact period depends on your state and type of practice. Check the applicable rule before deleting a child’s patient photos.

Do we keep the original photo if a patient withdraws marketing permission?

Yes. Stop using the photo for future marketing but keep the original in the patient’s medical record for the retention period required by your state. Withdrawing marketing permission does not mean the clinical photo should be deleted.

All accessed 3rd November, 2026, except the New Jersey rule and the NHS schedule, which could not be re-opened on that date.

US law and guidance

• HHS FAQ: Does HIPAA require covered entities to keep medical records for any period?: no retention period; state law governs; safeguards apply while records are kept.
• 45 CFR 164.530: (c) safeguards, (j)(1) documentation and (j)(2) 6-year retention period.
• 45 CFR 164.508: authorization, including (b)(5) revocation and (b)(6) documentation.
• 45 CFR 164.501: definition of designated record set.
• HHS FAQ: disposal of electronic media: clearing, purging or destroying media.
• MedPro Group: record retention guideline: keep records when a claim or request is open.

US state rules

• 8 NYCRR 29.2: New York, (a)(3) patient records.
• Florida Administrative Code 64B8-10.002: Florida physicians, (2) 5 years from last patient contact.
• 22 Tex. Admin. Code § 163.2: Texas, 7 years from last treatment.
• 49 Pa. Code § 16.95: Pennsylvania, (e) 7 years from the last medical service.
• N.J.A.C. 13:35-6.5: New Jersey, (b) 7 years from the most recent entry.

Other countries

• NHS England: Records Management Code of Practice: Appendix II retention schedule (guidance, not a law).
• UK GDPR Article 5: (1)(e) storage limitation.
• UAE Federal Law No. 2 of 2019: Article 20, at least 25 years from the last health procedure.
• Health Records and Information Privacy Act 2002 (NSW): section 25, and the IPC NSW fact sheet.
• OAIC: state and territory privacy legislation: which privacy laws apply in each state and territory.
• Saudi Personal Data Protection Law (MISA English text): Article 18, retention and destruction.

CureCast

• HIPAA and clinical photos (US HIPAA page): audit trail coverage and BAA wording.
• Audit trail: what the audit trail records.
• Patient consent form: consent form features.