How Long Are Medical Records Kept? Retention Laws by State?
Learn how long hospitals and doctors keep medical records. Complete guide to medical records retention laws by state, federal requirements, and what happens to old records.
Loading...
Related medical records and patient rights resources.
Learn how long hospitals and doctors keep medical records. Complete guide to medical records retention laws by state, federal requirements, and what happens to old records.
How long your records exist depends on what state you live in, who treated you, and whether you were a minor. Know this before you need records for a lawsuit, disability claim, or new doctor.
Your provider is not required to keep your records forever. Most states set a minimum of 5–10 years after your last visit—but that clock has already been running. If you need records from a hospital stay in 2014, a closed practice, or a childhood surgery, you may be racing against a destruction deadline. State law governs retention. Federal HIPAA rules do not set a minimum. And your provider does not have to warn you before they shred.
For adults: Most states require medical records to be kept 5-10 years after the last treatment date.
For minors: Records are typically kept until the patient reaches age 18-28, depending on the state.
Federal rules set a floor in some situations—but state law usually goes higher. When they conflict, providers must follow whichever requires the longer retention period. Here is what each federal rule actually says:
HIPAA does not set a retention period for actual medical records. It requires HIPAA-related documentation—policies, procedures, signed authorizations—to be kept for 6 years. Actual record retention is determined by your state.
Providers who participate in Medicare or Medicaid must retain records for 5 years from the date of service (or longer if required by state law).
Employee medical records must be retained for the duration of employment plus 30 years.
Health plan records under ERISA must be retained for 6 years.
When federal and state requirements conflict, providers must follow whichever demands the longer retention period. Many providers voluntarily keep records well beyond the minimum—electronic storage is cheap, and early destruction creates liability exposure.
State minimums vary from 5 years (Virginia, Nevada, Kentucky) to 11 years (North Carolina). Pediatric records are held even longer—some states require them until age 28 or 31. Find your state below.
| State | Adult Records | Minor Records | Notes |
|---|---|---|---|
| Alabama | 6 years | Age 19 or 6 years, whichever is longer | From last treatment date |
| Alaska | 7 years | Age 20 or 7 years | — |
| Arizona | 6 years | Age 21 | From discharge or last treatment |
| Arkansas | 5 years | Age 22 | Master index retained 25 years |
| California | 7 years | Age 19 or 7 years | Some records 25 years |
| Colorado | 10 years | Age 21 or 10 years | — |
| Connecticut | 7 years | Age 18 or 7 years | — |
| Delaware | 7 years | Age 18 or 5 years | — |
| Florida | 7 years | Age 25 | 5 years for physicians |
| Georgia | 10 years | Age 18 or 5 years | — |
| Hawaii | 7 years | Age 25 | — |
| Idaho | 10 years | Age 21 or 10 years | — |
| Illinois | 10 years | Age 23 | Hospital records |
| Indiana | 7 years | Age 18 or 7 years | — |
| Iowa | 10 years | Age 21 or 10 years | — |
| Kansas | 10 years | Age 19 or 10 years | From discharge |
| Kentucky | 5 years | Age 19 | — |
| Louisiana | 10 years | Age 21 or 10 years | — |
| Maine | 7 years | Age 25 | — |
| Maryland | 5 years | Age 21 or 5 years | — |
| Massachusetts | 7 years | Age 28 | — |
| Michigan | 7 years | Age 26 or 10 years | — |
| Minnesota | 7 years | Age 21 | — |
| Mississippi | 10 years | Age 21 | — |
| Missouri | 7 years | Age 23 | — |
| Montana | 10 years | Age 25 | — |
| Nebraska | 10 years | Age 28 | — |
| Nevada | 5 years | Age 23 | — |
| New Hampshire | 7 years | Age 18 or 7 years | — |
| New Jersey | 7 years | Age 23 | 10 years for hospitals |
| New Mexico | 10 years | Age 28 | — |
| New York | 6 years | Age 21 or 6 years | Hospitals retain longer |
| North Carolina | 11 years | Age 30 | — |
| North Dakota | 10 years | Age 21 | — |
| Ohio | 6 years | Age 18 or 6 years | — |
| Oklahoma | 7 years | Age 21 or 7 years | — |
| Oregon | 7 years | Age 18 or 7 years | — |
| Pennsylvania | 7 years | Age 21 or 7 years | — |
| Rhode Island | 5 years | Age 23 | — |
| South Carolina | 10 years | Age 31 | — |
| South Dakota | 10 years | Age 21 | — |
| Tennessee | 10 years | Age 19 or 10 years | — |
| Texas | 7 years | Age 20 | 10 years for hospitals |
| Utah | 7 years | Age 22 | — |
| Vermont | 10 years | Age 28 | — |
| Virginia | 5 years | Age 18 or 5 years | — |
| Washington | 10 years | Age 21 | — |
| West Virginia | 10 years | Age 20 or 10 years | — |
| Wisconsin | 5 years | Age 19 or 5 years | — |
| Wyoming | 10 years | Age 28 | — |
* Retention periods are minimum requirements. Many providers keep records longer. Contact the specific provider to confirm their retention policy.
Where you were treated matters as much as where you live. State law often sets different minimums for hospitals versus private practices—and some providers operate under federal rules that override state law entirely.
Typically have the longest retention periods (often 10+ years). Many large hospital systems keep records indefinitely in electronic systems.
Usually follow state minimums (5-10 years). Private practices may destroy records when the practice closes.
Lab results are typically retained 2-10 years depending on the test type and state requirements.
Prescription records are usually kept 2-5 years, with controlled substance records retained longer (up to 7 years).
Psychotherapy notes may have different (sometimes longer) retention requirements than general medical records.
X-rays, MRIs, and CT scans are often kept 5-7 years. Mammograms may be kept longer for comparison purposes.
Records for minors are typically kept until the patient reaches the age of majority (usually 18) PLUS the standard adult retention period. Some states extend this to age 28-31.
If a provider is notified of potential or pending litigation, they must preserve all related records until the matter is resolved—regardless of standard retention periods.
Most states require records to be retained for the same period after death as they would be for a living patient's last treatment.
When a practice closes, records must still be retained for the required period. They're typically transferred to another provider, a custodian, or a records storage company.
Once the retention period expires, a provider has no legal obligation to keep your records. They can destroy them immediately—as long as they do it in a way that prevents unauthorized disclosure.
If a provider has destroyed your records after the retention period, you have limited options:
Request copies after any major treatment and store them yourself. Patient portals let you download records immediately—use that option. A provider who closes, merges, or hits the retention limit takes your records with them. Your personal copy doesn't expire.
Old records are harder to get but not impossible. The key is knowing where to look—and knowing that providers often hold records longer than required because storage is cheap and liability from early destruction is real.
Even if years have passed, they may still have your records. Many providers keep records longer than required.
If the practice closed, records may have been transferred. The state medical board may know where records went.
Specialists, labs, or hospitals who received referrals may have copies of relevant records.
Health insurers keep claims data that may include diagnosis codes, procedures, and provider information.
Professional services have experience tracking down old records and navigating closed practices.
Most states require adult records for 5–10 years after your last treatment. The range is wide: Nevada requires just 5 years, North Carolina requires 11. Pediatric records are kept until age 18–28 depending on state, which is consistently longer. See the state-by-state table for your specific minimum.
Hospitals typically keep records 7–10 years after your last treatment. Several states set a higher standard for hospitals than for private offices—Texas hospitals must keep records 10 years, while private physicians there are only required to keep them 7. Large hospital systems often keep records indefinitely in electronic form.
Sometimes. State law only requires 5–10 years, so you're outside the minimum. But many providers keep records longer—especially hospital systems. Call the original provider first. If the practice closed, check for practice transfers and your state medical board. A records retrieval service can investigate channels you may not know about.
Once destroyed, those records are gone. Providers must use HIPAA-compliant methods—shredding, burning, electronic purging—but they don't have to notify you first. If your primary records are gone, check with the insurance company that paid the claims, specialists who received referrals, or labs that ran tests. Those secondary sources sometimes have copies.
Yes. Records for minors are kept until the patient reaches the age of majority (usually 18) PLUS the standard adult retention period. Many states require pediatric records until age 21-28.
No. HIPAA does not set a minimum retention period for your actual medical records—only for the administrative paperwork around them (authorizations, privacy policies). Record retention is entirely governed by state law. This is a common misconception. Learn more about your HIPAA rights.
The records don't disappear when the practice does—they must still be retained for the legally required period. They're typically transferred to another provider, a medical records custodian, or a storage company. Your state medical board tracks where records went when practices close. See our guide on getting records from closed hospitals.
Medicare and Medicaid require providers to retain records for at least 5 years from the date of service. For ongoing treatments, the 5-year clock starts when treatment ends.
Old records get harder to find every year—closed practices, merged hospital systems, transferred custodians. The sooner you request, the better your odds. We navigate all of it.