Close your account
Removes access and stops future processing for convenience purposes, without erasing the underlying clinical record that must be retained.
How long your record is kept, and what deletion really means
People often assume that asking for a record to be deleted will result in it disappearing. Under HIPAA that is rarely the case, and the reason is not obstruction — retaining clinical records for a defined period is a legal obligation on the clinician, not a preference of the business.
The starting point
HIPAA has no right to be forgotten
This surprises people who are familiar with European data protection. HIPAA gives you access, amendment, accounting and restriction rights — but no right to compel erasure of a clinical record.
What sets the retention period is usually state law governing licensed professionals, which commonly requires records to be held for a number of years after the last encounter. A clinician who deleted records on request would be breaching their own licensing obligations.
HIPAARequires certain compliance documentation to be kept for six years
State lawSets the clinical record period, commonly several years after last contact
MinorsFrequently longer, often running from the age of majority
Whichever is longerGoverns in practice
What you can actually do
Deletion is limited, but you are not powerless
Withdraw marketing consent
Communications preferences are separate from clinical retention and can be switched off entirely at any time.
Revoke authorisations
Stops future disclosures to third parties from the moment the revocation is received.
Request a restriction
Ask that specific information not be used in specific ways. Not always granted, but must be considered and answered.
Ask for non-clinical deletion
Data held outside the clinical record — marketing lists, support tickets — is not subject to the same retention duty.
Use state privacy law
Where a state statute grants deletion rights, it generally exempts HIPAA-covered records — but may still reach data held outside them.
What happens at the end of the period
Disposal is not simply deletion from a database. A compliant process destroys records so they cannot be reconstructed, applies the same standard to backups and to any copies held by business associates, and documents that the destruction occurred. That documentation is itself retained, which is why a service can tell you a record was destroyed even after it no longer holds the record.
Frequently asked
Can I have my ESA record deleted?
Usually not in full. HIPAA contains no right to erasure, and state law generally requires licensed clinicians to retain clinical records for a set period after the last encounter.
How long are ESA records kept?
The clinical retention period is set by state law and commonly runs for several years after your last contact. HIPAA separately requires certain compliance documentation to be kept for six years.
Does closing my account delete my record?
No. It removes your access and stops further processing for convenience purposes, but the underlying clinical record remains subject to the applicable retention period.
Do state privacy laws give me a deletion right?
Several do, but they generally exempt information already covered by HIPAA. They may still reach data held outside the clinical record, such as marketing lists.
What happens to backups?
A compliant disposal process covers backups and copies held by business associates, not just the primary record, and documents that the destruction took place.
Are records for minors kept longer?
Frequently yes. Many states extend the period for minors, often measuring it from the age of majority rather than from the date of the encounter.
Your privacy is not an afterthought here
Start a free evaluation and see exactly what your landlord will — and will not — receive.
Start free evaluation All privacy topics