Missouri Healthcare Compliance Requirements
State-specific breach notification rules, medical records retention periods, PDMP requirements, and mandatory reporting obligations for medical practices operating in Missouri.
Missouri healthcare compliance is governed by Mo Rev Stat §407.1500, embedded in the Missouri Merchandising Practices Act and enforced by the Missouri Attorney General's office in Jefferson City. The placement inside the merchandising-practices code is consequential: violations carry penalties up to $150,000 per violation, among the highest single-violation ceilings in the central United States. The statute's deadline language — "without unreasonable delay, consistent with law enforcement needs" — gives the AG broad discretion to challenge notice timelines, and the AG must be notified for any breach affecting Missouri residents with no minimum-resident threshold. Missouri was famously the last U.S. state to adopt a statewide PDMP, with the Missouri PDMP launching only in 2023 after years of county-level patchwork enforcement — the program is now in phased enforcement, and recent prescribers should re-verify their registration status. Hospital records must be retained 7 years from last treatment under 19 CSR 30-20.021, with pediatric records held until age of majority plus 7 years. The Missouri Merchandising Practices Act's $150,000 ceiling makes Missouri a high-exposure state.
Breach Notification Rules
Notification deadline
Most expedient time possible
Notification must be made without unreasonable delay, consistent with law enforcement needs.
AG notification threshold
All breaches
Notify: AG
Harm analysis required
Penalty range
Enforceable by AG; up to $150,000 per violation under Merchandising Practices Act
Enforcement Posture
The Missouri Attorney General's posture on healthcare data is moderate, but the Missouri Merchandising Practices Act's $150,000-per-violation ceiling places Missouri among the higher-penalty jurisdictions. The AG's Consumer Protection Division has historically pursued cases that combine deceptive-acts claims under the broader merchandising statute with the discrete §407.1500 breach-notice violation, producing layered exposure. Kansas City and St. Louis metros generate the majority of enforcement matters, but Springfield and Columbia have also surfaced. The lack of a resident-count threshold for AG notice means even small Missouri practices land on the AG's docket after any incident affecting Missouri residents. Coordination with law enforcement is built into the statute, but practices should not interpret the "consistent with law enforcement needs" language as authorizing indefinite delay.
Medical Records Retention
| Record type | Retention period | Measured from |
|---|---|---|
| General medical | 7 years | Last treatment |
| Pediatric | 7 years | Patient turns 18 |
Controlled-Substance Prescription Monitoring (Missouri PDMP)
The Missouri PDMP launched statewide only in 2023, making Missouri the last U.S. state to adopt a statewide controlled-substance monitoring program. Queries are required before every controlled-substance prescription, with delegation to licensed staff permitted. Exemptions cover hospice, cancer treatment, ER three-day supplies, inpatient or long-term-care administration, and veterinary prescribing. The program is in phased enforcement, with civil penalties ramping alongside Missouri Board of Healing Arts discipline. Register at missouri.pmpaware.net and document the query in the chart. Prescribers who relied on the old county-level St. Louis County PDMP should re-register on the statewide system.
Check required
Every prescription
Check frequency
Every prescription
Delegation allowed
Penalty range
Licensing board discipline; civil penalties; program established 2023 with phased enforcement
Exemptions
Hospice patients, cancer treatment, ≤3 day supply in ER, inpatient hospital or long-term care facility, veterinarians
How Missouri Rules Hit by Specialty
Pharmacy/compounding
Missouri's compounding pharmacies — concentrated in the St. Louis and Kansas City metros — face Missouri PDMP query obligations newly launched in 2023, plus Missouri Board of Pharmacy inspection rules. The PDMP's phased enforcement means civil penalties are still ramping; the Board of Pharmacy retains independent disciplinary authority.
Hospital systems
BJC HealthCare, Mercy, and SSM Health span the Missouri-Illinois border with networks reaching into Kansas, Arkansas, and Oklahoma. A cross-border EHR incident must satisfy Missouri §407.1500's broad-discretion AG-notice standard alongside Illinois, Kansas, Arkansas, and Oklahoma counterparts.
Pediatrics
Missouri pediatric records must be retained 7 years past age of majority under 19 CSR 30-20.021. The 7-year-past-majority window is shorter than Iowa's 10-year-past-majority, and breach response should be calibrated to whichever state's residents are affected.
Mandatory Reporting Obligations
Mandated reporters
Physicians, nurses, dentists, psychologists, social workers, and all healthcare professionals
Report to
Children's Division, Department of Social Services, or local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Class A misdemeanor; Class E felony if abuse results in serious injury or death
Immunity provision
Good faith reporters immune from civil and criminal liability under RSMo 210.115
Mandated reporters
Physicians, nurses, social workers, and all healthcare professionals
Report to
Adult Abuse and Neglect Hotline, Department of Health and Senior Services
Timeline
Immediately / as soon as possible
Penalty for failure
Class A misdemeanor
Immunity provision
Good faith reporters immune from civil and criminal liability
Mandated reporters
Healthcare providers treating injuries from suspected criminal acts
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
Physicians, laboratories, and healthcare facility administrators
Report to
Missouri Department of Health and Senior Services
Timeline
Within 24 hours
Penalty for failure
Class A misdemeanor
Immunity provision
Good faith reporters immune from civil liability
Mandated reporters
All healthcare providers treating gunshot wounds or wounds from deadly weapons
Report to
Local law enforcement
Timeline
Immediately / as soon as possible
Penalty for failure
Class B misdemeanor
Immunity provision
Good faith reporters immune from civil and criminal liability
Missouri Compliance FAQs
Mo Rev Stat §407.1500 requires notice "without unreasonable delay, consistent with law enforcement needs." There is no fixed day count, but practices generally align with the HIPAA 60-day outer limit. The "consistent with law enforcement needs" language allows brief delays when active investigation requires it — document any law-enforcement coordination contemporaneously.
Mo Rev Stat §407.1500 is enforced under the Missouri Merchandising Practices Act, which allows penalties up to $150,000 per violation. The AG has discretion to seek restitution, injunctive relief, and parallel deceptive-acts claims. The high single-violation ceiling makes Missouri a notable-exposure jurisdiction for healthcare breaches.
19 CSR 30-20.021 requires hospitals to retain general medical records for 7 years from last treatment. Pediatric records must be retained until age of majority plus 7 years. Physician offices outside the hospital regulatory scheme default to HIPAA's six-year minimum, but most align with the hospital 7-year window to support litigation and Board of Healing Arts review.
Missouri was the last U.S. state to adopt a statewide PDMP. The Missouri PDMP launched in 2023 after years of county-level patchwork enforcement led by the St. Louis County program. The statewide program is in phased enforcement, and prescribers who relied on the older county system should re-register through the statewide platform at missouri.pmpaware.net.
Yes. Mo Rev Stat §407.1500 does not impose a minimum-resident threshold for AG notice. The AG's Consumer Protection Division receives notice for any breach affecting Missouri residents, regardless of count. AG notice should mirror the substantive content of the consumer letter and should account for the Merchandising Practices Act $150,000-per-violation exposure.
Guides & Articles
Neighboring State Compliance Guides
Stay audit-ready in Missouri
GuardWell tracks Missouri-specific breach deadlines, retention periods, Missouri PDMP PDMP queries, and mandatory reporting obligations automatically.