Medical records don’t have a single expiration date, but they don’t last forever either. How long medical records are kept depends mostly on state law, with federal rules setting floors for certain providers and record types. For adult patients, most states require healthcare providers to hold records somewhere between five and ten years after your last date of treatment. Children’s records are kept substantially longer. Once the retention period ends, the provider can legally destroy the file, so a chart you assume is still sitting in storage may have been shredded years ago.
Adult Records: Five to Ten Years in Most States
No single federal law sets one retention period for all patient medical records. State law is the primary authority, and it varies. Most states land somewhere between five and ten years after the patient’s last visit or discharge. Some states sit at the longer end, others at the shorter end and count on providers to hold records longer as their own protection against malpractice claims.
Because the exact number depends on where you were treated, the safest approach is to request copies of anything you might need well before the retention period could plausibly run out. Waiting until you need them is how people discover the records are already gone.
Children’s Records Are Kept Much Longer
The retention clock for a minor’s records works differently and almost always produces a much longer holding period. In most states, the countdown doesn’t start until the child turns 18. Once the child reaches adulthood, the state’s standard retention period then kicks in on top of that. A newborn’s records in a state with a seven-year retention rule would need to be kept for roughly 25 years.
The reason is practical. Children can’t file legal claims on their own behalf, and a young adult might need records from birth to pursue a malpractice case or simply to establish a health history.
Federal Minimums That Can Extend Retention
Federal law doesn’t set a universal retention period for clinical records, but it does impose floors on certain providers. When federal and state rules overlap, the provider follows whichever demands the longer period.
Hospitals that participate in Medicare must retain all medical records for at least five years.1eCFR. 42 CFR 482.24 – Condition of Participation: Medical Record Services Providers that submit Medicare cost reports must keep patient records for at least five years after the cost report closes, and providers in a Medicare managed care plan must keep records for ten years.2Centers for Medicare & Medicaid Services. Medical Record Retention and Media Format for Medical Records
HIPAA is often assumed to cover this, but it doesn’t require providers to keep your actual medical chart for any specific length of time. What HIPAA does require is that providers retain their own compliance paperwork, such as signed privacy notices, internal policies, and documentation of actions required by the privacy rule, for at least six years from the date of creation or the date the document was last in effect.3eCFR. 45 CFR 164.530 – Administrative Requirements That six-year rule protects the audit trail, not your clinical file.
Records With Their Own Retention Rules
A few categories of health information sit outside the general state rules and carry their own federal timelines.
Mammograms
Under the Mammography Quality Standards Act, facilities must keep original mammograms and reports for at least five years. If no additional mammograms are performed at that facility, the retention period extends to at least ten years. If state or local law requires a longer period, the facility must follow that instead.4U.S. Food and Drug Administration. Important Information: Final Rule to Amend the Mammography Quality Standards Act (MQSA) A single mammogram from a facility you never went back to can be on file for a decade or more.
Workplace Exposure Records
If you were exposed to toxic substances or harmful physical agents at work, your employer’s obligations run much longer than anything in clinical medicine. OSHA requires employers to preserve medical records related to such exposures for the duration of your employment plus 30 years. Exposure monitoring records must also be kept for at least 30 years.5Occupational Safety and Health Administration. Access to Employee Exposure and Medical Records These are employment records, not HIPAA-covered records, but other federal laws impose their own confidentiality protections.
Vaccination Records
Federal law doesn’t set a standalone retention period for immunizations. Vaccination data is generally treated as part of your general medical record and follows the state’s retention rule. Separately, most states operate immunization information systems, which are centralized registries that store vaccination data independently of any individual provider, often indefinitely.6Centers for Disease Control and Prevention. Staying Up to Date with Your Vaccine Records
When a Provider Closes or Retires
A provider shutting down a practice doesn’t end the obligation to maintain your records. The retention clock keeps running whether the office doors are open or not. Most states require the departing provider to notify patients, typically at least 30 days in advance, and to explain how patients can obtain or transfer their records. The provider must also arrange for a custodian, whether that’s another practice, a medical records storage company, or a hospital system, to hold the files for the remainder of the retention period.
Enforcement varies. In practice, records from solo practitioners who die unexpectedly or retire without a succession plan are the ones most likely to fall through the cracks. If you learn a former provider has closed, contact your state medical board. Boards typically require departing providers to report who has taken custody of their records, and staff can often point you to the right place.
Getting Copies Before the Retention Period Ends
Federal law gives you the right to your records. Under HIPAA, a provider must act on your request within 30 calendar days, with one possible 30-day extension if they send you a written explanation of the delay within that first month.7U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI Start with the provider’s office, or the health information management department for hospitals. Most require a written request with your full name, date of birth, and the dates of service you’re looking for.
Providers can charge a reasonable, cost-based fee for copying, supplies, and postage, but not for searching for records or verifying your identity. For electronic copies of records already stored electronically, HHS allows a flat fee of no more than $6.50 in lieu of calculating actual costs.8U.S. Department of Health and Human Services. Individuals’ Right Under HIPAA to Access Their Health Information
If the Records Are Already Gone
If the retention period has passed and the file has been destroyed, pieces of your medical history likely still exist in other places.
- Health insurers: Claims records include diagnosis codes, procedures, and dates of service. Not clinical notes, but enough to reconstruct a timeline.
- Pharmacies: Prescription records are typically stored for years and document what you took and when.
- Labs and imaging centers: If your provider ordered tests from an outside facility, that facility keeps its own copy on a separate retention schedule.
- Other providers: Specialists, hospitals, and emergency rooms each keep their own records of visits.
- State immunization registries: Most states operate centralized vaccine databases that store records independently of any single provider.6Centers for Disease Control and Prevention. Staying Up to Date with Your Vaccine Records
Your own paperwork can help too. If you deducted medical expenses on your federal tax return, the IRS recommends keeping supporting records for at least three years after filing, and up to seven years in certain situations.9Internal Revenue Service. How Long Should I Keep Records Personal copies of bills and receipts can serve as a partial backup when a provider’s file is gone.