The burglary could have ended there ; until Sutter, a network of doctors and hospitals in northern California, realized that one of the purloined computers contained the electronic medical data for more than four million patients. Some of it dated back to 1995.
Medical records are eligible for destruction in a minimum of seven years from the anniversary of the last date of treatment or, if the patient is a minor, seven years from the anniversary of the last date of treatment or until the minor reaches 21 (whichever is later). Do not destroy medical records that relate to any civil, criminal, or administrative proceeding if you know the proceeding has not been finally resolved. Follow any state and federal regulation that requires you to retain medical records longer than the above time periods. Read Retention of Medical Records