# Who keeps a closing practice's records, and what may be…

> 2 of 9 rules read say what happens to records when a practice closes, a doctor leaves or a business is wound up, newest read 9 November 2026.

Sell Medical Records to AI · https://sellmedicalrecordstoai.com/datasets/medical-records-custody-law/ · computed 2026-11-09

**Rules on a closing practice's records:** 2 of 9 rules (9 texts read; 11 named).

## The answers, question by question

- **The duty it sets:** what happens to records when a practice closes, a doctor leaves or a business is wound up 2, keeping records, or for how long 2, using, selling or de-identifying the information 2, a duty of confidentiality 2, the patient's right to see or copy the record 1
- **Where it applies:** United States, federal 6, United Kingdom 2, a US state 1
- **What it says, in its own words:** stated 9

## Every rule

| Rule | The duty it sets | Where it applies | What it says, in its own words |
|---|---|---|---|
| 11 U.S.C. 351, disposal of patient records in bankruptcy | what happens to records when a practice closes, a doctor leaves or a business is wound up | United States, federal | promptly publish notice, in 1 or more appropriate newspapers, that if patient records are… |
| 42 CFR 482.24(b)(1), a Medicare hospital's record retention | keeping records, or for how long | United States, federal | Medical records must be retained in their original or legally reproduced form for a… |
| 45 CFR 164.502(a)(5)(ii)(B), what counts as a sale | using, selling or de-identifying the information | United States, federal | a disclosure of protected health information by a covered entity or business associate… |
| 45 CFR 164.514(e), the limited data set | using, selling or de-identifying the information | United States, federal | A covered entity may use or disclose a limited data set under paragraph (e)(1) of this… |
| 45 CFR 164.524(a)(1), the patient's right of access | the patient's right to see or copy the record | United States, federal | an individual has a right of access to inspect and obtain a copy of protected health… |
| 45 CFR 164.530(j)(2), keeping HIPAA documentation | keeping records, or for how long | United States, federal | A covered entity must retain the documentation required by paragraph (j)(1) of this… |
| Data Protection Act 2018, Schedule 1 paragraph 2(2), what health or social care purposes are | a duty of confidentiality | United Kingdom | In this paragraph “health or social care purposes” means the purposes of |
| Florida Statutes 456.057(12) and (13), records owners leaving practice | what happens to records when a practice closes, a doctor leaves or a business is wound up | a US state | records owners shall notify the appropriate board office when they are terminating… |
| GMC, Confidentiality: good practice in handling patient information | a duty of confidentiality | United Kingdom | This guidance sets out eight principles of confidentiality that you should apply to your… |

## The sentence each answer rests on (27)

- 11 U.S.C. 351, disposal of patient records in bankruptcy, [LII, 11 U.S. Code 351](https://www.law.cornell.edu/uscode/text/11/351), read 2026-11-09, The duty it sets: "If a health care business commences a case under chapter 7, 9, or 11, and the trustee does not have a sufficient amount of funds to pay for the storage of patient records in the manner required under applicable Federal or State law"
- 11 U.S.C. 351, disposal of patient records in bankruptcy, [LII, 11 U.S. Code 351](https://www.law.cornell.edu/uscode/text/11/351), read 2026-11-09, Where it applies: "11 U.S. Code § 351 - Disposal of patient records"
- 11 U.S.C. 351, disposal of patient records in bankruptcy, [LII, 11 U.S. Code 351](https://www.law.cornell.edu/uscode/text/11/351), read 2026-11-09, What it says, in its own words: "promptly publish notice, in 1 or more appropriate newspapers, that if patient records are not claimed by the patient or an insurance provider (if applicable law permits the insurance provider to make that claim) by the date that is 365 days after the date of that notification, the trustee will destroy the patient records"
- 42 CFR 482.24(b)(1), a Medicare hospital's record retention, [eCFR, 42 CFR 482.24](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24), read 2026-11-07, The duty it sets: "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years."
- 42 CFR 482.24(b)(1), a Medicare hospital's record retention, [eCFR, 42 CFR 482.24](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24), read 2026-11-07, Where it applies: "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years."
- 42 CFR 482.24(b)(1), a Medicare hospital's record retention, [eCFR, 42 CFR 482.24](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24), read 2026-11-07, What it says, in its own words: "Medical records must be retained in their original or legally reproduced form for a period of at least 5 years."
- 45 CFR 164.502(a)(5)(ii)(B), what counts as a sale, [eCFR, 45 CFR 164.502](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502), read 2026-11-02, The duty it sets: "where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information"
- 45 CFR 164.502(a)(5)(ii)(B), what counts as a sale, [eCFR, 45 CFR 164.502](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502), read 2026-11-02, Where it applies: "a disclosure of protected health information by a covered entity or business associate, if applicable"
- 45 CFR 164.502(a)(5)(ii)(B), what counts as a sale, [eCFR, 45 CFR 164.502](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502), read 2026-11-02, What it says, in its own words: "a disclosure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information."
- 45 CFR 164.514(e), the limited data set, [eCFR, 45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-11-05, The duty it sets: "A covered entity may use or disclose a limited data set under paragraph (e)(1) of this section only for the purposes of research, public health, or health care operations."
- 45 CFR 164.514(e), the limited data set, [eCFR, 45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-11-05, Where it applies: "Standard: Limited data set."
- 45 CFR 164.514(e), the limited data set, [eCFR, 45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-11-05, What it says, in its own words: "A covered entity may use or disclose a limited data set under paragraph (e)(1) of this section only for the purposes of research, public health, or health care operations."
- 45 CFR 164.524(a)(1), the patient's right of access, [eCFR, 45 CFR 164.524](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524), read 2026-11-07, The duty it sets: "an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set"
- 45 CFR 164.524(a)(1), the patient's right of access, [eCFR, 45 CFR 164.524](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524), read 2026-11-07, Where it applies: "an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set"
- 45 CFR 164.524(a)(1), the patient's right of access, [eCFR, 45 CFR 164.524](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524), read 2026-11-07, What it says, in its own words: "an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set"
- 45 CFR 164.530(j)(2), keeping HIPAA documentation, [eCFR, 45 CFR 164.530](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530), read 2026-11-02, The duty it sets: "A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later."
- 45 CFR 164.530(j)(2), keeping HIPAA documentation, [eCFR, 45 CFR 164.530](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530), read 2026-11-02, Where it applies: "Implementation specification: Retention period."
- 45 CFR 164.530(j)(2), keeping HIPAA documentation, [eCFR, 45 CFR 164.530](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530), read 2026-11-02, What it says, in its own words: "A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later."
- Data Protection Act 2018, Schedule 1 paragraph 2(2), what health or social care purposes are, [legislation.gov.uk, Data Protection Act 2018 Schedule 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/1), read 2026-11-07, The duty it sets: "See also the conditions and safeguards in Article 9(3) of the"
- Data Protection Act 2018, Schedule 1 paragraph 2(2), what health or social care purposes are, [legislation.gov.uk, Data Protection Act 2018 Schedule 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/1), read 2026-11-07, Where it applies: "In this paragraph “health or social care purposes” means the purposes of"
- Data Protection Act 2018, Schedule 1 paragraph 2(2), what health or social care purposes are, [legislation.gov.uk, Data Protection Act 2018 Schedule 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/1), read 2026-11-07, What it says, in its own words: "In this paragraph “health or social care purposes” means the purposes of"
- Florida Statutes 456.057(12) and (13), records owners leaving practice, [Online Sunshine, Florida Statutes 456.057](https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0400-0499/0456/Sections/0456.057.html), read 2026-11-09, The duty it sets: "records owners shall place an advertisement in the local newspaper or notify patients, in writing, when they are terminating practice, retiring, or relocating, and no longer available to patients, and offer patients the opportunity to obtain a copy of their medical record."
- Florida Statutes 456.057(12) and (13), records owners leaving practice, [Online Sunshine, Florida Statutes 456.057](https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0400-0499/0456/Sections/0456.057.html), read 2026-11-09, Where it applies: "Notwithstanding the provisions of s. 456.058, records owners shall notify the appropriate board office when they are terminating practice"
- Florida Statutes 456.057(12) and (13), records owners leaving practice, [Online Sunshine, Florida Statutes 456.057](https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0400-0499/0456/Sections/0456.057.html), read 2026-11-09, What it says, in its own words: "records owners shall notify the appropriate board office when they are terminating practice, retiring, or relocating, and no longer available to patients, specifying who the new records owner is and where medical records can be found."
- GMC, Confidentiality: good practice in handling patient information, [General Medical Council guidance page](https://www.gmc-uk.org/professional-standards/the-professional-standards/confidentiality), read 2026-11-09, The duty it sets: "This guidance sets out eight principles of confidentiality that you should apply to your practice."
- GMC, Confidentiality: good practice in handling patient information, [General Medical Council guidance page](https://www.gmc-uk.org/professional-standards/the-professional-standards/confidentiality), read 2026-11-09, Where it applies: "It was updated on 25 May 2018 to reflect the requirements of the General Data Protection Regulation and Data Protection Act 2018"
- GMC, Confidentiality: good practice in handling patient information, [General Medical Council guidance page](https://www.gmc-uk.org/professional-standards/the-professional-standards/confidentiality), read 2026-11-09, What it says, in its own words: "This guidance sets out eight principles of confidentiality that you should apply to your practice. It provides a framework to help you decide when you can share information."

## Read and set aside

- [California Code, HSC 123145](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=HSC&sectionNum=123145): the stored read is the California code site's navigation shell with no section text
- [Statutes & Constitution :View Statutes : Online Sunshine](https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0400-0499/0456/Sections/0456.058.html): the stored read is the Florida statutes search shell with no section text

## Methodology

Each rule's own 45 CFR Part 164, 42 CFR 482.24, Florida, Texas and California medical-record rules, the Bankruptcy Code, the GMC's guidance and the Data Protection Act 2018 were read through estate-fetch and stored whole (sha256 on every row). For every text, three questions were answered from its own words: the duty it sets, where it applies, what it says, in its own words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question. A rule with several texts reads 'varies' where they disagree. 9 rules, 9 texts.

## Sources

- [eCFR :: 45 CFR 164.530 -- Administrative requirements.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530) (read)
- [eCFR :: 45 CFR 164.524 -- Access of individuals to protected health information.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524) (read)
- [eCFR :: 45 CFR 164.502 -- Uses and disclosures of protected health information: General rules.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) (read)
- [eCFR :: 45 CFR 164.514 -- Other requirements relating to uses and disclosures of protected health information.](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) (read)
- [eCFR :: 42 CFR 482.24 -- Condition of participation: Medical record services.](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-482/subpart-C/section-482.24) (read)
- [Statutes & Constitution :View Statutes : Online Sunshine](https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0400-0499/0456/Sections/0456.057.html) (read)
- [California Code, HSC 123145](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=HSC&sectionNum=123145) (not-terms)
- [11 U.S. Code § 351 - Disposal of patient records \| U.S. Code \| US Law \| LII / Legal Information Institute](https://www.law.cornell.edu/uscode/text/11/351) (read)
- [Confidentiality: good practice in handling patient information - professional standards - GMC](https://www.gmc-uk.org/professional-standards/the-professional-standards/confidentiality) (read)
- [Data Protection Act 2018](https://www.legislation.gov.uk/ukpga/2018/12/schedule/1) (read)
- [Statutes & Constitution :View Statutes : Online Sunshine](https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0400-0499/0456/Sections/0456.058.html) (not-terms)

## Cite or embed

- 2 of 9 rules read say what happens to records when a practice closes, a doctor leaves or a business is wound up, newest read 9 November 2026.
- The duty it sets, by rule: a duty of confidentiality 2 of 9, what happens to records when a practice closes, a doctor leaves or a business is wound up 2 of 9, keeping records, or for how long 2 of 9, using, selling or de-identifying the information 2 of 9, the patient's right to see or copy the record 1 of 9 (9 rules, read 9 November 2026).
- Where it applies, by rule: United States, federal 6 of 9, United Kingdom 2 of 9, a US state 1 of 9 (9 rules, read 9 November 2026).
- What it says, in its own words, by rule: stated 9 of 9 (9 rules, read 9 November 2026).

Cite as: "Who keeps a closing practice's records, and what may be done with them", updated 2026-11-09, https://sellmedicalrecordstoai.com/datasets/medical-records-custody-law/.

CSV: https://sellmedicalrecordstoai.com/datasets/medical-records-custody-law.csv
JSON: https://sellmedicalrecordstoai.com/datasets/medical-records-custody-law.json
Embed (plain HTML, static link back): see https://sellmedicalrecordstoai.com/datasets/medical-records-custody-law/#lead