Regulation
How long must you keep diagnostic images in Colombia (and what it means for your storage)
The question almost always arrives the same way: “how many years do I have to keep the images?”. And it almost always gets one of two wrong answers: “twenty years”, a figure that changed nearly a decade ago, or “fifteen years”, which is right for the report but does not fully describe what happens to the image.
The distinction is not academic. The ten-year archive budget, the document disposal policy and the answer you give when a court asks for a 2014 study all follow from it.
The figure almost everyone quotes is no longer in force
The number still circulating in presentations, tenders and internal manuals is twenty years, and it comes from article 15 of Resolution 1995 of 1999: a minimum of five years in the active archive and a minimum of fifteen in the central archive.
That article was amended. Resolution 839 of 2017 from Colombia’s Ministry of Health and Social Protection regulated the handling, custody, retention period, conservation and final disposal of medical record files, and in its article 3 set the period at fifteen years from the date of last care: the first five in the active archive and the following ten in the central archive. Its article 14 states that it amends Resolution 1995 of 1999 as applicable.
Five fewer years of obligation over an archive that grows every month is not a detail. It is a material difference in the budget.
Two exceptions stretch the period rather than shorten it. For medical records of victims of human rights violations or serious breaches of International Humanitarian Law, the retention and conservation terms are doubled. And if the record forms part of proceedings for crimes against humanity, conservation is permanent.
The report and the image are not the same thing under the rules
This is the point most retention policies we have seen skip over, and it is the one that really determines how many terabytes you will pay for.
The report — the interpretation signed by the radiologist — is unquestionably part of the medical record. Resolution 1995 of 1999 is explicit: in the case of diagnostic images, interpretation reports must be entered in the specific register of paraclinical examinations. The full retention period applies to it.
The image has a regime of its own. That same article 11 establishes that diagnostic images may be handed over to the patient, explaining the importance of preserving them for future analysis, and that this act must be recorded in the medical record with the patient’s signature. It closes with a sentence worth reading twice:
In any case the service provider shall be responsible for these images if it has not recorded their delivery in the medical record.
Colombia’s National Health Superintendency read it the same way in its Opinion 338051 of 2024: preserving the images is the provider’s responsibility, and it only passes to the patient when there is a record of delivery signed by them.
That article was written for a world of film
The 1999 rule pictured an envelope of X-ray films the patient took home and signed for on receipt. Delivery was a physical, verifiable event with a signature attached to it.
Your operation today looks nothing like that. Images are delivered through a link to the patient or referring-physician portal, with no CD and no film. Nobody signs anything. And if nobody signs anything, responsibility for those images is not transferred anywhere: it stays with you.
The practical consequence is uncomfortable but clear. In most Colombian centers, publishing a study to a portal does not release the provider from preserving it. The archive remains theirs, and the relevant period stops being a decision about the image and becomes a consequence of the medical record that underpins it.
On top of that sits a behavior we see in every center we work with: nobody deletes. The minimum period expires and the study is still there, because deleting requires a documented procedure — appraisal, public notices, minutes, disposal by document series and sub-series rather than by isolated document types — and because no medical director wants to be the person who signed off on erasing the study a court asks for two years later.
The result is that an image archive behaves, in practice, as if it were permanent.
Keeping it is no longer enough: now you have to expose it
While the debate over retention periods stayed open, the nature of the obligation changed.
Law 2015 of 2020 created the Interoperability of the Electronic Medical Record (IHCE) and established something that reframes the whole problem: clinical data belongs to the patient, not to the institution that generated it. Resolution 866 of 2021 then regulated the set of relevant clinical data elements for that interoperability, along with the mandatory catalogues (ICD-10, CUPS, IUM).
And Resolution 1888 of 2025, dated 15 September 2025, made the Digital Summary of Health Care (RDA) mandatory within the IHCE framework. Providers were given six months from 15 October 2025 to integrate and interoperate their systems with the defined model, using the HL7 FHIR R4 standard and encrypted transmission to the Ministry’s national platform.
That deadline expired on 15 April 2026. This is not a future obligation being prepared for — it is one already running.
For an imaging service the underlying shift is this: preserving is no longer sufficient. An archive that stores everything but cannot deliver structured data to an external platform meets half of what is now required. Conservation and interoperability stopped being two separate projects.
What this means for your storage
The useful reading of all this regulation fits in one sentence: the rules require availability and integrity, not immediacy.
Nowhere do they say a nine-year-old study must open in two seconds. They say it must exist, be intact, be authentic and be retrievable. That distinction is exactly what separates a reasonable storage bill from an absurd one.
A study from this week needs to sit in fast storage: it is being read, compared against priors, delivered. A study from nine years ago needs to be available, and a cold archive tier — at a fraction of the cost per terabyte — meets that perfectly.
Paying for high-performance storage to hold 2014 studies is not complying better. It is complying more expensively.
That is why automatic tiering — moving each study to the tier that matches its age and its real retrieval pattern, without anyone deciding study by study — is not an optional technical optimization. It is how you sustain an obligation that lasts fifteen years, or thirty, or forever, without the cost growing at the same rate as the archive.
Six questions to ask your vendor
- What does a terabyte cost at each tier, and what moves a study between tiers? If there is only one price, there is no tiering.
- How long does it take to retrieve a study already in cold archive? Minutes is reasonable. “We don’t know” is not.
- How do you prove the integrity of a ten-year-old study? There must be a concrete technical answer that holds up in an audit.
- What about traceability? Who accessed what and when, across the whole retention period and not just the current year.
- Can the system deliver the structured data the IHCE requires? FHIR R4, not a flat file exported by hand.
- What happens to my archive if the contract ends? Extraction has a cost and a timeline. That number is agreed before signing, not after.
What is coming: a new medical records resolution
In July 2026 the Ministry of Health published for comment a draft resolution that would unify the rules for medical records, paper and electronic, and that would repeal Resolutions 1995 of 1999 and 839 of 2017. The draft keeps the minimum period of fifteen years from last care (five in the active archive and ten in the central archive), the doubling for victims and permanent conservation in crimes against humanity proceedings.
As of October 2026 it is still a draft: until it is published in the Official Gazette, the rules cited in this article are the ones in force. Once it is issued we will update this text, particularly where it concerns the delivery and custody of images, which today depend on article 11 of Resolution 1995.
An honest caveat
This article is technical guidance written from the operation of RIS/PACS systems, not a legal opinion. The interaction between Resolution 1995 of 1999 and Resolution 839 of 2017 has been the subject of formal opinions and differing readings, and your retention policy should be validated with your legal team and with whoever is responsible for records management at the institution, taking into account the document retention schedules that apply to you.
What we do assert without qualification is the technical part: an image archive behaves as permanent, the rules demand availability rather than immediacy, and sizing storage without separating those two facts is the most common way to overpay for a decade.
At NOVA Imaging we design each center’s archive around its real production figures and the conservation period that actually applies to it, not around a sector average. Medical image storage covers how compression, deduplication and automatic tiering work; how much storage your imaging center needs sets out the method for projecting terabytes over ten years; and RIS/PACS cybersecurity explains how that data is protected for as long as you are required to keep it.