Medical Records Storage: How to Choose a Provider and What Drives the Cost

October 19, 2026Posted by: Tony Acerra

Take Control of Your Records

Get a free consultation to simplify storage, scanning, retrieval, and secure destruction.

Choosing a medical records storage provider comes down to four checks: a business associate agreement that covers breach reporting, access and exit terms; a facility built to protect paper for decades; tracking that logs every box and file movement; and retrieval fast enough to meet patient access deadlines. Price matters, but only after those four hold up.

Most healthcare organizations don’t choose a medical records storage company because they want one. They choose one because the file room is full, a practice is merging or closing, or the space is needed for patient care. That pressure tends to push the decision toward the lowest monthly rate per box, which is the one number in the contract that matters least over a ten- or twenty-year relationship.

This guide covers what a storage provider takes on when it holds your patient records, what to check in the agreement, the facility and the tracking system, how retrieval decides whether storage actually works, and what really drives the cost. For how long each type of record has to be kept, see our HIPAA records retention guide.

What a Medical Records Storage Provider Takes On

A company that stores patient records for a hospital, practice or lab is maintaining protected health information on that organization’s behalf, which makes it a business associate under HIPAA. The covered entity still owns the obligation to safeguard those records, so the provider’s controls become part of the covered entity’s own compliance.

HIPAA defines a business associate as a person that creates, receives, maintains or transmits protected health information on behalf of a covered entity, and the definition extends to subcontractors that do the same for a business associate (45 CFR 160.103). Storage is “maintains” in its plainest form. A box of charts on a vendor’s shelf is still PHI, and the vendor holding it is inside the compliance perimeter, not outside it.

The safeguarding duty doesn’t stop when records leave the building. HHS has stated that the Privacy Rule does not itself set a retention period for medical records, since state law generally governs that, but that covered entities must apply appropriate administrative, technical and physical safeguards to medical records for whatever period the information is maintained, including through disposal, citing 45 CFR 164.530(c). Hospitals carry an additional federal floor: under the Medicare conditions of participation, medical records must be retained in their original or legally reproduced form for at least five years, and the hospital must ensure that unauthorized individuals cannot gain access to or alter them (42 CFR 482.24).

What goes wrong with paper is rarely sophisticated. HHS titled one of its enforcement cases a “medical records dumping case”: Parkview Health System agreed to pay $800,000 and adopt a corrective action plan to fix deficiencies in its HIPAA compliance program. Records left where nobody is accountable for them are exactly the failure a storage contract exists to prevent.

Start With the Business Associate Agreement

The business associate agreement is the first document to read, before the price sheet. HIPAA sets what it must contain, and four of those terms matter most for storage: breach reporting, subcontractors, access to the records, and what happens to the records when the contract ends.

Under 45 CFR 164.504(e), the agreement has to commit the business associate to, among other things:

Report problems. Report any use or disclosure not provided for by the contract, including breaches of unsecured PHI. Ask how the provider would detect a missing box in the first place.
Bind its subcontractors. Ensure any subcontractor that handles the records agrees to the same restrictions. Ask who actually transports, scans or destroys your records, and whether those are the provider’s own employees.
Make records available for access. Make PHI available so the covered entity can meet a patient’s right of access. That is a retrieval obligation, and the agreement should say how fast.
Handle termination properly. At the end of the contract, return or destroy the PHI if feasible, or extend the agreement’s protections if it is not. For records still inside their retention period, return is the realistic path, which makes the exit terms a compliance question as much as a commercial one.

A provider that hands over a signed agreement without being able to explain how each of those clauses works in its operation is giving you paper, not protection.

The Facility: What to Look For on a Site Visit

A records facility has to protect paper from fire, water, pests and unauthorized people for longer than most leases run. Visit it. Look at the building, the shelving, the access controls and how a box moves from the loading dock to its shelf location.

There is no HIPAA building code for records storage, but there is a useful public benchmark. The National Archives sets facility standards that federal agencies’ records storage facilities must meet, in 36 CFR 1234.10. Among them: construction with non-combustible materials, siting at least five feet above and 100 feet from any 100-year flood plain or protection by an appropriate flood wall, a roof membrane that does not let water through, shelving that permits proper air circulation and fire protection, and separate areas with separate air handling for records infested by insects or showing active mold. Your records are not federal records, but a provider that can talk through that list with you knows what it is protecting against.

On the visit, ask to see:

How access is controlled at the building, the storage floor and any client review room, and who reviews the access logs.
Fire detection and suppression in the storage area itself, not only in the office.
Where records are received and how long they sit before they are indexed and shelved.
Where film, tapes and other media go, since they need tighter climate control than paper.

Tracking and Chain of Custody

A storage provider is only as good as its inventory. Every box, and ideally every file you will need individually, should carry a barcode tied to a shelf location, and every movement out and back should be logged with who handled it and when.

Chain of custody starts before the records leave your building. Ask whether boxes are barcoded at pickup or only once they reach the facility, what is recorded at handoff, and whether you can see the inventory yourself rather than calling to ask. Being able to look up any box yourself, by its barcode or by your own index such as a range of patient names or dates of service, is the difference between knowing where a chart is and believing it.

Then test it. Before you sign, ask the provider to show you the full movement history of a sample box from an existing client account, anonymized: every pickup, retrieval, refile and scan request, with dates and names. If they can’t produce one quickly, they won’t be able to produce yours during an audit.

Retrieval Decides Whether Storage Works

Patients, payers, auditors and attorneys will all ask for records that are in storage. Under HIPAA, a covered entity generally has 30 days to act on a patient’s request for access, so retrieval turnaround is a compliance number, not just a service level.

The right of access rule requires a covered entity to act on a patient’s request no later than 30 days after receiving it, with a single extension of up to 30 more days if it gives the patient a written reason (45 CFR 164.524). That clock doesn’t pause because the chart is offsite. Release of information, payer audits, legal holds and continuing care requests add their own deadlines on top.

Here’s the part most buyers skip. The storage rate is what gets compared, but retrieval is what you actually live with. A provider that is cheap per box and slow per request moves the cost onto your HIM staff, who end up chasing records by phone while the access clock runs. Before signing, ask for the standard and rush turnaround in writing, ask whether a single file can be scanned and sent instead of shipping the whole box, and ask what happens on a Friday afternoon request.

Good providers offer more than one way to get a record back: physical delivery, scan on demand for a single file, and a secure room at the facility where your staff can review boxes on site. Each one fits a different kind of request, and the agreement should name all three.

What Drives the Cost of Medical Records Storage

The monthly storage rate is only one line of a medical records storage bill. Intake, indexing, transport, retrieval, refiling, scanning on request, permanent withdrawal and destruction are usually priced separately, and over the life of a contract they can matter more than the shelf rate.

Most providers quote custom pricing rather than publishing a rate card, so the useful comparison is line by line. Ask every bidder to price the same scenario: your actual box count, your expected annual retrievals and refiles, and a realistic share of rush requests. The items that drive the total:

Storage. Usually per box or per cubic foot per month. Confirm whether the rate is fixed or escalates each year.
Intake and indexing. Barcoding and capturing index fields at the start. More detail costs more upfront and saves time on every retrieval after.
Pickup and delivery. Per trip, per box or both, with rush and after-hours surcharges.
Retrieval and refile. Charged per item every time a file goes out and comes back. For an active archive, this line can outgrow storage.
Scan on demand. Per page or per file, often the fastest and cheapest way to fill a single request.
Permanent withdrawal and exit fees. The charge for taking records out for good, including when you change providers. This is the clause buyers miss and the one that decides how easily you can leave.
Destruction. Records that have passed their retention period should be reviewed first. Destruction is a documented decision made after that review, not an automatic step, and it is usually priced per box, with a certificate of destruction for each job.

Questions to Ask Before You Sign

Put the same questions to every provider, in writing, and compare the answers side by side. The ones that matter most are the ones a provider cannot answer with a brochure.

Will you sign our business associate agreement, and how do you meet its breach reporting, subcontractor, access and termination terms in practice?
Can we visit the facility where our records will be stored, and who has access to the storage floor?
Are boxes barcoded at pickup, and can we look up our own inventory without calling you?
Can you show the full movement history of a sample box?
What are your standard and rush retrieval times, and can a single file be scanned and sent?
What will it cost to remove all of our records if we leave?
How do you handle records that have reached the end of their retention period?

Frequently Asked Questions

Does HIPAA say how long medical records must be stored?

No. HHS has stated that the HIPAA Privacy Rule does not set a retention period for medical records; state laws generally decide how long they must be kept. HIPAA does require appropriate safeguards for as long as the records are kept, including while in storage and through disposal. Hospitals also have a federal floor of at least five years under the Medicare conditions of participation.

Is a medical records storage company a business associate under HIPAA?

Yes. HIPAA defines a business associate as a person that creates, receives, maintains or transmits protected health information on behalf of a covered entity, and storing patient records is maintaining them. A medical records storage company therefore needs a business associate agreement with the covered entity, and any subcontractor it uses for the records must agree to the same restrictions.

How quickly should a storage provider retrieve a medical record?

Fast enough that the covered entity can meet its own deadlines. Under HIPAA, a covered entity generally must act on a patient’s request for access within 30 days, with one 30-day extension if it explains the delay in writing. Clinical and audit requests are often more urgent, so standard and rush retrieval times should be written into the agreement.

What happens to stored medical records when we change storage providers?

The business associate agreement has to address termination: the provider returns or destroys the records if feasible, or keeps protecting them if not. Records still inside their retention period are normally returned or transferred to the new provider. Check the permanent withdrawal and exit fees before signing, and make sure every box is tracked and accounted for during the move.

What happens to medical records when a medical practice closes?

The retention obligation continues after a practice closes. State law generally sets how long patient records must be kept, and someone has to remain responsible for storing them securely and answering patient and legal requests until each retention period ends. Many closing practices appoint a medical records custodian to take on that responsibility.

Store Medical Records With GRM

GRM stores medical records in secure offsite facilities with controlled access and full chain of custody. Every box and file is barcoded and tracked through GRM’s PrecisionPlus process, with each movement logged, and your team can search its inventory and request pickups, deliveries and scanning through the eAccess portal. Records come back the way each request needs them: delivered, scanned and emailed, or reviewed on site in a secure client access room. When records reach the end of their retention period, GRM supports review first and documented destruction only once eligibility is confirmed. Learn more about our medical document storage services and medical records custodian services, or request a free quote.