Retiring, selling, or closing an Arizona medical practice comes with a fact most physicians discover late in the process: your legal responsibility for patient records does not end when the practice does. Under A.R.S. § 12-2297, a retiring provider must take “reasonable measures” to ensure records remain retained — and accessible — for the full retention window. Depending on your patient mix, that window can extend more than two decades past your last day of practice.
Plenty of guides explain the rules. Almost none of them tell you what compliance actually costs, or when each step has to happen. This one does both.
The retention math nobody runs until it’s too late
Arizona’s retention requirements under A.R.S. § 12-2297:
- Adult patients: at least six years after the last date of service.
- Minor patients: whichever is later — six years after the last date of service, or three years after the patient’s 18th birthday. A patient you saw as an infant in 2024 keeps you on the hook until roughly 2045.
- Source data (lab results, imaging, diagnostic data): six years from the date of collection, even if stored separately.
- Federal overlays: mammography records carry a 10-year federal minimum under MQSA, and Medicare/Medicaid participation and malpractice “tail” coverage can each impose longer periods.
A physician retiring in 2026 with an active family or pediatric panel isn’t closing a six-year obligation. They’re opening a custodianship obligation that may outlast their retirement plans — and Arizona law expects them to keep a current address on file with the Medical Board so patients can find those records the entire time.
The closure timeline, worked backward
The Arizona Medical Board and AMA guidelines converge on one hard deadline: active patients need written notice at least three months before you close. Everything else stacks up behind that. Working backward from closing day:
T-minus 6 months — decide what happens to the records. Three options: transfer them to an acquiring practice, become your own custodian, or contract a records custodian. This decision drives every other step, so it goes first. If the records are still on paper, this is also the moment to get a scanning quote — digitizing 20 years of charts takes weeks, not days.
T-minus 4–5 months — digitize. If records are transferring to a buyer, digital files transfer cleanly; paper transfers are where charts get lost. If you’re contracting custodianship, virtually every custodian works from digital files. Either way, scanning happens before the notification letters go out, because those letters must tell patients where their records will be and how to request them — and you can’t write that paragraph until the records have a destination.
T-minus 3 months — notify patients (the legal floor). The letter must include: the closing date, where records will be stored, how to request them, a release-of-information form, the request deadline, and guidance on finding a new provider. Send by registered mail for high-risk patients, put a copy in each chart, post signage in the office, and put the notice on your website. Announce in a local paper.
T-minus 2–3 months — notify everyone else. The Arizona Medical Board (or Osteopathic Board for DOs), the DEA, Medicare/Medicaid, your malpractice carrier (confirm tail coverage), commercial payers, and referring physicians.
T-minus 30 days — final records logistics. Last outbound transfers to patients who requested them, chain-of-custody handoff to the custodian, and certified destruction of anything already past its retention date (with certificates for your compliance file).
Closing day — the obligation continues. Whoever holds the records now fulfills requests from patients, attorneys, insurers, and successor providers for the rest of the retention window. If that’s you, it’s you at your home address, for up to 21 years.
What it actually costs — with real numbers
This is the part every other guide skips, because almost nobody in this market publishes pricing. We do, so here’s the honest math for a typical retiring solo or two-provider Phoenix practice with about 40 banker boxes of charts.
Option 1 — Storage unit (the default, and the trap). A climate-controlled Phoenix unit runs $100–$300/month. Over a six-year adult window that’s $7,200–$21,600 — before a single records request. And every request means someone (you) drives to the unit, digs through boxes, copies the chart, and logs the release in a HIPAA-defensible way. An unlocked unit with PHI inside isn’t a future risk; it’s a present violation. You remain the custodian, personally.
Option 2 — Commercial box storage. Roughly $5–25 per box per month plus retrieval fees that spike exactly when you need a chart fast. Forty boxes lands in the same multi-thousand-per-year territory, still with per-request friction, and you’re still the responsible custodian.
Option 3 — Scan once, then managed custodianship. Overland’s published pricing: $145 per standard banker box to scan, or $195 per box with full HIPAA chain-of-custody handling (BAA before pickup, documented transfers, certified destruction of originals). Forty boxes at the chain-of-custody rate is a one-time ~$7,800. Ongoing custodianship of the digital archive is $75–$125/month flat — fixed at signup — with records releases handled for you at $20–$25 per release, retention-schedule tracking against A.R.S. § 12-2297, and certified destruction at end of retention. Those are, as far as we can find, the only published custodianship numbers in the Phoenix market; every alternative is a call-for-quote.
The difference isn’t only dollars. Under options 1 and 2, you answer the records requests for the next decade or two. Under option 3, your obligation is satisfied by the arrangement itself — the “reasonable measures” A.R.S. § 12-2297 requires, documented in writing.
Why digitize before you close (even if you’re transferring the practice)
- Transfers get cleaner. An acquiring practice inherits indexed, searchable files that import into Epic, Athena, eClinicalWorks, Dentrix, or Eaglesoft — not pallets of paper their staff has to re-file.
- The paper can legally go away. Arizona law permits destroying paper originals once digital copies exist. Certified destruction with documentation closes out the storage problem entirely.
- Requests take minutes, not evenings. An indexed digital archive turns a records request from a storage-unit excavation into a lookup.
- The archive can’t burn, flood, or fade. A six-to-twenty-one-year window is a long time to bet on cardboard in the Arizona heat.
For the compliance specifics of the scanning itself — BAA, encryption, access controls, chain of custody — see our HIPAA-compliant scanning checklist and medical records scanning service. For the underlying retention law in full, see our A.R.S. § 12-2297 retention guide.
A note for practices that have already closed
If you closed months or years ago and the charts are sitting in a garage or storage unit — you’re not alone, and it’s fixable. Taking over records from already-closed practices is one of the most common projects we handle, including coordinating with the Arizona Medical Board’s notification requirements so patients can find their records again. The managed records storage program was built for exactly this situation.
Frequently asked questions
How long am I responsible for patient records after closing my Arizona practice?
Six years after the last date of service for adult patients. For minors, whichever is later: six years after last service or three years after their 18th birthday — up to 21 years for young pediatric patients. A.R.S. § 12-2297 requires retiring or selling providers to take reasonable measures to ensure records stay retained for the full period.
How much notice do I have to give patients before closing?
Arizona Medical Board and AMA guidance: written notice to active patients at least three months before closure, including the closing date, where records will be stored, how to request copies, a release form, and a request deadline. Registered mail is recommended for high-risk patients.
Can I just put the charts in a storage unit?
You can, but you remain the legal custodian — responsible for fulfilling every records request, maintaining HIPAA-compliant access controls, and keeping a current address with the Medical Board for the full retention window. An unsecured unit containing PHI is a HIPAA problem today, not just a risk later.
What does records custodianship cost in Phoenix?
Overland publishes its pricing — the only published custodianship rate we know of in the Phoenix market: scanning at $145 per banker box ($195 with full HIPAA chain-of-custody handling), then $75–$125/month flat for managed custody of the digital archive, with releases handled at $20–$25 each and certified destruction at end of retention.
Can I destroy the paper records after scanning?
Yes. Arizona law allows destruction of paper originals once digital copies exist. Use certified destruction and keep the certificates in your compliance file — they’re part of demonstrating “reasonable measures” under A.R.S. § 12-2297.
Closing a practice in the Valley? Overland Printing has handled secure records work in Phoenix since 1985 — BAA signed before pickup, free Phoenix-metro pickup, indexed delivery, certified destruction, and flat-rate custodianship with published pricing. Call 602-224-9971 or get a free scanning quote.
This article is provided for general informational purposes and does not constitute legal advice. Physicians should confirm their specific obligations with the Arizona Medical Board (or Arizona Board of Osteopathic Examiners) and qualified counsel.
If a closing practice is billed for scanning and retrieval separately from ongoing storage, see our Phoenix scanning rate guide for typical per-page and per-box pricing.
