How long does a massage therapist have to keep client records? A table by state and country

Somewhere in your practice there is a folder, or a drawer, of records for clients you no longer see. You would like to throw it out, or you are afraid you may not. Type how long does a massage therapist have to keep client records into a search box and five different numbers come back, and all five can be right, because no single body sets the number.

In the US it sits in your state board's rule. Texas says two years, and only for the dates, types and billing (16 TAC § 117.90, 2026); Massachusetts says seven, for the whole file (269 CMR 6.06, 2017). In the UK the law names none and your insurer does; in Australia it comes from state acts. The table below shows which number is whose, and where there is none — not legal advice, because rules change, and every row carries the day we read it.

Who sets the clock for you?

Your number comes from one of three places. A state board writes it into a rule (US); a limitation period and an insurance condition stand in for a number the law never gives (UK); a state health-records act sets it and your association repeats it (Australia). Only the first hands you a figure to look up.

The Federation of State Massage Therapy Boards lists 50 US jurisdictions that regulate massage therapy; Kansas, Minnesota and Wyoming are not on the list (FSMTB, 2026). Each state that sets a period writes it into its own rule or statute, and the numbers do not agree. Washington says three years (WAC 246-830-570, 2021), Massachusetts seven (269 CMR 6.06, as amended 2025), Wisconsin five (MTBT 5.02, 2015), New York six (8 NYCRR 29.2, 2026), Texas two (16 TAC § 117.90, 2026). Each is right for exactly one state.

The number that belongs to no state is "HIPAA says seven years". HIPAA sets no period for a client's file; the FAQ below has both texts.

In the UK nobody writes the number down. "The UK GDPR does not set specific time limits for different types of data. This is up to you, and will depend on how long you need the data for your specified purposes" (ICO, 2026). That page now carries a banner saying the guidance is under review after the Data (Use and Access) Act; check it again before you rely on it.

Two things fill the gap. The Limitation Act 1980 says how long a claim can wait: six years for a tort (s. 2), three for personal injury (s. 11). The insurer names the figure everyone repeats: "it is usually a condition of your Insurance policy (Contract Law) that records be kept for at least 7 years, or for 7 years after they reach the age of majority when treating minors" (Balens, 2019).

Even a statutory regulator declines to name one: the HCPC, which does not cover massage, answers "This will vary according to the context in which you practise" (HCPC, 2025). That seven years is a term in your policy, not a law of the country: the document to open is your policy.

Australia looks like the UK from a distance and is not. Ahpra's 15 National Boards do not include massage (Ahpra, 2024), so the Ahpra page that ranks for this question is not addressed to you. The number is in state health-records law.

New South Wales asks for "7 years from the last occasion on which a health service was provided to the individual" (Health Records and Information Privacy Act 2002 (NSW), s. 25). For a client who was under 18, the same section says "until the individual has attained the age of 25 years". Victoria writes the same figures as a ban on deleting earlier (Health Records Act 2001 (Vic), HPP 4.2).

The Association of Massage Therapists repeats "kept for a minimum of 7 years" with no start date and no section cited (AMT, 2023). The association echoes the acts; the text to keep is the act.

How long does a massage therapist have to keep client records? The table

Find your row and you have your number, or the certainty that there is none. One to seven years across the twenty-six US jurisdictions that state a period; no massage rule at all in twenty-five more; seven years in New South Wales and Victoria; no statutory period in the UK. Every row names the text and the day we read it.

The columns are ours; the words in the cells are the rule's. Minimum period is the floor the text sets; Clock starts from and Minors are quoted where the rule speaks and read "not stated" where it does not. That blank is a finding: "at least five years" without an anchor leaves you to pick the anchor. Who this binds is whoever the rule names: the licensee, the establishment, or everyone under a general statute that includes massage.

The table holds 51 US jurisdictions — twenty-six with a stated period, twenty-five with none, Tennessee among them only in part — plus the UK, New South Wales and Victoria. Those twenty-five are not gaps. They are the answer for half the country: no board tells you when to stop, and the number you find online for such a state almost always belongs to someone else.

Check the date on any rule you find. A reputable host can carry an old version with nothing on the page to say so. A live link is not a current rule.

What does the clock start from?

Almost never from the day you wrote the note: most rules run from the last session, some from the last entry or the end of the working relationship, several run a minor's clock from a birthday, and a few name no start at all.

Most rules count from the last time you saw the client, not from the date on the page. Washington runs its three years "from the date of last treatment" (WAC 246-830-570, 2021). Delaware, Pennsylvania and Missouri count from the last date services were provided (24 Del. Admin. Code 5300, 2024; 49 Pa. Code § 20.42, 2026; 20 CSR 2197-3.010, 2026).

Louisiana's five calendar years begin "after the last service is performed for that client" (LAC 46:XLIV.4101, 2013). So a note from your first year with a client and one from the last session expire on the same day, the later one.

Other anchors exist, and they can land on different days. New Jersey counts "from the date of the most recent entry" (N.J.A.C. 13:37A-5.2, 2026), so a line added after the client stopped coming restarts the seven years. Alabama, North Carolina and Maryland count from the end of the relationship (Ala. Admin. Code ch. 532-X-3, 2024; 21 NCAC 30 .0505, 2026; COMAR 10.65.03.04, 2026).

Montana says both in two rules: "from the last date of service to the client" in one, "from the termination of the therapeutic relationship" in the other (ARM 24.155.402 and 24.155.902, 2020). Nevada anchors to the record itself, "for 5 years after their receipt or production" (NRS 629.051, 2023). Wisconsin, Kentucky, West Virginia, Texas and Mississippi give a number and no anchor at all. The anchor is yours to pick.

One Wisconsin line travels with its rule online: a client "shall continue to be considered a client for 6 months after the termination of professional services". It sits in the prohibition on sexual conduct, not in the recordkeeping provision (MTBT 5.02(15)(b), 2015), and says nothing about how long the file lives.

For a client who was a minor, several rules count birthdays instead of sessions. Washington keeps records three years after the client turns eighteen (WAC 246-830-570, 2021). New York's regulator puts it in one line, "six years or until the client turns 22, whichever is longer" (NYS Office of the Professions, 2026). Nevada forbids destroying "the health care records of a person who is less than 23 years of age on the date of the proposed destruction of the records" (NRS 629.051, 2023).

New South Wales and Victoria run to 25 (HRIP Act 2002, s. 25; Health Records Act 2001, HPP 4.2). Massachusetts runs two clocks and takes the longer. For a minor at the last visit, records must be kept "either seven years from the date of the last client encounter or until the client reaches the age of eighteen, whichever is the longer retention period" (269 CMR 6.06, as amended 2025).

A fifteen-year-old's file is governed by the seven years, a six-year-old's by the birthday.

The UK has no records clock, so the arithmetic moves to the claim. The three years for personal injury run from the later of the event and "the date of knowledge (if later) of the person injured" (Limitation Act 1980, s. 11). For someone who was under 18 the period does not begin until they cease to be under a disability (s. 28).

That is why a UK practitioner cannot compute a safe date from the last session alone. It is also why the insurer's "7 years after they reach the age of majority" exists (Balens, 2019). The Limitation Act is a rule about when a claim can be brought, not about what you must keep.

The records you didn't write

Treat your notes and the client's forms as one file, because the rules do. To you they are two different things; to the rules in the table they are one, "client records", and where a rule gives the client a right of access it does not ask who held the pen.

My folder holds two kinds of paper: my notes on each session — what we did, how the person seemed, what I noticed, what I would try next. And the documents I asked clients to write themselves — the consent form at the start, and afterwards a feedback sheet, sometimes a longer written reflection. The note is my working material, a snapshot of sensation, emotion and approach that lets me bring the person back to mind and carry on from there. The consent form is different: of everything in the folder, that part belongs to the client, who wrote it.

The rules do not draw that line: Mississippi's board spells out what "required client documentation" means, and the list runs from intake and release forms through the notes to the appointment book and client evaluations (Mississippi State Board of Massage Therapy, 2025). Delaware keeps intake forms "and any other client records" on the establishment's premises for the same three years as the notes (24 Del. Admin. Code 5300, 2024). The period attaches to the file, whoever wrote each page.

Access is just as blind to authorship. North Carolina assigns ownership of client records to the establishment, or to the licensee working at one, and requires release within 30 days of a written request (21 NCAC 30 .1005, 2019). Minnesota, which does not license massage, still requires a practitioner outside licensing to give every client a written statement covering credentials, complaints, fees, confidentiality and the right of access to records (Minn. Stat. § 146A.11, 2026). In both places the note you wrote and the form they wrote stand on the same footing when the client asks.

Which lands on something I did not do: I do not remember ever telling a client that I was writing things down, and I do not remember one asking. That was a habit, not a position. In Minnesota that written statement is the one duty that reaches a practitioner outside licensing. In the UK the regulator asks that you can justify what you hold (ICO, 2026).

Being open about the records, not a number, is the obligation that follows you out of licensing. What goes into the note is the hub article on session notes; this one stops at how long it stays.

When nobody sets a date: how long should client records be kept?

If no board, insurer or association names one for you, then in the United States no rule in the table names one either, and none puts a ceiling on how long the folder sits there. In the UK a duty reaches you without a number — "no longer than is necessary" — and it names keeping things "just in case" as the wrong answer.

The question of deleting has never come up for me, not once. I have a folder of paper records from clients I no longer see, and it is still there, on the off chance. If one of them comes back, what is in it will still matter: I go back to old notes to refresh how a session went and which approach may have worked. That sense, going into a session, points at where to go, where not to, what burned me last time and what did the job.

Between the two fears I have only ever had one. Keeping too much has never worried me — better to write more than less. Deleting something and then needing it has, and there have been times I did need it.

That is testimony, not advice, and here is where it stops working. In the United States it works because no rule is addressed to me. Minnesota lists massage therapy among the unlicensed complementary and alternative health care practices under chapter 146A (Minnesota Department of Health, 2026). The client bill of rights that chapter requires sets no retention period and does not require records to exist (Minn. Stat. § 146A.11, 2026).

South Carolina licenses massage and still writes a conditional: "If client treatment records are kept, they shall be maintained in a manner to safeguard the confidentiality of the records" (S.C. Code Regs. 77-141, 2023). Idaho's whole massage chapter runs three pages with no records provision at all (IDAPA 24.27.01, 2024). In those states no rule tells you to keep the folder, and none tells you when to empty it.

In the UK it does not work, and the regulator has the folder's exact words. The principle is one clause: personal data "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed" (UK GDPR, Art. 5(1)(e), as reproduced by the ICO, 2026). The ICO's gloss is shorter: "You must not keep personal data for longer than you need it", you should not keep data indefinitely "just in case", and you need to "be able to justify" how long you keep it (ICO, 2026).

A small practice doing occasional low-risk processing may not need a written retention policy, the same page says, but "must still regularly review the data you hold, and delete or anonymise anything you no longer need". The duty attaches to holding the data, not to holding a licence.

The licensing states sit between the two: their rules set a floor, and where they mention a ceiling it is a permission. Washington says records may be disposed of once the period has run (WAC 246-830-570, 2021). Louisiana says that after five years "client records may be disposed of in an appropriate and confidential manner" (LAC 46:XLIV.4101, 2013). Victoria drafts it the other way round, a ban on deleting before seven years or age 25 and nothing about after (Health Records Act 2001 (Vic), HPP 4.2).

So keeping forever is not a rule anywhere in the table; it is what happens when no one asks. What happens when a practice closes, or its owner dies, is the question a reader asks on a pause, and none of these texts answers it.

Getting rid of them

Where a rule says how, it says shred, delete, erase, or make the medium unreadable; most only say "securely"; two Australian states ask you to write down what you destroyed and when. Scanning is not disposal.

Most rules stop at the adverb. Alabama, North Carolina, West Virginia and the District of Columbia each tell the licensee to dispose of client files "in a secure manner" and leave the method to you (Ala. Admin. Code ch. 532-X-3, 2024; 21 NCAC 30 .0505, 2026; W. Va. Code R. § 194-1-4.1, 2026; DC Health, 2019).

Washington names methods: once the period has run, records may be disposed of "by shredding, deleting or erasing electronic media, or otherwise rendering the media unusable and unreadable" (WAC 246-830-570, 2021). That covers a filing cabinet and a hard drive in one sentence, and it is the method to borrow when your rule only says "securely".

Australia adds a step none of the US rules in the table asks for: a record of the destruction. In New South Wales a practice that deletes health information "must keep a record of the name of the individual to whom the health information related, the period covered by it and the date on which it was deleted or disposed of" (HRIP Act 2002 (NSW), s. 25); Victoria's HPP 4.3 asks for the same note (Health Records Act 2001 (Vic), Sch. 1). The file goes; a line saying it went stays.

My own plan for the folder, when I next find it, is either to destroy it or to scan it, pack it up with a password and burn the paper. The second half deserves a plain word: a scan is not disposal. The rules above say "records" and "files", not "paper", and Washington puts electronic media in the same breath as shredding. A password-protected archive is still a record with the same clock on it — safer storage, not an ending.

Where do the records live while the clock runs?

Whatever you keep them in, it should show the last session date for every client, keep each history in one place, and let you take all of it with you when you leave.

Every anchor in the table — last session, last entry, end of the relationship, a birthday — is a date you have to find for one client, years later. HoldSpace is practice management for holistic practitioners — voice-first session notes, online booking, and client history in one place, built for people who hold space, not for hospitals.

Notes belong to the client rather than to a session, so a whole history reads as one timeline with its dates on it. Deleting a client is an archive step: the whole tree is kept for 30 days before it is removed for good. You can export your clients, sessions, notes, forms and logs as one file at any time, which is what leaving looks like when a practice closes.

Neither the tool nor this article tells you your period: the table shows what each document says, and nothing here, and nothing in the product, decides which one governs you. How the screens look is in the article on why we built it; the plans are on the pricing page.

So, the folder, this week. Find your row in the table and write its number and its starting point inside the cover; if the row says none, write that too, because it is the answer. Then go through the folder once and note the last session date for each client: almost every clock in the table starts there. What is past its period can go the way your rule says, shredded or erased; what has no period is yours to decide, and deciding again next year beats keeping it forever because nobody asked.

Keep every client's history in one timeline — free30 minutes of voice, 10 structurings and 5 clients.

FAQ

How long do therapists have to keep client records?

As long as the body that regulates your own profession says, and a neighbouring profession's number is not yours. In the table it runs from two years (Texas, and only for the dates, types and billing — 16 TAC § 117.90, 2026) to seven (Massachusetts, 269 CMR 6.06, 2017). The seven years shown online for Minnesota belongs to the Board of Behavioral Health and Therapy, which does not license massage (Minn. R. 2150.7535, 2026).

How long does a massage therapist have to keep client records in the UK?

No law names a number. The UK GDPR "does not set specific time limits for different types of data" (ICO, 2026); the seven years practitioners quote is an insurance condition (Balens, 2019); the Limitation Act 1980 sets six years for a tort claim and three for personal injury (ss. 2 and 11). Your number lives in your own policy wording.

How long does a massage therapist have to keep client records in Australia?

Seven years from the last service in New South Wales (Health Records and Information Privacy Act 2002 (NSW), s. 25). In Victoria, a ban on deleting before seven years or age 25, whichever is later (Health Records Act 2001 (Vic), HPP 4.2). Both come from the state health-records acts, not from Ahpra, whose 15 National Boards do not include massage (Ahpra, 2024).

Does HIPAA require keeping client records for seven years?

No. "The Privacy Rule does not include medical record retention requirements and covered entities may destroy such records at the time permitted by State or other applicable law" (HHS, 2023). HIPAA's six years is in the Security Rule: a covered entity must "Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR § 164.316, 2023). That paragraph (b)(1) is its own policies, procedures and the record of its own assessments, not anyone's session notes. Whether HIPAA reaches your practice is a separate question for a legal professional who knows your state; our position is in the Terms — this is not a HIPAA-covered tool, and if HIPAA applies to your practice, read them first.