Medical Records Custodian: What One Does and Costs

Short answer

A medical records custodian is the person or company that keeps a practice's patient records after the practice closes, the physician retires or dies, or the practice is sold, and answers patients' requests for copies until the state retention period ends. The custodian can be a successor physician, the estate, or a commercial custodian service under a written agreement. Some states require you to tell the medical board who the custodian is.

A custodian keeps the original records, releases copies on a patient's signed request, and destroys them only when the retention period ends.
Successor physicians, estates and commercial storage firms can all act as custodian; malpractice carriers advise putting it in writing.
Some states set the notice and filing steps: Florida requires newspaper notice and a copy to the Board of Medicine within one month.
Before records go to a custodian, check whether a de-identified copy could be licensed. Most small practices will not qualify on volume alone.

What is a custodian of medical records?

A custodian of medical records is whoever holds a practice's patient charts once the treating provider no longer does: it keeps them secure, sends copies when a patient or new doctor asks with a signed authorization, and destroys them only after the retention period ends. The Doctors Company, a malpractice insurer, says custodians "can be replacement physicians, nonphysicians, or commercial storage facilities" (The Doctors Company).

This page is general information, not legal or medical advice; state law varies, so confirm each rule with your counsel, your malpractice carrier or your state board.

This page covers the custodian. For how long the custodian must keep each chart, see how long to keep patient records; for who owns the records in the first place, see who owns patient records.

When does a practice need a medical records custodian?

A practice needs a named custodian whenever the provider who created the records will no longer be there to answer requests. Four situations cover almost every case:

Situation	Who usually becomes custodian	Example rule
Practice closes	Another provider, a commercial custodian, or the owner from home storage	Maryland: records "must be maintained by another health care provider, the administrator of the physician's estate, or a designee who has agreed to maintain the records" (Maryland Board of Physicians)
Physician retires	The retiring physician, a successor or a custodian service	Arizona: a provider who retires or sells must "take reasonable measures to ensure that the provider's records are retained" (A.R.S. 12-2297)
Physician dies	The executor or administrator of the estate	Massachusetts: "The executor or administrator must maintain a patient's medical records for a minimum period of seven years from the date of the last patient encounter." (243 CMR 2.07)
Practice is sold	The buyer, under the purchase agreement	See practice valuation and records in a sale for the HIPAA rule that lets records pass to a buyer.
Dental group or clinic	A licensed dentist named as custodian	Texas: the owner of a clinic "shall designate a licensed Texas dentist as the dental custodian of records" (22 TAC 108.72)

What do medical records custodian services do, and what do they cost?

A medical records custodian service takes the charts, paper or electronic, stores them under HIPAA safeguards, answers release requests from patients, lawyers and insurers, and destroys records as each one reaches the end of its retention period. Overland Printing, a records vendor, notes that "Most records companies make you call for a quote." Two vendors do publish prices:

Provider	Published price	Kind of source
ChartRequest	"a one-time implementation fee of $1 per record times the retention years, plus $199/month for ongoing management throughout the retention period" (ChartRequest)	Vendor's own published pricing
Overland Printing (Phoenix)	Managed records storage at "$75–$125/mo"; scanning at "$145 per standard banker box" (Overland Printing)	Vendor's own published pricing, one metro area

Read these as examples, not a market rate: they are what two vendors publish for their own services. The Doctors Company notes that "Commercial custodial arrangements for retaining records are usually entered into for a fee, but all agreements should be in writing." (The Doctors Company).

What state laws and medical boards require of a records custodian

Custodian duties come mostly from state law and medical or dental board rules. Examples from named states:

Florida: a physician who terminates, sells or relocates a practice must publish notice "once during each week for four (4) consecutive weeks" in local newspapers, saying where records can be obtained, and "A copy of this notice shall also be submitted to the Board of Medicine within one (1) month from the date of termination, sale, or relocation of the practice." (Fla. Admin. Code 64B8-10.002).
Maryland: "The new custodian of records must write to the applicable health occupations board" that the records will be kept as state law requires (Maryland Board of Physicians).
New Hampshire: a physician who retires or moves must notify active patients and make sure records can be transferred; "Whenever possible, notice shall be provided at least 30 days prior to cessation of treatment" (N.H. Med 501.02).
Georgia (dentists): the Board of Dentistry says "only a dentist actively licensed in Georgia may control or maintain the custody of a patient's dental records" and "At no time should a dentist transfer any patient's record to an unlicensed party." (Georgia Board of Dentistry). Check your own dental board before choosing a commercial custodian.
Massachusetts (dentists): "If the licensee dies and the practice is closed, the estate may notify patients treated within the two years prior to the date of passing." (234 CMR 5.13).
Everywhere: the American Academy of Family Physicians tells closing physicians to "Notify your state medical board of the storage location." and to "Establish a mailing address or PO Box for medical record requests after closing." (AAFP checklist).

How to get medical or dental records from a closed office

A patient whose doctor or dentist has closed should first ask whoever took over the office, then the state board, which may know the custodian. The Texas Medical Board says to write to the address on the physician's board profile, and "You can also contact the TMB to determine if a custodian of records has been reported." (Texas Medical Board).

Call or visit the old office first. The Georgia Composite Medical Board's first step is to "Call or visit the doctor's office to verify who has possession of the files from his/her practice" (Georgia Composite Medical Board).
If the doctor has died, the Georgia board suggests you "call the Clerk of Courts or the local Probate Court" to find the executor of the estate, who is often the custodian (Georgia Composite Medical Board).
For dental records, contact the state dental board, and the dentist who bought the practice if there was a sale. The Georgia Board of Dentistry requires a closing dentist's notice to include "A means for the patient to obtain a copy of his/her dental records." (Georgia Board of Dentistry).
Your rights stay the same after a closure. Under HIPAA "an individual has a right of access to inspect and obtain a copy of protected health information about the individual", and a covered custodian "may impose a reasonable, cost-based fee" (45 CFR 164.524).

What the custodian agreement should say

Put the arrangement in writing before any chart moves. The Doctors Company lists what a written custodial agreement should cover, and the points below follow its list (The Doctors Company):

Fees for maintaining the records, including fees for retention and for continued access to electronic records.
How long the custodian keeps each record: the state period for adults, minors and imaging. Use the state table.
Compliance with state and federal confidentiality, access and copy-charge rules.
Access only with patient authorization: the records "cannot be accessed without a signed release from the patient or a properly executed subpoena or court order".
Continued access for you or your personal representative to answer a malpractice claim or a board inquiry.
What happens if a physician custodian later retires, sells or moves, and a promise that you "will be notified of any change of the custodian" address or phone number.
An inventory: "Medical records should be inventoried prior to transfer or storage, and the physician should retain a copy of the inventory."
Who may destroy records at the end of the period, how, and the log kept of it. See medical records destruction.
Whether you keep any right to make a de-identified copy before or during custody (next section).

The same guide warns: "Do not give original records to patients." Patients get copies; the custodian keeps the originals (The Doctors Company).

Before custody: can de-identified records be licensed for research or AI?

Sometimes, and the check should happen before the charts are handed off, because a custodian agreement usually covers storage and release only. HIPAA says "a covered entity or business associate may not sell protected health information" except under a patient authorization (45 CFR 164.502; 45 CFR 164.508). De-identified information is different: the Privacy Rule's requirements "do not apply" to it, and a practice may disclose records to a business associate to create it (45 CFR 164.502).

De-identification means either removing the identifiers HIPAA lists (the Safe Harbor method) or having an expert determine "that the risk is very small that the information could be used" to identify anyone (45 CFR 164.514). The AMA's ethics code adds that physicians who allow commercial access to patient information should "Only provide data that has been de-identified." (AMA Opinion 3.2.4). The method is in Origin's de-identification guide.

De-identified patient records do get licensed. Tempus AI reported in its SEC filing for the quarter ended 30 September 2026 that a licensee will pay data license fees of $100 per delivered record, up to $50 million, for 500,000 de-identified records of patients with Alzheimer's disease or other specified neurological conditions (Tempus 10-Q). That deal is between large companies, not a single practice.

Most small practices will not qualify on volume alone. The one priced deal above covers 500,000 records, far more than a solo office holds, and Origin has found no published sale by a single small practice. A specialty, a long history or imaging linked to signed reports can still make a set worth a look (what makes patient records licensable), which is why a check before records go to storage is worth a few minutes.

What buyers want from charts and imaging is set out in licensing patient records and licensing medical imaging data.

Next step

If you are closing, use the closing a medical practice checklist to time the custodian handoff, and practice valuation if you are selling instead.

Does your company hold records like these? See what your data is worth.

Common questions

What does a custodian of medical records do?

A custodian keeps a practice's original patient records after the treating provider is gone, keeps them secure, sends copies to patients or new doctors on a signed authorization, answers subpoenas, and destroys records at the end of the state retention period. It can be a successor physician, the estate, or a commercial custodian service working under a written agreement.

How much do medical records custodian services cost?

Most custodian services quote privately. Two publish prices: ChartRequest charges a one-time fee of $1 per record times the retention years, plus $199 a month, and Overland Printing in Phoenix lists managed records storage at $75 to $125 a month. These are vendors' own prices for their services, not a market average.

Who becomes the custodian of medical records when a doctor dies?

Usually the executor or administrator of the estate, unless another physician or a custodian service takes the records. Massachusetts, for example, says the executor or administrator must keep the records for at least seven years from the last patient encounter. Patients can find the executor through the local probate court, as the Georgia medical board suggests.

How do I get my dental records if my dentist retired or closed the office?

Call the old office first, then the dentist who bought the practice, if any, then your state dental board, which may know who holds the records. In Georgia, a closing dentist's notice must tell patients how to get copies. Under HIPAA you can obtain a copy for a reasonable, cost-based fee.

Do I have to tell the state medical board who my records custodian is after closing?

In some states, yes. Florida requires a copy of the closing notice, which says where records can be obtained, to go to the Board of Medicine within one month. Maryland requires the new custodian to write to the board. The AAFP advises every closing physician to tell the board where records are stored.

Can a commercial company be the custodian of dental records from a closed dental practice?

It depends on the state. The Georgia Board of Dentistry says only a dentist actively licensed in Georgia may maintain custody of patients' dental records, and records should never go to an unlicensed party. Texas requires dental clinics to designate a licensed Texas dentist as custodian. Check your dental board before signing with a storage company.

Should a retiring physician check whether patient records can be licensed before handing them to a custodian?

Yes, it costs little to check first. Identifiable records need patient authorization to be sold, but de-identified records fall outside the HIPAA Privacy Rule and are sometimes licensed for research or AI. Most small practices will not qualify on volume alone, so treat it as a check, not an expected payment.

Sources and further reading

Origin Data Partners is an independent data partner. We work with buyers, and a buyer may pay us when a deal closes.