How long to retain children's records under daycare licensing rules

Last updated 2026-07-09

What is the general rule for how long daycare providers must keep children's records?

No single federal law sets one retention period for every licensed daycare, so the answer starts with your state licensing code. Across most states the norm lands between 2 and 5 years after a child leaves care. Three years is the single number you'll see written into regulations most often ^[1].

The Child Care and Development Fund (CCDF) adds a separate floor for anyone who accepts subsidy payments. Under 45 CFR Part 98, grantees and subgrantees must keep financial and program records for at least 3 years from the date the final expenditure report is submitted ^[2]. That clock covers subsidy documentation, attendance records, and enrollment agreements tied to CCDF children. It does not replace your state licensing rule, which applies to all children.

Abuse and neglect records are the exception that trips people up. Many states break from the standard window and require these records kept until the child reaches a set age (often 21 or 28) or for a fixed period after the child turns 18. The reason is civil statutes of limitations for childhood abuse claims, which usually start running when the victim reaches adulthood, not when the incident happened ^[3].

So you almost certainly have two retention clocks running at once: one from your state licensing agency, one from CCDF if you take subsidies. A few record types (abuse reports, medication incident logs) carry a third, longer clock. Missing any one of them is exactly the gap that surfaces during an inspection or an audit and earns you a deficiency citation.

What do state licensing regulations actually say? A state-by-state comparison

State rules vary more than most providers expect. The table below covers a representative sample and the published retention periods for general enrollment and health records. These come from each state's current licensing regulations. Verify the live version of your own code before you rely on any figure here, because states update these rules on their own schedules ^[1][4].

State	Retention period (after child leaves care)	Key source
California	3 years	Cal. Code Regs., tit. 22, §101229
Texas	3 years	26 TAC §746.501
Florida	2 years	Fla. Admin. Code 65C-22.001
New York	3 years	18 NYCRR §418-1.11
Illinois	2 years	89 Ill. Adm. Code 407.260
Colorado	3 years	7 CCR 703-11, Rule 7.710
Ohio	1 year (inactive children)	OAC 5101:2-12-31
Pennsylvania	2 years	55 Pa. Code §3270.183
Georgia	1 year	Ga. Comp. R. & Regs. 591-1-1-.08
Virginia	2 years	22 VAC 40-185-510
Washington	3 years	WAC 110-300-0295
Minnesota	3 years	Minn. R. 9502.0415

A few patterns stand out. Ohio and Georgia sit at the low end with 1-year minimums for inactive records. That's genuinely short, and providers in those states should treat it as a true floor, not a target. California, Texas, and Washington cluster at 3 years. If your program runs multiple license types (a center plus a school-age program, say), you may face different minimums for different age groups inside the same state.

Ohio deserves a flag. Its 1-year minimum for inactive children looks low against the CCDF 3-year floor. An Ohio provider who accepts CCDF subsidies is bound by the federal 3-year rule for subsidy records even though state law asks for only 1 year ^[2]. Federal law wins whenever it's stricter.

Which specific records does the retention requirement cover?

Licensing codes rarely say just "keep records." They name categories. Most childcare regulations cover at least the following.

Enrollment and admission records: the original application, emergency contacts, authorized pickup lists, and custody documentation. Inspectors ask for these first.

Health and immunization records: vaccination history, well-child exam documentation, and any signed medical exemptions. Some states (California among them) require immunization records verified at enrollment and updated annually, and the record of that verification has to be kept ^[5].

Medication authorization and administration logs: every dose given, who authorized it, who administered it. These carry a separate evidentiary weight if a medication error ever becomes a legal claim.

Incident and injury reports: falls, bites, allergic reactions, anything requiring first aid or an emergency contact. Most states require a copy filed with the licensing agency within 24 to 72 hours depending on severity, and your copy stays on file for the full retention period ^[4].

Attendance records: daily sign-in and sign-out sheets. CCDF audits cross-reference attendance against subsidy billing, so gaps here are a major audit risk ^[2].

Abuse and neglect reports: any mandated reporter report made while the child was in your care. These carry the extended retention I covered above.

Financial records tied to individual children: subsidy documentation, fee agreements, payment receipts. These overlap with the CCDF 3-year financial requirement.

If you carry a home daycare insurance policy, your insurer may set its own retention expectations, especially around incident reports. Confirm that with your agent.

How does the CCDF 3-year federal retention rule work in practice?

The Child Care and Development Block Grant Act and its regulations at 45 CFR Part 98 require lead agencies (your state's CCDF administrator) and their subgrantees to keep financial and program records for 3 years ^[2]. That obligation flows down to you through your subsidy agreement.

The clock starts when the final expenditure report for that funding period is submitted, not when the child left care. So the real-world retention period usually runs longer than 3 years from a child's discharge date, because the expenditure report goes in months after the service period ends.

An HHS Office of Inspector General audit found significant documentation gaps in state CCDF programs, including missing attendance records and incomplete eligibility files. The report concluded those gaps made it impossible to determine whether payments were appropriate ^[6]. That's the enforcement reality: when auditors can't verify records, the state faces a disallowance, and the state often passes that liability back to the provider.

Here's the safest practical approach if you take subsidies. Keep every record for a subsidized child for 3 years from the last date of service, or 3 years from your state's final expenditure report submission date, whichever is longer. Then stack your state licensing period on top if it runs longer than that.

If your program has dealt with a compliance dispute or a fraud allegation (see our coverage of minnesota daycare fraud for what happens when documentation falls apart), keeping records past the minimum is genuinely protective.

When does the retention clock start, and when does it end?

This is where providers slip. The retention period almost always starts on the child's last date of attendance, not the day the record was created and not the day the enrollment agreement was signed ^[1][4]. A child who enrolled in 2019, had immunization records updated in 2021, and left care in 2023 starts a clock that runs from 2023.

Some states phrase it differently. They say "date of discharge" or "date the child ceases to receive services." Those all mean the same thing. The last day you provided care.

The end of the period is the date you're legally allowed to destroy the records. Allowed, not required. Nothing stops you from keeping records longer, and many experienced providers keep everything 5 to 7 years across the board rather than tracking a separate clock for each child. That's a reasonable choice as long as your storage is secure.

One real nuance: if a child withdraws and then re-enrolls, most state regulations treat the re-enrollment as a new period of care, and the clock resets from the new discharge date. Read your state's exact language, because a few states aggregate all periods of care instead.

Are there longer retention requirements for abuse and neglect records?

Yes, and this is the area where providers most often have a gap without knowing it.

Childcare providers are mandated reporters in every U.S. state. When you report to child protective services, the law requires you to keep a record of that report. Many states set the retention period for these records at the child's 21st birthday (sometimes 28th), not a fixed number of years after discharge ^[3].

The reason is civil statute of limitations law. Most states let a childhood abuse survivor file a civil suit until they're 21 to 26, sometimes later. Destroy the records after 3 years for a child who was 4 at the time of an incident, and you've thrown away documentation that might have protected you when the now-adult plaintiff sues 17 years later.

Several states have stretched their abuse limitations periods hard in recent years. California's AB 218, effective January 1, 2020, extended the civil limitations period to age 40 for survivors of childhood sexual assault ^[3]. That turns record retention for any abuse-adjacent incident into a multi-decade obligation in California.

Do this: keep a separate, clearly marked folder for any record touching a mandated reporter report or a licensing-reported abuse incident, and treat it as permanent until the child turns 21 at the very least. It's a simple filing habit, physical or digital, that could matter enormously later.

What happens if a daycare provider cannot produce records during a licensing inspection?

Inspectors check records against two things: the retention period in your state code, and the completeness rules for the records themselves. Fail either and you get a deficiency citation.

A missing or destroyed record before the retention period ends is usually cited as a Class B or Class II violation (the naming varies by state). It comes with a corrective action deadline, and on repeat it can hit your license status. Some states attach civil penalties: California can impose fines starting at $150 per violation day for Class B violations ^[5].

More serious is a CCDF-funded child. If an auditor can't verify attendance or eligibility, the state may recoup those payments from you. The OIG recommended that HHS strengthen oversight of documentation requirements across state CCDF programs ^[6], which tells you federal scrutiny of record-keeping is rising, not fading.

The least obvious risk is a civil lawsuit. If a child is injured at your facility and you can't produce incident reports, medication logs, or health records because the period passed and you shredded them, you may face a spoliation inference. That means a judge can instruct the jury to assume the missing records were unfavorable to you. That's a serious disadvantage even if you destroyed the records lawfully and in good faith.

If you're building a record-keeping system, the ChildCareComp compliance toolkit has templates for retention schedules and inspection-ready file organization.

How should daycare providers physically store and secure children's records?

State codes almost universally require children's records kept confidential. Most specify a locked file cabinet for paper and, for electronic records, a password-protected system with restricted access ^[4][5]. HIPAA does not govern most childcare providers (childcare isn't a covered entity under HIPAA), but FERPA applies to school-age programs that are part of an educational institution.

For a typical licensed home daycare or center, here's what that looks like in practice.

Paper records go in a locked cabinet children can't reach and other families and unauthorized staff can't open. Only staff who need access for their job get the key or code.

Electronic records need real access control: individual passwords instead of a shared login, plus a backup. Cloud-based childcare management software (Procare, Brightwheel, and similar) usually meets the technical bar if you configure it right, but you still own access management.

When records finally get destroyed, destroy them securely. Shred paper. Delete electronic records from your backups too, not only the active file.

Proximity matters for active files. Your code may require current enrollment records and emergency contacts immediately accessible during operating hours, meaning not in off-site storage. Check the exact wording in your state's rules.

Decent daycare liability insurance sometimes covers data breach claims, which matters if electronic records with children's health information get compromised. Ask about it when you shop coverage.

Do home daycares have different record retention rules than licensed centers?

In most states, licensed family child care homes face the same or nearly the same retention requirements as centers, even though the regulatory citation is different ^[1][4]. Home providers may have fewer record categories overall (no board minutes, fewer staff files), but the retention period for children's records is typically identical.

A few states run lighter documentation rules for providers below a capacity threshold. Georgia, for instance, uses tiered licensing, and its smallest-capacity home providers face somewhat reduced record-keeping. Even there, the children's record retention period doesn't shrink to match.

Home providers who also take school-age children after hours or run summer programs should watch for this: some states apply different licensing rules (and different retention rules) once program size or age range changes. If you expand, verify whether your retention obligations move with the new license category.

One practical difference for home providers is space. The locked-cabinet requirement can feel like a lot in a home, but it's non-negotiable. A locking file box from an office supply store meets the rule if it genuinely locks and stays secured. Records in a home office that children can wander into does not.

What is the best record retention schedule for a childcare provider to actually use?

Given the spread between state minimums, the CCDF requirement, and the extended window for abuse records, most compliance people recommend a tiered schedule instead of a single number ^[1][2][3].

Here's a framework that works.

Category 1: General enrollment, health, attendance, and billing records. Keep for the longer of (a) your state licensing minimum after last date of care, or (b) 3 years after the related subsidy expenditure report is submitted if CCDF funds were involved. For most providers that means 3 to 5 years after the child leaves.

Category 2: Incident and injury reports. Keep for the same period as Category 1, or until the child turns 21, whichever is longer. A child hurt at age 2 who leaves care at 3 could carry a claim window to age 21 or beyond in states with extended minor tolling rules.

Category 3: Mandated reporter records, abuse investigations, and anything tied to a license revocation or enforcement action. Treat these as permanent, or keep until the child turns 21 at minimum. If your state extended its civil statute of limitations (look up the specifics), consider age 25 or beyond.

Category 4: Financial records not tied to individual children (general ledger, vendor invoices). The IRS recommends keeping tax-related business records at least 3 years, and up to 7 years if there's any question of underreported income ^[7]. For the wider financial picture, see general guidance on daycare cost accounting.

Build a simple annual purge calendar. Every January, review your files and safely destroy the ones past their retention date. Doing it once a year also surfaces any record gaps before an inspector finds them for you.

How do childcare licensing agencies actually verify record retention during inspections?

Inspectors review records during scheduled renewals and unannounced visits. The scope varies by state, but it almost always includes pulling a sample of currently enrolled children's files and, this part matters, checking whether files from recently discharged children are still present and intact ^[4][5].

An inspector who finds a destroyed file for a child who left 18 months ago (in a state with a 3-year minimum) will cite a violation. The inspector may also ask you to explain your record retention policy. No written policy? In some states that's a second citation on its own.

Texas and California, among others, have moved parts of their compliance monitoring to self-reporting systems where providers attest to record completeness. Attestation doesn't kill in-person verification, but it does fold your written retention policy into your attestation trail.

Here's what surprises providers: inspectors often check the dates inside files, more than whether files exist. A file that's present but missing pages (no current-year immunization update, for example) counts as an incomplete record, not a retained one. Complete retention means the whole file is intact, more than a folder with the child's name on it.

If an inspection turns up a pattern of retention violations, the agency may increase your inspection frequency. For a home daycare that's especially disruptive. Getting the system right the first time is far easier than fixing it under closer oversight.

Frequently asked questions

How long do I have to keep a child's enrollment file after they leave my daycare?

The minimum ranges from 1 year (Ohio, Georgia) to 3 years (California, Texas, Washington) after the child's last date of care, depending on your state's licensing code. If you accept CCDF subsidies, federal rules require at least 3 years from the final expenditure report date regardless of state minimums. When in doubt, keep files 3 years after discharge as a practical floor that satisfies most jurisdictions.

Does CCDF require daycare providers to keep records for 3 years?

Yes. Under 45 CFR Part 98, CCDF grantees and subgrantees must keep financial and program records at least 3 years from submission of the final expenditure report. That obligation flows down to providers through subsidy agreements. The clock runs from the expenditure report date, not from when the child left care, so the effective period is often longer than 3 years from the child's discharge.

Do I need to keep abuse and neglect records longer than other records?

In most states, yes. Records tied to mandated reporter reports and abuse investigations are typically kept until the child reaches age 21, or in some states age 28, because civil statutes of limitations for childhood abuse claims run from when the victim turns 18. California extended its civil limitations period for childhood sexual assault to age 40 under AB 218 (effective 2020). Keep these in a separate, permanently retained file.

What records do daycare licensing inspectors actually check?

Inspectors routinely check enrollment applications, emergency contacts, immunization records, medication administration logs, incident and injury reports, and attendance records. They typically pull a sample of current files and verify that recently discharged children's files are still present and complete. Gaps in any of these, including missing immunization updates or files destroyed before the retention period ends, generate deficiency citations.

Can I keep children's records electronically instead of in paper files?

Most states permit electronic storage as long as records sit in a secure, password-protected system with access limited to authorized staff, and you can produce them on request during an inspection. Cloud-based childcare management software generally qualifies if access controls are configured properly. Check your state's specific language; a few states still require original signatures on certain documents.

What happens if I destroy a child's records before the required retention period ends?

You risk a deficiency citation at your next inspection, which can affect renewal and may carry civil penalties. In states with penalty structures like California's, fines start at $150 per violation day for Class B violations. If a lawsuit arises, courts can apply a spoliation inference, letting the jury assume destroyed records would have been unfavorable to you, even if you believed the retention period had passed.

Is there a federal law that sets the minimum record retention period for all daycares?

No single federal law governs retention for all children's records at every licensed daycare. The CCDF regulations at 45 CFR Part 98 set a 3-year minimum for subsidy-related program and financial records. FERPA applies to programs connected to educational institutions. Most retention rules come from state childcare licensing codes, which is why the range runs so wide, from 1 year to 5 or more years.

Do home daycare providers have the same record retention requirements as childcare centers?

Generally yes. In most states, licensed family child care homes face the same retention periods for children's records as centers, though the regulatory citation differs. The types of records required may be narrower for home providers, but the timeline for enrollment, health, attendance, and incident records is typically the same. A few states run tiered rules for very small home providers, so verify your specific license category.

How long should I keep attendance records for daycare subsidy children?

At minimum, 3 years from the date the related final expenditure report is submitted to the state under CCDF rules (45 CFR Part 98). In practice that often means 4 or more years from the last date of service, because the expenditure report submission happens after the funding period closes. Attendance records are one of the primary audit targets in CCDF compliance reviews.

When does the retention clock start for a child's records?

The clock starts on the child's last date of attendance, not the date the record was created or the enrollment agreement was signed. If a child temporarily withdraws and re-enrolls, most states treat the new enrollment as a separate period and reset the clock from the new discharge date. After that final discharge date, count forward the number of years your state requires before you can legally destroy the records.

How should I securely destroy children's records when the retention period ends?

Cross-cut shred paper records rather than tossing them in a trash bin. Delete electronic records from active files and from all backups. Some providers hire a certified records destruction service that issues a certificate of destruction. Log the date and method for each file you purge, so you have proof you destroyed records lawfully rather than negligently if it ever comes up.

Do medication administration logs have a different retention requirement than enrollment records?

In many states, yes. Medication logs are often treated as incident-adjacent records and may carry a longer period than standard enrollment files, especially if a medication error occurred. Even where the state minimum matches enrollment records, the litigation risk from medication incidents is high enough that most compliance advisors recommend keeping medication logs until the child turns 21 as a protective practice.

My state only requires 1 year of retention but I accept CCDF subsidies. Which rule applies?

Federal CCDF rules require at least 3 years of retention for program and financial records tied to subsidy children. Federal law sets a floor, not a ceiling. Your state can't lower that requirement below 3 years for CCDF-related records. So for subsidy children you must keep records at least 3 years from the final expenditure report date, no matter what your state licensing code says for non-subsidized children.

Are there different retention rules for school-age childcare versus infant and toddler programs?

In some states, yes, because different license types govern different age groups and those types sit in separate regulatory chapters with potentially different record requirements. The retention period is usually the same across age groups within a given license type, but the required content of the record may differ (developmental screening requirements, for example, are age-specific). Always verify under the license type you actually hold.

Sources

1. Child Care Aware of America, Child Care in America state fact sheets: State childcare licensing record retention periods commonly range from 1 to 5 years after a child's last date of care.
2. HHS Office of Child Care, 45 CFR Part 98 CCDF Regulations: CCDF grantees and subgrantees must retain financial and program records for at least 3 years from the date of submission of the final expenditure report.
3. California Legislative Information, AB 218 (2019) civil statute of limitations for childhood sexual assault: California AB 218, effective January 1, 2020, extended the civil limitations period for childhood sexual assault claims to age 40.
4. National Conference of State Legislatures, childcare licensing regulations resources: State licensing codes specify categories of required children's records and mandate secure storage in locked cabinets or password-protected electronic systems.
5. California Department of Social Services, Community Care Licensing Division, Title 22 CCR: California Title 22 requires immunization records to be verified at enrollment and retained for 3 years; civil penalties start at $150 per violation day for Class B violations.
6. HHS Office of Inspector General, audit of CCDF program documentation: An HHS OIG audit found significant documentation gaps in state CCDF programs including missing attendance records and incomplete eligibility files, recommending strengthened oversight.
7. IRS, recordkeeping guidance (Publication 583, Starting a Business and Keeping Records): The IRS recommends keeping tax-related business records for at least 3 years and up to 7 years if there is any question of underreported income.
8. Texas Health and Human Services, child care minimum standards (26 TAC §746.501): Texas 26 TAC §746.501 requires child-care centers to retain children's records for 3 years after the child leaves care.
9. Pennsylvania Department of Human Services, 55 Pa. Code §3270.183: Pennsylvania 55 Pa. Code §3270.183 requires child care centers to retain children's records for 2 years after the child's last date of attendance.