Patient Records in a Medical Practice Sale: HIPAA Rules Explained

Quick answer: The HIPAA Privacy Rule permits patient records to be disclosed and transferred as part of the sale of a medical practice — both during due diligence and at closing — because these activities fall under HIPAA’s “health care operations.” Records generally remain with the practice as legal custodian; patients own the right to access their records and to have copies sent elsewhere, not the records themselves. Sellers must still handle diligence disclosures carefully, notify patients of the transition, honor transfer requests, and meet state and federal retention requirements — which commonly run five to ten years, and longer for minors.

Patient records are the part of a practice sale where physicians rightly get cautious. Your patients trusted you with the most sensitive information they have, and now that information is part of a transaction. The good news: HIPAA anticipated exactly this situation, and the rules are workable when you know them. Here is what the HIPAA Privacy Rule actually says about records in a practice sale — and what it requires of you before, during, and after.

First, the Ground Rules: What the HIPAA Privacy Rule Does

The HIPAA Privacy Rule is the federal standard governing how protected health information (PHI) can be used and disclosed. Among the hipaa rules, it is the one that matters most in a practice sale. Three of its principles frame everything below:

• PHI can be used and disclosed without individual patient authorization for treatment, payment, and health care operations. The definition of “health care operations” expressly includes the sale, transfer, merger, or consolidation of a covered entity — and the due diligence connected to it. This is the provision that makes a practice sale legally workable.
• The minimum necessary standard applies. Even permitted disclosures should be limited to what the purpose requires. During diligence, that means a buyer evaluating the practice does not need — and should not receive — more identifiable patient data than the evaluation genuinely requires.
• Patients hold defined rights. What the HIPAA Privacy Rule grants to patients includes the right to access their records, to receive copies (generally within 30 days of a request), to request amendments, and to direct copies to another provider. Patients do not own the physical or electronic record — but their access rights survive your sale.

(One clarification worth making, since the terms get conflated: the Patient Safety Rule is a separate regulation dealing with patient safety work product and Patient Safety Organizations. The rule that governs records in your sale is the Privacy Rule.)

Who Owns Medical Records When a Practice Is Sold?

Medical records ownership follows a consistent pattern across most states: the practice — as the legal custodian — owns the record; the patient owns the information rights in it. In a practice sale, custodianship of the records typically transfers to the buyer as part of the transaction, which is what allows continuity of care to survive the ownership change.

Two practical implications:

• Records ordinarily transfer with the practice. The successor physician becomes the new custodian and must protect the records to the same HIPAA standard you did.
• Patients can always vote with their chart. Any patient who prefers a different provider can direct that copies of their records be sent elsewhere — and honoring those requests promptly is both a HIPAA obligation and a professionalism signal during the transition.

State law adds detail on top of this — some states have specific requirements for notice, custodianship, and record handling in a sale or closure — so your health-care attorney should confirm the rules for your state before closing.

HIPAA and Due Diligence: What You Can Share With a Buyer

Due diligence is where sellers most often get nervous, and where the rules are most misunderstood. Because sale-related diligence sits inside HIPAA’s health care operations definition, you may share information a buyer legitimately needs to evaluate the practice — but the how matters:

• Confidentiality agreements first. NDAs before any information changes hands — standard practice in a professionally run sale, and doubly important where PHI is concerned.
• De-identify where possible. Most of what a buyer needs — volumes, payer mix, visit patterns, panel demographics — can be provided in aggregate or de-identified form. Lead with that.
• Minimum necessary, always. Where identifiable information is genuinely required, limit it to what the evaluation demands, restrict who sees it, and document the safeguards.
• Use appropriate agreements with third parties. Advisors, consultants, and others handling PHI on the practice’s behalf during the process should be under business associate agreements as required.

Handled this way, diligence is routine. Handled loosely — spreadsheets of identifiable patient data emailed around — it becomes the compliance finding that stalls your own deal.

The Transfer of Medical Records at Closing

The medical records transfer itself is a project, and the deals that go smoothly plan it like one:

• Put it in the purchase agreement. Which records transfer, in what format, who bears migration costs, how legacy paper charts are handled, and what access the seller retains for defense of claims, audits, and billing follow-up.
• Plan the EHR migration early. System-to-system transfers take time, and data integrity through the migration is a patient-safety issue as much as an IT one.
• Notify patients of the transition. A planned communication tells patients who the successor is, that their records will remain with the practice, and how to request a transfer of medical records elsewhere if they prefer. A simple medical records transfer form (or your state’s authorization form) makes honoring those requests fast and documented.
• Keep continuity of access. Patients’ right to access their records — generally within 30 days of a request — does not pause for your closing. Someone must be responsible for fulfilling requests at every point in the transition.

Medical Record Retention: How Long, and Whose Job Is It Now?

Medical records retention requirements come from several overlapping sources, and the safest rule is simple: the longest applicable requirement wins.

In a sale, the purchase agreement should assign retention responsibility explicitly — usually to the buyer as successor custodian, with defined seller access rights. If a practice closes rather than sells, a records custodian arrangement is required instead; but in a well-run sale, retention transfers with custodianship.

A Records Checklist for Sellers

• Confirm your state’s retention period and notice requirements with your health-care attorney.
• NDAs and, where applicable, business associate agreements in place before diligence begins.
• Diligence data de-identified or aggregated wherever the purpose allows.
• Records transfer, format, migration costs, and seller access rights written into the purchase agreement.
• Patient transition notice drafted, with a records transfer request path (form + contact) included.
• A named owner for records requests at every stage of the transition — no gaps.

Records compliance is one workstream inside a larger, sequenced sale process — the full sequence is here: How to Sell Your Medical Practice: A Complete Step-by-Step Guide. It is also exactly the kind of detail where specialist guidance earns its keep: an experienced Medical Practice Broker coordinates diligence and transition mechanics like these with your attorney so nothing surfaces at the closing table.

Key Takeaways

• The HIPAA Privacy Rule permits records disclosure and transfer in a practice sale — sale and diligence sit inside “health care operations” — but the minimum necessary standard still applies throughout.
• The practice owns the record as custodian; patients own the right to access it and to send copies elsewhere. Both survive the sale.
• Diligence done right: NDAs first, de-identified data wherever possible, identifiable PHI only where genuinely necessary and safeguarded.
• Retention is layered — HIPAA documentation (6 years), state medical-record periods (commonly 5–10 years, longer for minors), and payer rules. The longest applicable requirement wins, and the purchase agreement should assign the obligation explicitly.
• Patient notification and a working records-request path are not courtesies — they are obligations, and they are also what a respectful transition looks like.

The Bottom Line

Your patients’ records are the most sensitive asset that changes hands in a practice sale — and the law is built to let that happen safely when the process is run with care. Plan the records workstream as early as the valuation, put the mechanics in writing, and keep your attorney close on state specifics. Our founder owned and administered medical practices for thirteen years before advising other physicians through their transitions, and protecting patients through the handoff is the standard every engagement is built around. If you’re weighing a sale and want the process handled carefully, start with a confidential, no-obligation conversation. When you’re ready, we’re here.

This article is general information, not legal advice. State requirements vary — confirm specifics with a qualified health-care attorney.

Frequently Asked Questions