How Long Do Pharmacies Need to Keep Prescription Records? A State-by-State Guide

Prescription record retention is one of those compliance areas that pharmacy teams often assume they have covered, right up until an audit request arrives and the scramble begins. How long records need to be kept, which records, and in what format are questions that do not have a single universal answer. They depend on a combination of federal requirements, state board of pharmacy rules, payer contracts, and the specific type of prescription involved.

Getting it wrong in either direction carries real consequences. Destroying records too early leaves a pharmacy unable to respond to audit requests and potentially in violation of state or federal law. Failing to maintain records in a retrievable format creates the same problem even if the records technically still exist somewhere. And for pharmacies operating home delivery programs, the record retention question extends beyond the prescription itself to include delivery documentation, proof of delivery records, and chain of custody trails that payers and regulators may want to see years after a delivery was made.

This guide covers the federal baseline, key state-level variations across some of the most pharmacy-dense states in the country, the specific rules that apply to controlled substances, and the practical principles that every pharmacy should build into its record retention policy regardless of where it operates.

The Federal baseline: What Federal Law requires

There is no single federal statute that sets a universal prescription record retention period for all pharmacies. Instead, several federal frameworks apply simultaneously, and pharmacies are required to comply with whichever standard is most stringent.

The DEA requires pharmacies to retain records related to controlled substance prescriptions, including electronic prescriptions for controlled substances (EPCS), for a minimum of two years from the date of creation or receipt under 21 CFR 1311.305. Critically, the DEA's two-year minimum does not pre-empt any longer period required by state law or regulation. Where state law requires longer retention, the state standard applies.

HIPAA does not set a specific retention period for prescription records themselves but does require pharmacies to retain HIPAA-related documentation, including privacy policies, procedures, and authorizations, for six years from the date of creation or last effective date.

Medicare Part D adds another layer: pharmacies participating in Part D programs are required to maintain records for a minimum of ten years from the date of service under 42 CFR 423.505. That ten-year requirement applies to Part D claims and related documentation and overrides shorter state minimums for pharmacies serving Medicare Part D patients.

The practical takeaway from the federal framework is straightforward: the federal floor is two years for most prescription records, but ten years for Part D-related documentation, and state law frequently requires more. Pharmacies should always default to the longest applicable requirement.

Key stat requirements

State boards of pharmacy set their own retention requirements, and they vary significantly. What follows covers some of the most important state standards, with source links for verification. This is not an exhaustive list of all fifty states, and pharmacy owners should always verify current requirements with their state board directly, as rules can and do change.

Florida: Four years

Florida established a uniform four-year retention policy for pharmacy records following a Florida Board of Pharmacy ruling in 2014. Under Rule 64B16-27.800 of the Florida Administrative Code, patient records must be maintained for a minimum of four years from the date of the last entry in the profile record. The four-year period applies uniformly across record types, replacing an earlier framework where different records carried different retention periods. Pharmacies participating in Medicare Part D in Florida must still meet the federal ten-year requirement for Part D documentation, which takes precedence.

Texas: Two years, five years (Medicaid)

The Texas State Board of Pharmacy requires pharmacies to maintain original prescriptions and keep them legible for a period of two years from the date of filling or the date of the last refill dispensed, under 22 Tex. Admin. Code Section 291.34. However, pharmacies participating in the Texas Medicaid Vendor Drug Program face a stricter requirement: all records and documents must be retained for five years from the service date. Texas also enacted legislation in 2026 requiring electronic health records to be stored within the United States, applying retroactively to all records regardless of creation date.

Oregon: Three years

Oregon requires all original prescriptions to be filed for a minimum of three years from the date of first dispensing, under OAR 855-041-1160. Records must be readily retrievable and open for inspection by the prescriber and the Oregon Board of Pharmacy at all times during the retention period.

Washington: Two years (pharmacy records), 26 years (hospital records)

Washington state requires pharmacies to maintain prescription records for a minimum of two years under RCW 18.64.245. However, Washington enacted a significant change in 2025 for hospital records: hospitals must now retain all medical records for a minimum of 26 years from the date each record was created, under amended RCW 70.41.190. This change applies to hospital-based pharmacy records and replaced a prior standard of ten years after discharge.

California: One to two years

California requires prescription records for non-controlled substances to be kept for one year from the date of dispensing, and prescription records for controlled substances to be kept for two years from the date of dispensing, under California Board of Pharmacy requirements. These are among the shorter state minimums in the country, and pharmacies in California participating in Medicare Part D must still meet the federal ten-year standard for Part D documentation.

Controlled substances

Controlled substance prescription records carry stricter requirements across most jurisdictions, and the consequences of non-compliance are significantly more severe. At the federal level, DEA regulations require that records of controlled substances be readily retrievable from all other records and that they be made available to the DEA upon request. Electronic records must be easily readable or easily rendered into a readable format.

At the state level, most boards of pharmacy require controlled substance records to be maintained separately from other prescription records, or at minimum to be readily identifiable and retrievable from general prescription files. Many states require controlled substance records to be retained for longer periods than non-controlled substance records.

For pharmacies dispensing Schedule II controlled substances on a home delivery basis, the documentation requirements extend to proof of delivery and chain of custody records in addition to the prescription record itself. An incomplete delivery documentation trail for a controlled substance delivery is a significant audit risk, regardless of whether the prescription record itself is complete.

Delivery documentation: The record retention dimension most pharmacies overlook

For pharmacies operating home delivery programs, prescription record retention is only part of the compliance picture. Every prescription dispatched for home delivery generates a set of delivery records that are subject to their own retention requirements and that payers and regulators may request during audits.

Proof of delivery records, chain of custody documentation, patient identity verification records, failed delivery exception records, and timestamped GPS delivery confirmation data all need to be retained and retrievable for as long as the underlying prescription claim may be subject to audit. For Medicare Part D claims, that means ten years.

Pharmacies that retain prescription records diligently but have not built equivalent retention practices for delivery documentation are carrying a compliance gap that is not always visible until an audit exposes it. A PBM or regulatory body reviewing a home delivery claim wants to see the complete picture: the prescription record, the dispensing documentation, and the delivery confirmation. If any part of that chain is missing or irretrievable, the claim is vulnerable.

RxMile's record keeping tools retain delivery documentation for ten years and allow immediate retrieval by patient, prescription number, delivery date, or delivery route, meeting the most stringent retention standards applicable to Part D pharmacy delivery programs. Learn more about RxMile's audit support.

Building a record retention policy that works

Regardless of which state a pharmacy operates in, several practical principles apply universally.

Always apply the longest applicable requirement

Where federal, state, payer, and regulatory requirements overlap, the longest retention period always governs. A pharmacy participating in Medicare Part D, serving Medicaid patients, and operating in a state with a four-year board requirement needs to retain Part D-related records for ten years, not four.

Retention starts from the right date

The start date for a retention period matters and is not always the dispensing date. Some requirements run from the date of the last refill, others from the date of last entry in the patient record, and others from the date of service. Misidentifying the start date can result in records being destroyed too early.

Records must be retrievable, not just retained

Many compliance failures in audit situations are not caused by records having been destroyed, but by records being held in formats or filing systems that cannot produce them quickly enough to meet audit deadlines. Digital records that are properly indexed and searchable are significantly more defensible than paper files or unstructured digital archives.

Retain records longer when litigation is possible

Standard retention periods do not account for litigation holds. If a dispute, audit, investigation, or legal proceeding is underway or reasonably anticipated, records must be preserved regardless of whether the standard retention period has expired.

Train staff on retention requirements and destruction protocols

Destroying records before the applicable retention period has expired is a compliance violation. So is destroying records in a way that does not properly protect patient health information. Staff responsible for record management need clear written policies and regular training on both requirements.

Quick reference: State retention requirements

The table below summarizes the key state requirements covered in this guide. Always verify current requirements with your state board of pharmacy before making policy decisions.

Build the habit before the auditor asks the question

Prescription record retention is not a complex area of pharmacy compliance in principle, but it is one where the gap between what pharmacies think they are doing and what they are actually doing often turns out to be significant. The variation between state requirements, the overlay of federal standards for Part D and controlled substances, and the additional dimension of delivery documentation for home delivery programs together create a compliance landscape that requires a deliberate, policy-driven approach rather than informal assumptions about how long records need to be kept.

The pharmacies best protected in an audit are those that have documented their retention requirements in writing, matched those requirements to the longest applicable standard, and invested in digital record keeping systems that make retrieval immediate rather than laborious.

RxMile's pharmacy delivery software and compliance tools help pharmacies build delivery programs that generate complete, retrievable records from the first dispensing to the final delivery confirmation. Made by a pharmacy owner, for pharmacy owners. Start your 30-day free trial today.